ENISA Publications Metadata Scraper

Keep an ENISA guidance inventory current without manually copying publication cards. Collect official publication titles, dates, report types, intended audiences, languages, topic labels and original document links for cybersecurity governance and regulatory research workflows.

This is a bounded metadata service for CRA/NIS2 compliance analysts, security governance teams and product-policy researchers. Original publications remain freely available at ENISA. No CVE analysis, compliance conclusions or risk scores are provided.

Quick start

Run the default input for up to ten records from the first unfiltered catalog page. Or provide an exact publication landing page:

{"discoverRecent":false,"publicationUrls":["https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook"],"maxItems":1}

Use publishedSince (inclusive YYYY-MM-DD) and topicKeywords to filter locally. Keywords match official topic labels, not inferred classifications. Explicit URLs are inspected first. A run inspects at most 30 detail pages, returns at most 30 records, and never follows related publications. Zero matches is a valid outcome, not a statement that no relevant publications exist.

Output

Each default-dataset record contains source, canonical url, slug, title, publishedDate, publicationType, audiences, languages, topics, agencyDescription (plain text from the landing-page description), downloadLinks (URL and source language), relatedPublicationUrls, additionalResourceLinks, sourceStatus, observedAt, attribution, freeSourceNotice, and diagnostics. Missing scalar values are null; missing lists are empty. Publication dates come only from the main publication date, never related-card dates. Source status means a public landing page was retrieved, not legal effectiveness or report currency. Document links are emitted but never fetched.

RUN_REPORT in the default key-value store records complete/stopped state, errors, request counts, checked/emitted/filtered counts and documentsFetched=0. Layout mismatches, denied requests and transport failures stop the run and fail the Actor; previously emitted records may remain. Empty results should be checked against this report. No full-archive completeness claim is made.

Access and scope

Only https://www.enisa.europa.eu/robots.txt, the plain /publications catalog, and strict /publications/slug paths are fetched. No query strings, search, pagination, configurable scraping proxies, redirects, authentication, assets, images, PDFs or downloads. Standard runtime network transport is retained. Requests are sequential, at least two seconds apart, honor applicable robots rules and crawl delays, and stop on HTTP errors including 403/429. Responses are capped at 2 MB; at most 32 requests are normally possible (robots + catalog + 30 details). A source change may require maintenance.

Attribution and reuse

Source: European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/publications . ENISA's legal notice, section 1.2, authorizes site-material reproduction with source acknowledgement unless otherwise indicated. Every record retains attribution. No endorsement is implied.

Original publication is freely available from ENISA; this service structures its public publication metadata. Some individual reports have additional terms, including free-access conditions. This Actor does not download, parse, repackage or sell report text/PDFs, logos, photos or third-party assets. Check each original document's terms before reusing its content; no uniform archive commercial license is claimed.

Product qualification

Compliance.ai's commercial regulatory-content coverage explicitly lists EU-ENISA reports, research publications and guidance (Agency_ID 33100017). That supports professional monitoring demand, not proven paying Actor customers. Apify Store searches checked 2026-10-05 found no dedicated ENISA publication inventory. The relevant garonne/cve-exploited-check covers CVE exploitation via EUVD, a distinct task. Generic web crawlers can extract pages, but require source-specific work for discovery, typed audience/language/report metadata and main-document versus related-link separation. Store coverage can change.

Local validation

Python 3.12: pip install -r requirements.txt, then python -m unittest tests -v. Tests embed compressed original HTML/robots fixtures retrieved 2026-10-05 from the catalog and two cited sample publication pages; no fixture network access is required. Run python main.py for the Apify SDK entry point. Production source-access success must be verified separately in the target cloud runtime.