CISA KEV alerts
How to get CISA KEV alerts without a SIEM
Updated 2026-08-28
CISA’s Known Exploited Vulnerabilities catalog is a public JSON feed. Here is how to get alerts for your SaaS stack without Elastic, Sentinel, or a six-figure intel platform.
The catalog is free. Matching it to your stack is the product.
CISA publishes the Known Exploited Vulnerabilities catalog as JSON. Anyone can poll it. Federal agencies must remediate entries under BOD 22-01. Everyone else should still treat a KEV addition as a P1 if the vendor is in their environment — CVSS is not the point. Exploitation is.
What CISA will not do is tell you whether the new row is Okta, a firewall you forgot, or a printer firmware you do not own. The feed is global. Your risk is not.
Four ways teams get KEV alerts today
One: refresh the CISA web catalog when you remember. This fails on the week you are shipping. Two: CISA’s email subscription. You will receive everything. You will ignore it. Three: join KEV to asset inventory inside a SIEM (Elastic has a cisa_kevs integration; Sentinel can watch a CSV). That is correct if you already paid for the SIEM and someone owns the rule. Four: a watchlist product that names your SaaS tools and only pages you on matches — including suppliers.
Scripts are fine. A Cloudflare Worker that diffs the catalog against a vendor list is a weekend project. The failure mode is the list: “Microsoft” matches too much; “Slack” misses AWS; “Auth0” misses Okta. The supplier graph is where homemade watchlists go quiet.
What “alerts for my stack” should include
A useful KEV alert names the CVE, the vendor CISA used, which of your tools matched (direct vs supplier), ransomware-use if known, and CISA’s required action. It should not require you to paste the CVE into four other tabs. It should not fire for a Linux kernel bug when you listed HubSpot.
ZeroDayTracker is that watchlist: curated SaaS catalog, CISA KEV plus critical NVD, email digest on Keep Track, no network access. If you would rather maintain the Worker, start from CISA’s JSON and a spreadsheet of logos. Revisit the spreadsheet the first time a parent company is exploited and you did not get the ping.
Questions
Does CISA email me when KEV is updated?
CISA offers a free subscription, but it is a full-catalog digest — every addition, not the three SaaS tools you actually run.
Is the KEV JSON feed free?
Yes. No API key. The catalog is at CISA’s known_exploited_vulnerabilities.json URL. Filtering it to your stack is the part most teams skip.
Watch the SaaS that holds your data.
Three tools free. Keep Track is $20/month for supplier blast-radius, full history, and a digest.