nistnvd-integration

name	nistnvd-integration
description	NIST NVD CVE lookups via Analysi for SOC alert triage. Use when investigating vulnerability-related alerts, checking CVE severity and CVSS scores, correlating exploit attempts with known vulnerabilities, assessing patch urgency, or enriching alerts with affected product details and CISA KEV status.
version	0.1.0

NIST NVD CVE Lookup — Analysi Integration

Query NIST National Vulnerability Database for CVE details during alert triage. One action available: cve_lookup. Public API, no credentials required (optional API key for higher rate limits).

Reference Loading Guide

Reference	Read when	Consult for
references/actions-reference.md	Calling cve_lookup or interpreting results	Parameters, response schema, field tables, CVSS/CISA KEV access, safe lookup pattern, error handling, rate limits
references/investigation-patterns.md	Building CVE enrichment tasks or workflows	Cy task templates, multi-source correlation, severity decision trees, CVSS disposition heuristics, data samples

Decision Path

• Alert contains a CVE ID → Extract from IOCs, primary_ioc_value, or rule name; call cve_lookup; assess severity via CVSS and CISA KEV
• CVSS ≥ 9.0 or CISA KEV present → Flag as urgent, recommend immediate patching
• Exploit attempt detected → Look up targeted CVE, check CISA KEV for active exploitation, correlate CVSS attack vector with observed traffic
• Multiple CVEs in alert → Loop through each; prioritize CISA KEV entries first, then by CVSS score
• CVE not found in NVD → Recently reserved or rejected; flag for manual review
• No CVE ID in alert → This integration cannot help; pivot to threat intel (VirusTotal, AbuseIPDB) or SIEM (Splunk)

Quick Reference

Call syntax: app::nistnvd::cve_lookup(cve="CVE-2021-44228") — always wrap in try/catch and check result.not_found (see actions-reference.md § Safe Lookup Pattern). CVSS data: result.cvss_metrics.base_score / .base_severity. CISA KEV: result.cisa_kev (null when not in catalog).

Guardrails

• Single action only — cve_lookup by exact CVE ID. No keyword search, no CPE/product search, no bulk query endpoint.
• Rate limit — 5 req/30s without API key; 50 with key. Built-in retry (3 attempts, exponential backoff 2–10s) handles 429s.
• Response size — full_data field contains the entire raw NVD API response (100KB+). Never pass to LLM — use extracted top-level fields.
• CVSS version — Returns CVSS v3.1 when available, falls back to v2 for older CVEs. CVSS v4.0 is present in NVD but not extracted.
• Older CVEs — CVSS v2 has fewer fields and no CRITICAL severity; see actions-reference.md § CVSS v2 Fallback.
• CISA KEV — cisa_kev is null unless the CVE is in the Known Exploited Vulnerabilities catalog. The due_date field may also be null.