Track CISA Known Exploited Vulnerabilities

CISA KEV status is a useful triage signal because it records known exploitation and a required action date. It is still not an asset match. Filter to KEV, then intersect affected CPEs or product keywords with systems you actually operate.

Use the NVD CVE Scraper to make that search reproducible. Save the exact filters and result cap as a Task rather than editing a one-off query every time.

Turn the search into a decision

Prioritize records that are both relevant to an owned asset and high impact. Keep the CVSS vector, not only the score, because attack complexity and required privileges often change the remediation decision.

Create explicit inclusion columns such as is_in_scope, owner, and review_reason. Keep them in a derived table, not in the raw source rows. This makes it possible to rerun qualification rules without losing the original evidence.

Sample ten included and ten excluded records. If exclusions are caused by missing upstream fields, do not silently treat those fields as false. Put them in a review queue or document the assumption.

Refresh without creating duplicates

The record key is cve_id. Upsert on that key and record the collection timestamp separately. A recurring workflow should distinguish a newly published record from an older record whose metadata changed.

CVSS is technical severity, not your business risk. Join results to an asset inventory and consider exposure, exploit status, ownership, and compensating controls before opening remediation tickets.

The practical payoff is a smaller, explainable queue. The source query finds candidates; the qualification layer decides which candidates deserve attention. Mixing those two jobs into one opaque keyword search makes both harder to audit.