How to Set Up CISA KEV Alerts Without a SIEM (Free, Under 30 Minutes)

CISA publishes the full KEV catalog at a stable public URL. The feed returns a JSON object with a top-level vulnerabilities array. Each entry includes:

{
  "cveID": "CVE-2026-0257",
  "vendorProject": "Palo Alto Networks",
  "product": "PAN-OS",
  "vulnerabilityName": "Palo Alto Networks PAN-OS Authentication Bypass Vulnerability",
  "dateAdded": "2026-05-11",
  "shortDescription": "Palo Alto Networks PAN-OS contains an authentication bypass...",
  "requiredAction": "Apply mitigations per vendor instructions...",
  "dueDate": "2026-06-01",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": ""
}

The feed URL is:

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

CISA also provides a CSV version at the same base path with a .csv extension. The JSON feed is easier to parse programmatically. The baseline detection approach is simple: download the feed, extract all CVE IDs, compare against yesterday's known set, and alert on the difference.

This option works on any Linux or macOS server and requires only Python 3 and an SMTP server or webhook URL for notifications.

Step 1: Create the monitoring script

Save this as kev_monitor.py:

import json
import urllib.request
import os
from datetime import date

KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
STATE_FILE = os.path.expanduser("~/.kev_seen.json")

def fetch_kev():
    with urllib.request.urlopen(KEV_URL) as r:
        return json.loads(r.read())

def load_seen():
    if os.path.exists(STATE_FILE):
        with open(STATE_FILE) as f:
            return set(json.load(f))
    return set()

def save_seen(ids):
    with open(STATE_FILE, "w") as f:
        json.dump(list(ids), f)

def format_alert(entry):
    return (
        f"NEW KEV ENTRY: {entry['cveID']}\n"
        f"  Product: {entry['vendorProject']} {entry['product']}\n"
        f"  Due Date: {entry['dueDate']}\n"
        f"  Action: {entry['requiredAction'][:120]}"
    )

data = fetch_kev()
current_ids = {e["cveID"] for e in data["vulnerabilities"]}
seen_ids = load_seen()
new_entries = [
    e for e in data["vulnerabilities"] if e["cveID"] not in seen_ids
]

if new_entries:
    for entry in new_entries:
        print(format_alert(entry))
    # Add your notification here: email, Slack webhook, PagerDuty, etc.

save_seen(current_ids)

Step 2: Schedule with cron

Run crontab -e and add:

0 8 * * * /usr/bin/python3 /path/to/kev_monitor.py >> /var/log/kev_monitor.log 2>&1

This runs every morning at 8 AM. The script stores the previously seen CVE IDs in ~/.kev_seen.json. On first run, it will report all 1,600+ current entries as new. After that, only genuine additions trigger output.

This option requires no server. GitHub Actions runs the check on a schedule using free tier compute, commits the updated KEV state to your repository, and can trigger a webhook notification on any new entries.

Step 1: Create a private repository named kev-monitor (or add to an existing private repo).

Step 2: Create .github/workflows/kev-monitor.yml:

name: CISA KEV Monitor

on:
  schedule:
    - cron: '0 8 * * *'  # Daily at 8 AM UTC
  workflow_dispatch:

jobs:
  check-kev:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Fetch KEV catalog
        run: |
          curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
            | jq -r '.vulnerabilities[].cveID' | sort > kev_current.txt

      - name: Compare to previous
        run: |
          if [ -f kev_previous.txt ]; then
            NEW=$(comm -23 kev_current.txt kev_previous.txt)
            echo "NEW_ENTRIES<<EOF" >> $GITHUB_ENV
            echo "$NEW" >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
          else
            echo "NEW_ENTRIES=FIRST_RUN" >> $GITHUB_ENV
          fi
          cp kev_current.txt kev_previous.txt

      - name: Notify on new entries
        if: env.NEW_ENTRIES != '' && env.NEW_ENTRIES != 'FIRST_RUN'
        run: |
          curl -s -X POST ${{ secrets.SLACK_WEBHOOK_URL }} \
            -H 'Content-type: application/json' \
            --data "{\"text\": \"New CISA KEV entries detected:\\n${{ env.NEW_ENTRIES }}\"}" 

      - name: Commit updated state
        run: |
          git config user.name "kev-monitor"
          git config user.email "bot@example.com"
          git add kev_previous.txt
          git diff --staged --quiet || git commit -m "KEV state update $(date -u +%Y-%m-%d)"
          git push

Step 3: Add your Slack webhook (or other notification endpoint) as a GitHub Actions secret named SLACK_WEBHOOK_URL.

This workflow commits a sorted CVE ID list daily and diffs it against the previous run. New entries trigger the notification step. The entire setup takes about 10 minutes.

If you want enriched Slack alerts that include the product name, due date, and required action text (not just the CVE ID), extend the Python script from Option A with a direct Slack webhook call.

Replace the comment in the script with:

import urllib.request
import json

def send_slack_alert(entries, webhook_url):
    lines = []
    for e in entries:
        lines.append(
            f"*{e['cveID']}* -- {e['vendorProject']} {e['product']}\n"
            f"> Due: {e['dueDate']} | {e['requiredAction'][:100]}"
        )
    payload = {
        "text": f":rotating_light: *{len(entries)} new CISA KEV entr{'y' if len(entries)==1 else 'ies'}*",
        "blocks": [
            {"type": "section", "text": {"type": "mrkdwn", "text": "\n\n".join(lines)}}
        ]
    }
    req = urllib.request.Request(
        webhook_url,
        data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"}
    )
    urllib.request.urlopen(req)

To get a Slack webhook URL: go to api.slack.com/apps, create a new app, enable Incoming Webhooks, add a webhook to your chosen channel, and copy the URL. Store it as an environment variable rather than hardcoding it in the script.

If you want zero code, Zapier and Make both support polling a JSON URL and triggering an action when new items appear.

Zapier setup (free tier):

1. Create a new Zap with trigger: "Webhooks by Zapier" or "Schedule" (daily)
2. Add an action step: "Code by Zapier" (JavaScript) that fetches the KEV JSON and compares against a stored list in Zapier Storage
3. Add a filter step that only continues when new entries exist
4. Add an action step: send to email, Slack, or SMS

Make (formerly Integromat) setup:

1. Create a scenario triggered on a schedule (daily)
2. Use the HTTP module to GET the KEV JSON feed
3. Use the JSON module to parse the response
4. Use the Data Store module to track previously seen CVE IDs
5. Use a Router to filter for new entries only
6. Connect to your notification channel

The no-code approach is slower to set up correctly (data store comparison logic requires some effort) but requires no infrastructure. Use it if you are not comfortable running Python scripts or GitHub Actions.