{"repo":"manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator","free":true,"listed":false,"github":"https://github.com/manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator","clone":"git clone https://github.com/manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator.git","description":"Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma detection rules, automatically, every week.","language":null,"stars":38,"topics":["agentic-ai","automation","cisa-kev","cybersecurity","n8n","threat-intelligence","sigma-rules","soc-analyst"],"license":null,"category":"workflow-automation","readme_excerpt":"CISA KEV Threat Intel Orchestrator ⭐ Featured In. Featured and shared within the Detection Engineering and Blue Team community. --- \"I love your kev tool, just shared it internally with our detection teams, thanks!\" Claus Cramon Houmann, Security Professional --- Publication Description ------------- ------------- 📰 TL;DRSec Featured in the Blue Team section for automating CISA KEV intelligence into Sigma detection rules. 📰 Detection Engineering Weekly Featured as an innovative detection engineering workflow for automated Sigma rule generation. Zero-touch pipeline that turns newly weaponized CVEs from the CISA Known Exploited Vulnerabilities (KEV) catalog into production-ready Sigma detection rules, automatically, every week. The problem Manually turning a new KEV entry into a usable detection is slow: check the advisory, research the attack pattern, write a Sigma rule, test it, brief the team. That's roughly 4-6 hours per CVE. Ten new entries in a week is a full week of work, and most SOCs don't have a spare analyst-week lying around every Monday. What this does Every Monday at 8:00 AM, the pipeline: 1. Pulls the live CISA KEV catalog and isolates newly added, weaponized CVEs since the last run. 2. Generates a Sigma detection rule per CVE using Google Gemini, constrained by a structured prompt that forces the model to: - target the exact product/vendor named in the CVE (not a generic placeholder rule) - use the correct Sysmon EventIDs for the technique (process creation, n","default_branch":null,"files":null,"tree":[],"storefront":"/r/manishrawat21","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/manishrawat21/Cisa-KEV-Threat-Intel-Orchestrator/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}