cveIntelligence

Response Center-owned exploitation and official KEV intelligence for one CVE indicator.

Examples

type CveIntelligence {
  exploitationStatus: CveExploitationStatus!
  firstReportedExploitationAt: DateTime
  firstObservedExploitationAt: DateTime
  kev: CisaKevObservation!
  euKev: EuKevObservation
  articleEvidence: [CveArticleEvidence!]!
}

Fields

Field	Description	Supported fields
exploitationStatus CveExploitationStatus!	Confirmed for current CISA or EU KEV membership, reported for supported reporter evidence, observed for VulnCheck sensor telemetry, or unknown.
firstReportedExploitationAt DateTime	The earliest publication date among sources reporting real-world exploitation activity.
firstObservedExploitationAt DateTime	The earliest exploitation observation date explicitly stated by a source.
kev CisaKevObservation!	The current CISA KEV observation retained for the CVE.	status CisaKevStatus! checkedAt DateTime! catalogFetchedAt DateTime catalogVersion String dateReleased String dateAdded String dueDate String requiredAction String knownRansomwareCampaignUse String
euKev EuKevObservation	Independent official EU KEV assertion; retained alongside CISA when both list the CVE.	status EuKevStatus! checkedAt DateTime! catalogFetchedAt DateTime source String! sourceDisplayName String! cve String euvdId String dateReported String originSource String exploitationTypes [String!]! threatActors [String!]! notes String
articleEvidence [CveArticleEvidence!]!	The analyzed source articles that reference the CVE.	sourceUrl String! sourcePublishedAt DateTime analyzedAt DateTime! analysisVersion String! articleTypes [String!]! classificationConfidence String! claims [CveExploitationClaimEvidence!]!

References

Fields with this object:

• {} Indicator.cveIntelligence

• {} ExtractedIndicator.cveIntelligence