/ writing / security

Threat intel means juggling three dashboards. One actor shouldn't.

2026-08-27 · cynix · 4 min read

When "Log4j" breaks, every CISO needs the same answer fast: every CVE, every malware URL, every recent disclosure. Usually that's three browser tabs — NVD, CIRCL, URLhaus — stitched together by hand. You just want: "enumerate CVEs for my stack and show me what malicious URLs are trending."

Security / CTI Enrichment Pack fuses the key open feeds into one actor with one flat record shape. Search by CPE or keyword, pull recent CVEs, pull trending malware URLs.

Sources & what you get

Source	What you get
NVD	US NIST CVE database: ID, CVSS severity, published date, description
CIRCL CVE API	Most-recent CVEs with CVSS and summaries
URLhaus (abuse.ch)	Recent malware URLs, parsed from the CSV feed into typed rows

Example output

{
  "query": "log4j",
  "source": "NVD",
  "id": "CVE-2021-44228",
  "severity": "CRITICAL",
  "published": "2021-12-10T00:00:00.000",
  "detail": "Apache Log4j2 JNDI features do not protect...",
  "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "attribution": "NVD (NIST, public domain)"
}

Every run also emits a RUN_SUMMARY row reporting per-source hit counts, so an empty result is explicit ("no matches") rather than a silent source failure.

Why this over the dashboards?

One query, three feeds — NVD CVEs, CIRCL recent, URLhaus URLs in a single pull.
Typed, flat output — one record shape across all sources; pipe it straight into a SIEM or digest.
Schedulable + webhook — run hourly, alert on new CVEs for your products.
No API key, no proxy — all three are free open-security endpoints.
Attribution per row — every record carries its real source credit.

Use cases

Vulnerability triage — enumerate CVEs for a product you run.
Threat-intel feeds — pipe recent CVEs / malware URLs into alerting.
Daily exposure digest — schedule a run, watch new CVEs for your stack.
Incident response — confirm whether a flagged CVE or URL is known.

Try it: Security / CTI Enrichment Pack on Apify — three feeds, one schema, keyless, schedulable.