cve-deep-dive

name	cve-deep-dive
description	Perform detailed analysis of specific CVE vulnerabilities with IOC extraction, exploit assessment, and structured output. Use when analyzing specific CVEs for threat intelligence or incident response.

CVE Deep Dive

Comprehensive vulnerability analysis for specific CVEs. Goes beyond basic NVD data to provide actionable intelligence.

Workflow

1. Identify — Parse CVE ID from task
2. Query NVD — Get base CVSS, description, affected products (CPE)
3. Check OpenCTI — Cross-reference with platform data for relationships
4. Research — Search for exploit PoCs, advisories, vendor patches
5. Extract IOCs — Pull indicators from references and advisories
6. Assess — Determine real-world risk considering exploit availability and exposure
7. Report — Generate structured analysis using template

Analysis Template

Use assets/cve-analysis.md for output formatting.

Scripts

Query NVD API

bash scripts/query-nvd.sh CVE-2026-XXXXX

Key Data Points to Extract

• CVSS v3.1 score and vector — base, temporal, environmental
• Affected products — CPE strings, version ranges
• Exploit availability — PoC on GitHub/ExploitDB, in-the-wild status
• CISA KEV status — is it in the Known Exploited Vulnerabilities catalog?
• EPSS score — probability of exploitation
• Patch status — vendor advisory links, fixed versions
• MITRE ATT&CK mapping — relevant techniques
• IOCs — IPs, domains, hashes associated with exploitation

References

See references/nvd-api.md for NVD API documentation.