CVE AI Agent

CVE AI Agent 🛡️

The CVE AI Agent is an autonomous cybersecurity data pipeline engineered to deliver SOC-grade, auditable vulnerability intelligence. This innovative tool continuously ingests, enriches, and triages Common Vulnerabilities and Exposures (CVE) data, providing actionable insights to various platforms including n8n, Jira, Slack, Splunk, and enabling local file exports.

Key Features

• Continuous Background Operation: The CVE AI Agent runs in the background, retrieving fresh vulnerability data from trusted sources such as NVD, CISA KEV, and EPSS. Each CVE is evaluated against user-defined risk thresholds, and AI-generated threat reports are delivered directly into your preferred workflow.
• LLM agnostic Add and choose your prefred LLM provider
• Token-Efficient Architecture: With a unique Deterministic Minimization Logic, the agent ensures efficient processing and communication:
  • 1K Token Average: Prompts are optimized to an average of 1,000 tokens, reducing unnecessary data overhead.
  • Resource Efficiency: Minimizes API usage, resulting in lower costs and faster processing times, while maintaining precision in output.
  • Relevant Context: Avoids "context window noise" by sending only essential metadata and relevant CVE context.

Two-Pass Architecture

The agent follows a Two-Pass architecture:

• Pass 1 (Deterministic): Collects comprehensive data from APIs without LLM involvement, ensuring accurate extraction of key metrics (CVSS, EPSS, KEV, CWE).
• Pass 2 (LLM Enrichment): Uses language models (LLMs) to enhance the report with qualitative insights, maintaining transparency with a fallback report in case of LLM unavailability.

How It Works

┌─────────────────────────────────────────────────────────────┐
│              PASS 1: DETERMINISTIC ENGINE (Layer 1 & 2)     │
│  layer1_fetcher.py ──► Fetches NVD, EPSS, KEV, CWE, MITRE   │
│  layer2_engine.py  ──► Generates 'static_json'              │
└──────────────────────────────┬──────────────────────────────┘
                               │
┌──────────────────────────────▼──────────────────────────────┐
│              PASS 2: LLM ENRICHMENT (Layer 3)               │
│  layer3_enricher.py ──► Processes 'static_json' target keys │
│  (Gemini / OpenAI / Claude / Groq / Ollama)                 │
│  Outputs: 'enriched_json'                                   │
└──────────────────────────────┬──────────────────────────────┘
                               │
┌──────────────────────────────▼──────────────────────────────┐
│              OUTPUT (Layer 4)                               │
│  layer4_report_generator.py → PDF report                    │
│  agent_core.py → Slack / Jira / n8n / Splunk dispatch       │
│  app_gemini.py → Web Dashboard at http://localhost:8080     │
└─────────────────────────────────────────────────────────────┘

Output Examples

Output from the CVE AI Agent includes:

• AI-Enriched Threat Reports in PDF format, providing in-depth insights.

• Structured CVE Intelligence in JSON format for easy integration into existing systems.

Integration Capabilities

The CVE AI Agent offers a variety of integration options allowing seamless connectivity with external services. It can send alerts and dispatch reports to services like Slack and Jira, or export structured reports for further analysis.

Configuration

The agent is highly configurable with options in the config.json file, allowing users to set LLM provider preferences, CVSS filtering criteria, keywords and output settings. The configurations enable precise control over the output reports, ensuring that users receive tailored insights that align with operational needs.

Continuous Monitoring Workflow

The agent includes an automated Continuous Monitoring workflow that periodically re-evaluates previously processed CVEs when authoritative signals change (NVD, EPSS, CISA KEV, or patch status). The monitoring manager performs an efficient Layer‑1-only fetch, diffs the data against the last stored snapshot.

Conclusion

The CVE AI Agent represents a comprehensive solution for vulnerability management in today's fast-paced cybersecurity landscape, providing actionable intelligence with minimal overhead and maximum efficacy. Learn more about its setup and architecture with the provided documentation.