| name | cve-deep-dive |
| description | Perform detailed analysis of specific CVE vulnerabilities with IOC extraction, exploit assessment, and structured output. Use when analyzing specific CVEs for threat intelligence or incident response.
|
CVE Deep Dive
Comprehensive vulnerability analysis for specific CVEs. Goes beyond basic NVD data to provide actionable intelligence.
Workflow
- Identify — Parse CVE ID from task
- Query NVD — Get base CVSS, description, affected products (CPE)
- Check OpenCTI — Cross-reference with platform data for relationships
- Research — Search for exploit PoCs, advisories, vendor patches
- Extract IOCs — Pull indicators from references and advisories
- Assess — Determine real-world risk considering exploit availability and exposure
- Report — Generate structured analysis using template
Analysis Template
Use assets/cve-analysis.md for output formatting.
Scripts
Query NVD API
bash scripts/query-nvd.sh CVE-2026-XXXXX
Key Data Points to Extract
- CVSS v3.1 score and vector — base, temporal, environmental
- Affected products — CPE strings, version ranges
- Exploit availability — PoC on GitHub/ExploitDB, in-the-wild status
- CISA KEV status — is it in the Known Exploited Vulnerabilities catalog?
- EPSS score — probability of exploitation
- Patch status — vendor advisory links, fixed versions
- MITRE ATT&CK mapping — relevant techniques
- IOCs — IPs, domains, hashes associated with exploitation
References
See references/nvd-api.md for NVD API documentation.
