CVE Enrichment

When you submit a CVE ID to CloudSigma, the pipeline automatically enriches it with data from trusted vulnerability sources before generating detection rules.

How It Works

1. NVD Lookup — Fetch the CVE record from the National Vulnerability Database
2. Reference Extraction — Identify advisory URLs from the CVE references list
3. Content Fetch — Download up to 2 reference URLs (max 500 KB each) from trusted domains
4. Merge — Combine NVD metadata, CVSS scores, and advisory content into the pipeline input

Trusted Domains

CVE reference URLs are only fetched from an allowlist of 9 trusted security domains:

• nvd.nist.gov — National Vulnerability Database
• cve.mitre.org — MITRE CVE records
• www.cisa.gov — CISA advisories
• github.com — GitHub Security Advisories
• msrc.microsoft.com — Microsoft Security Response Center
• access.redhat.com — Red Hat security advisories
• security.googleblog.com — Google security blog
• aws.amazon.com — AWS security bulletins
• cloud.google.com — GCP security bulletins

URLs from other domains are skipped to prevent SSRF and reduce noise.

Enrichment Limits

Best-Effort Enrichment

CVE enrichment is best-effort. If reference URLs are unavailable, return errors, or exceed size limits, the pipeline continues with whatever data was successfully fetched. The CVE ID and NVD metadata are always available.

Example

curl -X POST https://cloudsigma.a13e.com/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"inputType": "cve", "cveId": "CVE-2025-1974"}'

The pipeline will:

1. Fetch the NVD record for CVE-2025-1974
2. Identify references (e.g., a CISA advisory and a GitHub advisory)
3. Fetch content from up to 2 references
4. Extract TTPs from the combined content
5. Generate Sigma rules targeting the relevant platforms