We find the KEV data provided in cve2stix as STIX Reports very useful.
We have around 1000 Reports created by cve2stix representing KEV data. This number sounds very low, and I therefore suspect we are missing entries. How can I (in)validate this?
OK so a longwinded answer, but stay with me, I think it’s important to talk about what the KEV program is all about…
CISA’s methodology for generating data is described here:
https://www.cisa.gov/known-exploited-vulnerabilities
CISA’s definition of actively exploited;
A vulnerability under active exploitation is one for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner.
Now it’s unrealistic to assume CISA is monitoring all exploited vulnerabilities, and that’s not what the point of KEV is.
It is more focused on the most critical vulnerabilities being exploited so that organisations can priorities remediation/patches effectively;
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild: the Known Exploited Vulnerability (KEV) catalog. CISA strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation of the listed vulnerabilities to reduce the likelihood of compromise by known threat actors.
Of course it’s far from perfect:
So to answer your question…
How can I (in)validate this?
Go to:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
And download the CSV data.
You’ll see it currently returns around 1100 results, which I would say is suspiciously close to the amount you have in the STIX objects you’ve created using cve2stix.