Overview#
When the German Federal Office for Information Security (BSI) publishes an urgent advisory about a zero-day vulnerability in a widely deployed VPN appliance, a security operations team cannot afford to discover it hours later through manual monitoring. The Threat Intelligence Advisories module continuously polls official feeds from the BSI, national Computer Emergency Response Teams (CERTs), CISA, and EU-CERT, ingesting machine-readable advisories the moment they are published. Each advisory is parsed to extract CVE identifiers, CVSS severity scores, and affected product ranges, then automatically cross-referenced against the organisation's known asset inventory to identify exposure without any manual triage step.
Advisories published in languages other than the operator's working language are translated automatically, ensuring that a German-language BSI alert carries the same immediacy as an English-language CISA bulletin. Normalised risk scores are applied consistently across all sources, and alerts are dispatched to the relevant asset owners, SIEM platforms, and ticketing systems within seconds of ingestion. Security teams can focus their attention on remediation rather than on aggregating and parsing raw advisory text.
Key Features#
- Multi-Source Ingestion: Continuous polling of RSS, REST API, and STIX/TAXII feeds from authoritative cybersecurity agencies including the BSI, CISA, and national CERTs across the EU.
- Automated CVE Extraction: Structured parsing of advisory content to extract CVE identifiers, CVSS base scores, affected product CPE ranges, and recommended mitigations.
- Asset Correlation: Automatic cross-referencing of extracted CVEs and CPE strings against the organisation's asset inventory to determine which systems are exposed, with no manual intervention required.
- Machine Translation: Advisories published in German, French, Dutch, or other European languages are translated automatically so that operators receive consistent, localised alerts regardless of the advisory's origin language.
- Normalised Risk Scoring: Severity ratings from heterogeneous sources are normalised to a single consistent risk scale, preventing alert fatigue caused by incompatible vendor-specific scales.
- SIEM and Ticketing Integration: Indicators of compromise and affected asset lists are forwarded directly to connected SIEM platforms and ticketing systems, triggering watchlist updates and remediation tickets automatically.
- Audit Trail: Every advisory ingestion event, asset match, and alert dispatch is logged with a tamper-evident timestamp, supporting compliance reporting and post-incident review.
Use Cases#
- A security operations team receives an automated, asset-scoped alert within minutes of a BSI advisory disclosing a critical vulnerability in a product deployed across their environment, enabling same-day patching prioritisation.
- A Managed Security Service Provider (MSSP) aggregates advisories from multiple national CERTs and automatically routes exposure notifications to the relevant client based on each client's technology inventory.
- A CISO prepares a weekly board-level risk summary using advisory trends and asset exposure metrics drawn directly from the module, without requiring analysts to compile the data manually.
- A government agency operating under NIS2 obligations uses the module to demonstrate continuous monitoring of authoritative threat intelligence sources as part of its incident-response readiness posture.
- An organisation with multilingual operations ensures that German, French, and Dutch advisories are triaged with the same urgency as English-language bulletins, removing language as a barrier to timely response.
Integration#
The module connects to the organisation's asset inventory and configuration management data to resolve CVE exposure at the device and service level, and forwards structured alert payloads to SIEM platforms, ticketing systems, and notification channels over standard APIs. Existing vulnerability management workflows receive enriched advisory context, including CVSS scores, affected CPE ranges, and recommended mitigations, so that patch prioritisation decisions are grounded in authoritative source data rather than secondary summaries.
Open Standards#
- CSAF 2.0 (Common Security Advisory Framework): Advisories published in CSAF format are ingested natively, preserving the full machine-readable structure including vulnerability, product, and remediation trees.
- STIX 2.1 (Structured Threat Information eXpression): Threat intelligence objects, including indicators of compromise and vulnerability records, are consumed and stored in STIX 2.1 format to ensure interoperability with other intelligence platforms.
- TAXII 2.1 (Trusted Automated eXchange of Intelligence Information): Advisory feeds distributed via TAXII servers are polled on a configurable schedule using the TAXII 2.1 collections API.
- CVE (Common Vulnerabilities and Exposures): All vulnerability references are normalised to CVE identifiers as maintained by the MITRE Corporation and the NVD, ensuring consistent cross-source deduplication.
- CVSS v3.1 and v4.0 (Common Vulnerability Scoring System): Base, temporal, and environmental scores are extracted and stored in alignment with the FIRST CVSS specification, enabling consistent severity comparison across sources.
- CPE 2.3 (Common Platform Enumeration): Affected product ranges expressed as CPE names are matched against the asset inventory to determine exposure without requiring free-text product name matching.
- IETF RFC 4122 (UUID): Advisory and alert records are assigned universally unique identifiers conforming to RFC 4122 to support reliable cross-system correlation and deduplication.
- NIS2 Directive (EU 2022/2555): The module supports obligations under the NIS2 Directive by providing continuous monitoring of authoritative national advisory sources and audit-ready logging of advisory handling activities.
Availability#
- Enterprise Plan: Included
- Professional Plan: Available with a limit on the number of monitored advisory sources; additional sources available as an add-on.
Last Reviewed: 2026-05-26