CISA Known Exploited Vulnerabilities

Threat Intelligence

Overview

The CISA Known Exploited Vulnerabilities (KEV) Connector integrates with the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog data feed. The catalog is a public, authoritative list of CVEs that CISA has confirmed are being actively exploited in the wild, along with the remediation action and federal compliance due date for each.

The connector downloads the catalog feed (a single JSON document, optionally gzip-compressed), parses every catalog entry, and emits one Exploited Vulnerability record per CVE. These records map to the Brinqa Unified Data Model (UDM) CveRecord model, enriching CVE records in the platform with CISA's actively-exploited flag, the CISA-mandated remediation action, and the federal remediation due date. This connector is a Threat Intelligence data source.

Data retrieved from CISA Known Exploited Vulnerabilities

Connector Object	Required	Maps to Data Model
Exploited Vulnerability	Yes	Cve Record

note

For detailed steps on how to view the data retrieved from CISA Known Exploited Vulnerabilities in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select CISA Known Exploited Vulnerabilities from the Connector dropdown and provide the following:

Setting	Required	Default	Description
CISA URL	No	—	CISA data feeds base URL

Authentication

The CISA KEV catalog feed is a public, unauthenticated resource. No API key, token, or credentials are required. The connector issues a plain HTTPS GET against the CISA base URL and includes an X-Requested-With identification header.

Endpoint

Method	URL
GET	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Request Headers

Header	Value	Description
X-Requested-With	brinqa	Identifies the client making the request.

Request Body

None. The feed is retrieved with a GET request and no body.

Sample Response

The feed returns a single catalog object containing metadata and an array of vulnerabilities:

{
  "title": "CISA Catalog of Known Exploited Vulnerabilities",
  "catalogVersion": "2024.06.10",
  "dateReleased": "2024-06-10T14:00:00.000Z",
  "count": 1140,
  "vulnerabilities": [
    {
      "cveID": "CVE-2021-27102",
      "vendorProject": "Accellion",
      "product": "FTA",
      "vulnerabilityName": "Accellion FTA OS Command Injection Vulnerability",
      "dateAdded": "2021-11-03",
      "shortDescription": "Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.",
      "requiredAction": "Apply updates per vendor instructions.",
      "dueDate": "2021-11-17"
    }
  ]
}

If the response is served as application/x-gzip, the connector transparently decompresses it before parsing.

Response Fields

Field	Description
catalogVersion	Version identifier of the published catalog.
dateReleased	Timestamp the catalog version was released.
vulnerabilities	Array of exploited vulnerability entries (see Attribute Mapping below).

No token is issued or stored. Because the feed is anonymous, there is no credential reused across subsequent requests; every sync is a fresh anonymous GET.

Sync Behavior

The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.

How to obtain CISA Known Exploited Vulnerabilities credentials

Obtain the required credentials (CISA URL) from your CISA Known Exploited Vulnerabilities administrator or the CISA Known Exploited Vulnerabilities admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Exploited Vulnerability

Source Field Name	SDM Attribute
constant true	EXPLOITED
Vulnerability.cveID	UID
Vulnerability.dateAdded	Date added
Vulnerability.dueDate	DUE_DATE
Vulnerability.product	Product
Vulnerability.requiredAction	Action
Vulnerability.shortDescription	DESCRIPTION
Vulnerability.vendorProject	Vendor or project
Vulnerability.vulnerabilityName	NAME

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Exploited Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint · Endpoint: GET /sites/default/files/feeds/known_exploited_vulnerabilities.json

Changelog

Changelog

The CISA Known Exploited Vulnerabilities connector has undergone the following changes:

Version	Description	Migration Steps
3.0.5	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.4	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.3	Improvements - Standardized the "Date added" field so the date a vulnerability was added to the CISA catalog is now represented as a true date/time value, enabling consistent date-based filtering, sorting, and reporting.	• Exploited Vulnerability: The "Date added" attribute changed from a numeric value to a date/time type. Action: re-sync the connector so existing records are refreshed with the updated field type.
3.0.2	Improvements - Simplified how each Exploited Vulnerability record is uniquely identified, making correlation of catalog entries more reliable and consistent with platform conventions.	• Exploited Vulnerability: The record identifier configuration changed. Action: re-sync the connector so existing records are matched and updated correctly.
3.0.1	Improvements - Improved the field and identifier mappings for Exploited Vulnerability records so the "Due date" and "Exploited" fields and record correlation align with current platform standards.	• Exploited Vulnerability: The record identifier mapping changed. Action: re-sync the connector so existing records are matched and updated correctly.
3.0.0	Overview The CISA Known Exploited Vulnerabilities connector integrates with the CISA Known Exploited Vulnerabilities (KEV) Catalog to synchronize the authoritative list of vulnerabilities that are known to be actively exploited in the wild. Category: Threat Intelligence Models	N/A