CVE Feed & Correlation

The CVE Feed module pulls vulnerability data from the NVD NIST National Vulnerability Database in real-time and correlates it with your declared technology stack. When a new CVE affects software you run, CheckOps alerts you immediately.

Plan requirement: PRO and above. Enterprise includes all CVSS scores and SIEM integration.

HOW IT WORKS

1. Stack declaration — You declare your technology stack (frameworks, libraries, OS, databases)
2. Continuous ingestion — CheckOps Toolbox ingests CVEs from NVD NIST feed in real-time
3. Matching — New CVEs are matched against your declared stack using CPE (Common Platform Enumeration)
4. Correlation — Matched CVEs are correlated with uptime data to assess exposure risk
5. Alerting — Notifications are sent for CVEs matching your severity threshold

CVE DATA

Each CVE entry includes:

Field	Description
cve_id	CVE identifier (e.g., CVE-2024-12345)
description	Vulnerability description
cvss_score	CVSS v3.1 base score (0.0 - 10.0)
severity	CRITICAL, HIGH, MEDIUM, LOW
cpe_match	Affected software identifiers
published	Publication date
kev	Whether it appears in CISA KEV catalog
references	Links to advisories and patches

SEVERITY THRESHOLDS BY PLAN

Plan	Minimum CVSS Score	KEV Alerts	SIEM Export
PRO	7.0 (High+)	Yes	No
ENTERPRISE	All scores	Yes	Yes

KEV (KNOWN EXPLOITED VULNERABILITIES)

CVEs listed in the CISA KEV catalog are flagged with a special indicator. KEV entries are actively exploited in the wild and should be treated as immediate priority regardless of CVSS score.

STACK DECLARATION

Declare your stack from the CVE Feed settings page:

{
  "stack": [
    { "vendor": "apache", "product": "httpd", "version": "2.4.58" },
    { "vendor": "postgresql", "product": "postgresql", "version": "16.2" },
    { "vendor": "nodejs", "product": "node.js", "version": "22.3.0" },
    { "vendor": "openssl", "product": "openssl", "version": "3.2.1" }
  ]
}

Version ranges are supported: >=16.0,<16.3 will match any CVE affecting PostgreSQL 16.0 through 16.2.

UPTIME CORRELATION

The unique value of CheckOps CVE Feed is correlation with your uptime data:

• A CRITICAL CVE on a service that is publicly reachable and currently UP = immediate risk
• A HIGH CVE on an internal service behind a firewall = lower urgency
• A CVE on a service that is currently DOWN for maintenance = deferred action

The correlation engine adjusts the effective risk score based on exposure, helping you prioritize remediation.

ALERTS

CVE alerts are sent through your configured notification channels (webhooks, Slack, PagerDuty). Each alert includes:

• CVE ID and description
• Affected component in your stack
• CVSS score and severity
• KEV status
• Correlated monitor status
• Direct links to advisories and patches