<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: correlating-vulnerabilities-with-threat-intel
description: >-
  Correlate vulnerability scan findings with threat intelligence feeds to
  identify actively exploited CVEs, threat actor targeting patterns, and
  contextual risk factors for prioritized remediation.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - threat-intelligence
  - vulnerability-correlation
  - cisa-kev
  - ioc
  - threat-actors
  - otx
  - mitre-attack
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Correlating Vulnerabilities with Threat Intelligence

## Overview

Vulnerability scanners report what is vulnerable; threat intelligence tells you what
attackers are actually targeting. Correlating scan findings with TI feeds — CISA KEV,
AlienVault OTX, MITRE ATT&CK, and commercial threat feeds — transforms theoretical
risk into actionable intelligence. A medium-severity CVE actively exploited by a
ransomware group becomes an immediate priority.

Mode: `[MODE: PURPLE]` — Bridging offensive threat context with defensive prioritization.

## Prerequisites

- Vulnerability scan results (Nessus, Qualys, or OpenVAS format)
- AlienVault OTX API key
- CISA KEV feed access
- Python 3.10+ with `requests`
- Optional: VirusTotal API, MISP instance

## Key Concepts

### Threat Intel Sources

| Source | Type | Update Frequency | Cost |
|--------|------|-----------------|------|
| CISA KEV | Known exploited vulns | Daily | Free |
| AlienVault OTX | Community TI pulses | Real-time | Free |
| MITRE ATT&CK | TTPs and groups | Quarterly | Free |
| NVD | CVE details + CVSS | Continuous | Free |
| VirusTotal | Malware/exploit samples | Real-time | Freemium |
| Mandiant | APT tracking | Daily | Commercial |

### CISA KEV Correlation

```bash
# Download KEV catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" \
  -o /tmp/kev.json

# Cross-reference scan findings with KEV
jq -r '.vulnerabilities[].cveID' /tmp/kev.json > /tmp/kev_cves.txt
comm -12 <(sort /tmp/scan_cves.txt) <(sort /tmp/kev_cves.txt)
```

### AlienVault OTX Integration

```bash
# Search OTX for CVE intelligence
curl -s "https://otx.alienvault.com/api/v1/indicators/cve/CVE-2024-6387/general" \
  -H "X-OTX-API-KEY: $OTX_KEY" | jq '{pulse_count: .pulse_info.count, references: .pulse_info.references}'

# Get related IOCs
curl -s "https://otx.alienvault.com/api/v1/indicators/cve/CVE-2024-6387/malware" \
  -H "X-OTX-API-KEY: $OTX_KEY" | jq '.data[]'

# Search pulses for threat actor context
curl -s "https://otx.alienvault.com/api/v1/search/pulses?q=CVE-2024-6387" \
  -H "X-OTX-API-KEY: $OTX_KEY" | jq '.results[] | {name, tags, created}'
```

### Threat Actor Mapping

```
Correlation enrichment for CVE-2024-6387 (regreSSHion):
├── CISA KEV: Listed (due date 2024-08-15)
├── EPSS: 0.714 (99.2nd percentile)
├── OTX Pulses: 47 (high community interest)
├── Threat Actors: APT28, Lazarus Group (SSH targeting history)
├── Exploit Maturity: Public PoC available on GitHub
├── Ransomware Association: Known initial access vector
└── Priority Override: IMMEDIATE (multi-factor critical)
```

## Workflow

### Step 1: Correlate Scan Results with TI

```bash
node scripts/agent.js --action correlate \
  --input /tmp/scan_cves.json \
  --output /tmp/ti_correlated.json
```

### Step 2: Identify Actively Targeted CVEs

```bash
node scripts/agent.js --action active-threats \
  --input /tmp/ti_correlated.json \
  --output /tmp/active_threats.json
```

### Step 3: Generate Intelligence Report

```bash
cat /tmp/ti_correlated.json | \
  jq '.findings[] | select(.threat_level == "active_exploitation") | {cve, actors, kev, epss}'
```

## Detection

```yaml
title: Correlating Vulnerabilities With Threat Intel Detection
id: 6a2de224-4268-4dbb-a30e-864ef966f1ce
status: experimental
description: Detects suspicious activity related to correlating vulnerabilities with threat intel techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*correlating*vulnerabilities*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

- [ ] All critical/high CVEs correlated with CISA KEV
- [ ] OTX pulse count tracked for trending vulnerabilities
- [ ] Threat actor targeting patterns documented per CVE
- [ ] Exploit maturity assessed (none/PoC/weaponized/active)
- [ ] TI-enriched findings prioritized above scanner-only results
- [ ] Daily automated correlation with updated threat feeds

## References

- [AlienVault OTX API](https://otx.alienvault.com/api)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [MITRE ATT&CK Groups](https://attack.mitre.org/groups/)
- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
