Workflow · v1.0.0
Find known exploited packages
Checks every installed package against OSV.dev, then each of its CVEs against CISA's Known Exploited Vulnerabilities catalogue, and files what is known to be exploited in a tracked table — so a newly listed one is a change the kev-package-found alert rule raises.
Use cases
- Reads the package inventory keystone/linux package_inventory writes.
- Needs the data sources osv and cisa-kev (Administration → Data Sources → presets).
Included in packs
Each of these packs carries this workflow, so installing the pack installs it too.
- Security monitoringExposure out of the box: TLS discovery with its endpoints and every certificate they present tracked — key and signature algorithms, hybrid and post-quantum included, and which are quantum-vulnerable — a Linux package inventory, a daily workflow that checks the inventory against OSV.dev and…
kevpackages