manishrawat21/cisa-kev-threat-intel-orchestrator

This project automates a task that security teams normally do by hand: turning newly disclosed, actively exploited software vulnerabilities into detection rules. It watches the CISA Known Exploited Vulnerabilities catalog, a public list the US government keeps of security flaws that are already being used in real attacks, and checks it every Monday morning for new entries. When it finds a new vulnerability, the pipeline generates a Sigma detection rule for it. Sigma is a common format for describing how to spot an attack in system logs, and the rules produced here are meant to be dropped straight into tools like Splunk, Elastic, or Wazuh, which security teams use to monitor networks. Google Gemini writes each rule, guided by a prompt that pushes it to name the exact affected product, use the right Windows monitoring event types for the technique involved, add several filters to reduce false alarms, and tag the rule with the matching MITRE ATT&CK technique, a widely used catalog of attacker behaviors. Every processed vulnerability gets logged to a Google Sheet, creating a timestamped record of when each flaw was disclosed and when a detection rule became available for it. This kind of audit trail is useful for teams that need to show compliance with standards like SOC 2 or ISO 27001, which ask organizations to prove they respond promptly to new threats. The pipeline also emails a weekly summary to analysts, listing the new vulnerabilities, their severity, and draft detection logic ready for review. The whole system runs on n8n, a workflow automation tool, connected to the CISA KEV API, Google Gemini, Google Sheets, and email. The author describes it as a working weekly pipeline rather than a finished product. Planned improvements include sending generated rules directly into a security team's monitoring system instead of only by email, testing generated rules against sample logs before analysts see them, and connecting the pipeline to incident response systems. This is a solo project built by an independent detection engineer and SOC analyst, aimed at cutting the multi hour manual process of writing a detection rule per vulnerability down to near zero.