# CISA KEV Asset Remediation Report (`taroyamada/cisa-kev-asset-remediation-report`) Actor

Compare a bounded buyer-supplied asset inventory with the official CISA Known Exploited Vulnerabilities Catalog. Return conservative potential matches, CISA requiredAction and dueDate evidence, deadline alerts, and review handoffs. Matches are never assertions that an asset is vulnerable or compromi

- **URL**: https://apify.com/taroyamada/cisa-kev-asset-remediation-report.md
- **Developed by:** [naoki anzai](https://apify.com/taroyamada) (community)
- **Categories:** Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $60.00 / 1,000 kev asset potential matches

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## CISA KEV Asset Remediation Report

Security and vulnerability-management teams provide a bounded asset inventory, the actor compares it with the official CISA Known Exploited Vulnerabilities Catalog, and the output is a source-linked review queue containing conservative potential matches, CISA required actions, due dates, deadline signals, and optional exports.

The first `baseline_only` run and every unchanged run produce zero rows and zero charge.

Every match is labeled `potential_match` and `review_required`. The actor never asserts that an asset is vulnerable, compromised, exploitable, compliant, or remediated.

### Store Quickstart

1. Supply one or more assets that your team is authorized to review. Each asset needs `vendor` + `product`, or a CPE 2.3 value.
2. Run the first live check with `initialRunMode: "baseline_only"`. It validates the complete CISA catalog, saves the snapshot, and emits **0 rows / 0 charge**.
3. Reuse the same `monitorKey` for later checks. Use `emit_backfill` for the first comparison that should deliver changed matches.

The smallest useful trial is:

```json
{
  "assets": [{ "assetId": "web-prod-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"] }],
  "monitorKey": "trial-kev-portfolio",
  "initialRunMode": "baseline_only",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 30,
  "emitUnchanged": false,
  "emitExport": false,
  "dryRun": false,
  "maxChargeUsd": 0
}
```

#### Example 1: production inventory

```json
{
  "assets": [
    { "assetId": "web-prod-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"], "environment": "production" },
    { "assetId": "edge-01", "vendor": "Example Vendor", "product": "Example Appliance", "versions": ["4.2"] }
  ],
  "monitorKey": "production-kev-watch",
  "initialRunMode": "emit_backfill",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 45,
  "emitUnchanged": false,
  "emitExport": true,
  "dryRun": false,
  "maxChargeUsd": 30
}
```

#### Example 2: CPE-backed inventory

```json
{
  "assets": [{
    "assetId": "linux-image-01",
    "cpe": "cpe:2.3:a:example:appliance:4.2:*:*:*:*:*:*:*",
    "product": "Example Appliance",
    "vendor": "Example",
    "versions": ["4.2"],
    "environment": "staging"
  }],
  "monitorKey": "staging-kev-watch",
  "initialRunMode": "baseline_only",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 14,
  "emitUnchanged": false,
  "emitExport": false,
  "dryRun": false,
  "maxChargeUsd": 0
}
```

#### Example 3: deterministic dry run

```json
{
  "assets": [{ "assetId": "demo-01", "vendor": "Apache", "product": "Log4j2", "versions": ["2.14.1"] }],
  "monitorKey": "dry-run-demo",
  "initialRunMode": "emit_backfill",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 30,
  "emitUnchanged": false,
  "emitExport": true,
  "dryRun": true,
  "maxChargeUsd": 50
}
```

Dry-run output is deterministic and does not call the network, save state, or charge events.

### Output

`kev_remediation_report` is emitted first. It summarizes changed potential matches. `kev_asset_potential_match` carries the asset join, CISA CVE, vendor/project, product, description, `requiredAction`, `dueDate`, source URL, and explicit review labels. `kev_deadline_alert` carries the due-date window or due-date change reason. `kev_remediation_export` lists the stable keys included in the handoff.

The CISA `requiredAction` and `dueDate` fields are copied as source evidence. `versionMatchStatus` is `not_assessed_from_cisa_catalog`; the CISA feed does not provide enough inventory mapping to prove version applicability.

### Pricing and billing safety

| Event | Price | When it is charged |
| --- | ---: | --- |
| `kev-asset-potential-match` | `$0.06` | A changed conservative potential match is delivered |
| `kev-deadline-alert` | `$0.35` | A changed/new match has a due-date review signal |
| `kev-remediation-report` | `$12.00` | A changed portfolio report is delivered |
| `kev-remediation-export` | `$8.00` | An export handoff is delivered |

There is no start event. A baseline or unchanged run is always 0 rows and 0 charge. The complete unique event plan is checked against `maxChargeUsd` before the first push. Unknown event names, duplicate CVEs, invalid catalogs, state failures, missing charge proof, and budget overruns fail closed.

### Compliance and interpretation guardrails

- Official source: CISA KEV JSON only. No API key is required.
- The buyer must supply an authorized, bounded inventory. The actor does not scan networks or discover assets.
- Every match means `potential_match` and `review_required`, never a confirmed finding.
- Do not use the output as a statement of vulnerability, compromise, exploitability, compliance, legal status, remediation completion, or security advice.
- Review the current official CISA record and internal evidence before assigning work.
- The actor is not affiliated with or endorsed by CISA or the U.S. government.

### See also

For adjacent review workflows, compare this actor with the package portfolio upgrade report and product safety market-action portfolio report. They use similar baseline, change detection, report-first, and fail-closed delivery patterns for different source domains.

See `docs/source-compliance.md`, `docs/integration-guide.md`, and `docs/sample-output.json` for the operational contract.

# Actor input Schema

## `assets` (type: `array`):

Buyer-supplied bounded inventory. Each item needs vendor+product or a CPE 2.3 application/hardware/OS value. Product-name matching is conservative and does not prove applicability.

## `monitorKey` (type: `string`):

Stable key for the saved baseline. Use a different key for an independent inventory.

## `initialRunMode` (type: `string`):

baseline\_only always saves a validated snapshot with 0 rows/0 charge. emit\_backfill emits current changed matches on the first completed run.

## `generateReport` (type: `boolean`):

Emit one report event when changed potential matches exist.

## `emitPotentialMatches` (type: `boolean`):

Emit per-asset potential\_match/review\_required rows for changed matches.

## `includeDeadlineAlerts` (type: `boolean`):

Emit a deadline alert for a changed/new match due within the selected window or with a changed dueDate.

## `deadlineWithinDays` (type: `integer`):

Emit deadline review alerts for changed matches due within this many days.

## `emitUnchanged` (type: `boolean`):

Compatibility field. Unchanged runs always produce 0 rows and 0 charge, even if true.

## `emitExport` (type: `boolean`):

Emit one dataset JSON handoff event after the report and alerts.

## `dryRun` (type: `boolean`):

Use deterministic fixture output without network, state writes, or charges.

## `maxChargeUsd` (type: `number`):

The complete unique event plan must fit this cap before any dataset event is pushed.

## `requestTimeoutSeconds` (type: `integer`):

Maximum time allowed for the official CISA catalog request.

## `rateLimitMs` (type: `integer`):

Minimum delay before an official source retry.

## `maxRetries` (type: `integer`):

Maximum retry count for transient official source failures.

## `backoffBaseMs` (type: `integer`):

Initial exponential backoff delay after a transient source failure.

## `maxBackoffMs` (type: `integer`):

Maximum exponential backoff delay between retries.

## `delivery` (type: `string`):

Deliver to the default dataset or also copy the completed payload to an HTTPS webhook.

## `webhookUrl` (type: `string`):

Optional HTTPS copy after dataset event delivery.

## Actor input object example

```json
{
  "assets": [
    {
      "assetId": "web-prod-01",
      "vendor": "Apache",
      "product": "Log4j2",
      "versions": [
        "2.14.1"
      ],
      "environment": "production"
    }
  ],
  "monitorKey": "production-asset-portfolio",
  "initialRunMode": "baseline_only",
  "generateReport": true,
  "emitPotentialMatches": true,
  "includeDeadlineAlerts": true,
  "deadlineWithinDays": 30,
  "emitUnchanged": false,
  "emitExport": false,
  "dryRun": false,
  "maxChargeUsd": 50,
  "requestTimeoutSeconds": 30,
  "rateLimitMs": 250,
  "maxRetries": 2,
  "backoffBaseMs": 250,
  "maxBackoffMs": 4000,
  "delivery": "dataset"
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("taroyamada/cisa-kev-asset-remediation-report").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("taroyamada/cisa-kev-asset-remediation-report").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call taroyamada/cisa-kev-asset-remediation-report --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,taroyamada/cisa-kev-asset-remediation-report"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/6gr3TidBKn8MHu7LE/builds/V79hgp4cQhhlo8pQ2/openapi.json