soc security ops

The problem

Security teams and solo developers waste hours manually checking CVE databases and scrolling through noise-heavy threat news to see if their specific stack is at risk.

What it does

• Monitors the CISA KEV catalog against a local watchlist of your vendors and products.
• Enriches vulnerability alerts with FIRST.org EPSS exploit probability scores and ransomware indicators.
• Aggregates and dedupes security news from five major sources including The Hacker News and BleepingComputer.
• Provides a structured decision framework for software updates with clear safety verdicts.

Frameworks & tools

Python 3 (Standard Library only), CISA KEV JSON, FIRST.org EPSS API.

Why this beats prompting it yourself

This skill provides a pre-configured monitoring pipeline that requires zero API keys and runs entirely client-side. It replaces vague "check for news" prompts with specific, repeatable workflows and exit-code-driven automation for cron jobs.

Use cases

• Automate a daily morning check for actively exploited vulnerabilities in your specific production stack.
• Generate a clean, deduped daily cyber threat briefing for your team.
• Evaluate incoming update notifications to determine if they are urgent security patches or optional feature releases.

Known limitations

KEV absence does not guarantee safety. The threatline.io source relies on a Val Town endpoint that may experience downtime. The Hacker News Feedburner source may have high latency.