Lion Cipher Lab
Build a CVE watchlist for your own stack: scope the NVD firehose to the software you actually run
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Somewhere around a hundred new CVEs are published every day, and not one of them is addressed to you. Most people react to that by following a feed, feeling anxious for a fortnight, and then quietly muting it — which is worse than following nothing, because now you believe you are covered. The fix is not more feed; it is scope. If you know what you run, you can ask the National Vulnerability Database a much better question: not 'what came out today?' but 'what came out today that touches MY stack?' That question has an answer measured in single digits, and single digits are actionable. This…
What you'll learn
- building an asset inventory that vulnerability intel can actually be scoped to
- reading and finding CPE names with the NVD Products API
- knowing the ways CPE matching lies to you, and designing around them
- querying the NVD 2.0 CVE API with cpeName, virtualMatchString and a lastMod window
- paging a REST API with resultsPerPage and startIndex, politely
- enriching CVEs with the CISA KEV catalog and EPSS from Python
- ranking KEV then EPSS then CVSS, and defending that order
- diffing against a state file so a daily digest only shows what is new
- recognising the NVD enrichment backlog, rejected CVEs and other honest failure modes
Steps in this lab
- The problem: a hundred CVEs a day, none of them addressed to you
- Start with the inventory, not the feed
- What a CPE is, and how to find the right one for your product
- Why CPE matching lies to you — and how to design around it
- Set up: a folder, a virtual environment, requests, and an optional API key
- One query by hand: read the envelope before you automate it
- The fetcher: assets as data, a bounded window, paging, and a sleep you must not delete
- Parsing: getting a CVSS score out of a metrics block that is not all CVSS
- Enrich: KEV for fact, EPSS for probability
- The ranking rule: KEV, then EPSS, then CVSS — and why never CVSS alone
- Outputs, a state file, the two-run proof, and a daily schedule
- The honest failure modes — and where the shortlist goes next