<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-vulnerability-intelligence
description: >-
  Prioritize vulnerabilities using exploit intelligence, EPSS scores, threat actor
  exploitation data, and CISA KEV catalog. Covers vulnerability-to-threat mapping,
  patch prioritization, and exploit prediction.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - vulnerability-intelligence
  - epss
  - cisa-kev
  - exploit-prediction
  - cvss
  - patch-prioritization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1588.006"]
---
# Analyzing Vulnerability Intelligence

## Overview

Vulnerability intelligence goes beyond CVSS scoring to incorporate exploit
availability, active exploitation data, threat actor targeting patterns, and
predictive scoring (EPSS) for risk-based patch prioritization. This skill covers
querying NVD and CISA KEV, EPSS score integration, exploit-in-the-wild tracking,
and building prioritization matrices that combine technical severity with threat context.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `nvdlib` libraries | Required |
| NVD API key for higher rate limits | Required |
| Access to EPSS API and CISA KEV catalog | Required |
| Vulnerability scanner output (Nessus, Qualys, or similar) | Required |
| Understanding of CVSS v3.1 and CVSS v4.0 scoring | Required |

## Key Concepts

### Prioritization Framework

```
CVSS Base Score (technical severity)
  + EPSS Score (exploitation probability)
  + CISA KEV (confirmed exploitation)
  + Threat Actor Usage (targeted exploitation)
  + Asset Criticality (business context)
  = Risk Priority Score
```

### EPSS (Exploit Prediction Scoring System)

EPSS provides a probability (0-1) that a CVE will be exploited in the next 30
days. Key thresholds:
- **>0.9**: near-certain exploitation — patch immediately
- **0.5-0.9**: high probability — patch within 24-48 hours
- **0.1-0.5**: moderate — patch within standard cycle
- **<0.1**: low probability — schedule for next maintenance window

### CISA KEV (Known Exploited Vulnerabilities)

Mandatory remediation for federal agencies; strong signal for all organizations.
KEV entries confirm active exploitation in the wild with due dates for patching.

## Workflow

### Step 1: Query Vulnerability Data

```python
import requests

def get_epss_scores(cves: list[str]) -> list[dict]:
    """Get EPSS exploitation probability scores."""
    cve_str = ",".join(cves)
    resp = requests.get(
        f"https://api.first.org/data/v1/epss?cve={cve_str}",
        timeout=15,
    )
    data = resp.json()
    return [
        {
            "cve": entry["cve"],
            "epss": float(entry["epss"]),
            "percentile": float(entry["percentile"]),
        }
        for entry in data.get("data", [])
    ]

def check_cisa_kev(cve: str) -> dict:
    """Check if CVE is in CISA KEV catalog."""
    resp = requests.get(
        "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
        timeout=15,
    )
    catalog = resp.json()
    for vuln in catalog.get("vulnerabilities", []):
        if vuln["cveID"] == cve:
            return {
                "cve": cve,
                "in_kev": True,
                "vendor": vuln["vendorProject"],
                "product": vuln["product"],
                "due_date": vuln["dueDate"],
                "description": vuln["shortDescription"],
            }
    return {"cve": cve, "in_kev": False}
```

### Step 2: Build Priority Matrix

```python
def prioritize_vulnerabilities(vulns: list[dict]) -> list[dict]:
    """Score and prioritize vulnerabilities."""
    for vuln in vulns:
        score = 0.0
        score += vuln.get("cvss", 0) * 10  # 0-100 from CVSS
        score += vuln.get("epss", 0) * 100  # 0-100 from EPSS
        if vuln.get("in_kev"):
            score += 50  # KEV bonus
        if vuln.get("exploit_available"):
            score += 30  # Public exploit bonus
        score += vuln.get("asset_criticality", 0) * 20  # 0-100 from asset value
        vuln["priority_score"] = round(score, 1)
        vuln["priority_class"] = (
            "CRITICAL" if score >= 200 else
            "HIGH" if score >= 150 else
            "MEDIUM" if score >= 100 else "LOW"
        )
    return sorted(vulns, key=lambda v: v["priority_score"], reverse=True)
```

### Step 3: Map to Threat Actor Exploitation

```python
def map_vuln_to_actors(cve: str) -> list[dict]:
    """Map CVE to known threat actor exploitation (via ATT&CK)."""
    from attackcti import attack_client
    lift = attack_client()
    vulns = lift.get_enterprise_techniques()
    actors = []
    for tech in vulns:
        refs = tech.get("external_references", [])
        for ref in refs:
            if ref.get("external_id", "") == cve or cve in ref.get("description", ""):
                groups = lift.get_groups_using_technique(
                    refs[0].get("external_id", "")
                )
                actors.extend([g.get("name", "") for g in groups])
    return [{"cve": cve, "threat_actors": list(set(actors))}]
```

## Detection

```yaml
title: Vulnerability Intelligence Detection
id: 7647fb07-354c-44f2-b1e5-af8a4d57e086
status: experimental
description: Detects suspicious activity related to analyzing vulnerability intelligence techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1588.006
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Vulnerability Intelligence Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1588.006 |

## Verification

- [ ] EPSS scores retrieved for vulnerability set
- [ ] CISA KEV catalog checked for confirmed exploitation
- [ ] Priority matrix combines CVSS, EPSS, KEV, and asset criticality
- [ ] Vulnerabilities mapped to known threat actor exploitation
- [ ] Prioritized list actionable for patch management team
- [ ] Intelligence feeds update vulnerability context continuously

## References

- [EPSS](https://www.first.org/epss/)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD API](https://nvd.nist.gov/developers)
- [CVSS v4.0 Calculator](https://www.first.org/cvss/calculator/4.0)
- [Exploit-DB](https://www.exploit-db.com/)
