# CyberPulse CISA KEV Catalog Filter & Analyzer

> CyberPulse CISA KEV Catalog Filter & Analyzer is a paid API for AI agents from cyberpulse-six.vercel.app, paid per call via x402, $0.08/call, status unknown (last checked 2026-09-14).

Filters and analyzes the CISA Known Exploited Vulnerabilities catalog by vendor, product, or time range, returning ransomware-linked flags, CISA due dates, and patch prioritization data.

## Facts

- Endpoint: GET https://cyberpulse-six.vercel.app/api/cyber/cisa-kev
- Price: $0.08/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cyberpulse-cisa-kev-catalog-filter-analyzer-d6548122
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_erxpjNC4qR2ztidlFzjwu

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cyberpulse-cisa-kev-catalog-filter-analyzer-d6548122
```

Example prompt: Pull all CISA Known Exploited Vulnerabilities for Ivanti products added in the last 60 days, flag any tied to ransomware, and sort them by CISA patch due date so I know what to prioritize first.

## When to prefer this

Use this endpoint when you need to filter or prioritize vulnerabilities specifically from the authoritative CISA Known Exploited Vulnerabilities catalog — especially when ransomware linkage, federal patch deadlines, or CISA-mandated remediation timelines are relevant. Prefer this over generic CVE lookup endpoints when your goal is compliance-driven patch prioritization or federally-recognized exploitation evidence rather than broad vulnerability discovery.

## Known failure modes

- No results returned if vendor/product name does not match CISA catalog spelling exactly
- Time range with no new additions returns empty result set
- Stale data if daily sync is delayed
- Invalid date range format returns error
- Rate limiting or payment failure (x402) blocks access

## How this service works

CISA Known Exploited Vulnerabilities (KEV) lookup and patch prioritization. Filter the KEV catalog by vendor, product, or time range; returns ransomware-linked flags, CISA federal due dates, CVSS, and patch priority. Updated daily, for vuln-management and security agents.

## Output

Returns a filtered list of CISA KEV catalog entries matching the query, each including CVE ID, vendor, product, vulnerability description, date added, CISA required remediation due date, ransomware campaign association flag, and patch priority signal. Updated daily from the official CISA feed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "days": {
       "type": "string",
       "description": "Return entries added in last N days — e.g. \"30\" | \"60\" | \"90\" | \"365\" (default: 90)"
      },
      "lang": {
       "type": "string",
       "description": "en | es | fr | de | ja | zh | ko | pt | ar | hi (default: en)"
      },
      "filter": {
       "type": "string",
       "description": "\"ransomware\" to show only ransomware-linked entries | \"recent\" for last 30 days | omit for vendor search"
      },
      "vendor": {
       "type": "string",
       "description": "Vendor or product name to filter — e.g. \"Cisco\" | \"Ivanti\" | \"Microsoft\" | \"Palo Alto\" | \"Fortinet\" | \"MOVEit\""
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "errors": {
     "type": "object",
     "description": "Documented error responses, keyed by HTTP status code",
     "additionalProperties": {
      "type": "object",
      "required": [
       "description"
      ],
      "properties": {
       "example": {
        "type": "object"
       },
       "description": {
        "type": "string"
       }
      }
     }
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "query": "Cisco",
  "entries": [
   {
    "cve_id": "CVE-2023-20198",
    "product": "IOS XE",
    "due_date": "2023-11-17",
    "cvss_score": 10,
    "date_added": "2023-10-17",
    "vendor_project": "Cisco",
    "patch_available": true,
    "ransomware_linked": false,
    "vulnerability_name": "Cisco IOS XE Web UI Privilege Escalation"
   }
  ],
  "kev_count": 14,
  "priority_analysis": {
   "patch_immediately": [
    "CVE-2023-20198 (CVSS 10.0, due 2023-11-17)"
   ]
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cyberpulse-cisa-kev-catalog-filter-analyzer-d6548122/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cyberpulse-six.vercel.app](https://www.zero.xyz/host/cyberpulse-six.vercel.app/llms.txt)