1 min readBy Stackbyte engineeringAPIs
What a CVE Triage response contains
The fields CVE Triage returns for a vulnerability, and how each response shows the age of its data.
CVE Triage is our first API. This post describes the response format as it currently stands. The API is still in development, so field names may change before launch.
Requests
A lookup takes one CVE ID and costs 1 credit. The batch endpoint takes a list of CVE IDs and costs 1 credit for every 10, which suits scheduled jobs that check a full scan report.
Fields
The data section of the response contains the CVSS v3 base score from NVD, the EPSS probability from FIRST, a flag showing whether the CVE is in CISA's Known Exploited Vulnerabilities catalogue, the date it was added, whether a public exploit is known, and the affected product.
Metadata
The meta section lists the sources used, the date the data was last refreshed and the number of credits charged. If one of the sources has not updated overnight, the response uses the most recent good copy and the date shows how old it is.
Output format
Responses are flat JSON with the same field names on every call, so they can go straight into a SIEM, a ticketing rule or a script. A separate endpoint will list CVEs recently added to the KEV catalogue.
To try it before launch, request early access. The draft reference is in the API docs.
Sources
- NVD, National Vulnerability Database
- FIRST, Exploit Prediction Scoring System
- CISA, Known Exploited Vulnerabilities catalogue
- OSV, open source vulnerability database
Spotted an error? Tell us and we will correct it. Our editorial standards are on the About page.