Prioritize Zero-Day Exposure

This workflow answers two separate questions: which vulnerabilities have strong exploitation evidence, and which of your authorized external assets have matching observed findings.

Requirements

OEM Vulnerability Intelligence and platform vulnerability access
Python 3.10 or later with requests
One authorized domain to review

The OEM feed supports server-side kev and exploit_available filters. Each successful credited OEM request deducts one credit.

Run the correlation

export FULLHUNT_API_KEY="YOUR_API_KEY"
export FULLHUNT_ASSET_DOMAIN="your-owned-domain.example"
python prioritize_exposure.py

prioritize_exposure.py

import json
import os
import re

import requests

BASE_URL = "https://fullhunt.io/api/v1"
API_KEY = os.environ["FULLHUNT_API_KEY"]
ASSET_DOMAIN = os.environ["FULLHUNT_ASSET_DOMAIN"]
HEADERS = {"X-API-KEY": API_KEY, "Content-Type": "application/json"}
CVE_PATTERN = re.compile(r"CVE-\d{4}-\d{4,}", re.IGNORECASE)


def collect_cves(value):
    found = set()
    if isinstance(value, dict):
        for child in value.values():
            found.update(collect_cves(child))
    elif isinstance(value, list):
        for child in value:
            found.update(collect_cves(child))
    elif isinstance(value, str):
        found.update(match.upper() for match in CVE_PATTERN.findall(value))
    return found


def post(path, body):
    response = requests.post(
        f"{BASE_URL}{path}",
        headers=HEADERS,
        json=body,
        timeout=60,
    )
    response.raise_for_status()
    return response.json()


feed = post(
    "/oem/vulnerability-intelligence/feed",
    {
        "days": 7,
        "type": "vulnerabilities",
        "per_page": 100,
        "kev": True,
        "exploit_available": True,
        "query_tags": {"workflow": "zero-day-prioritization"},
    },
)

observed = post(
    "/oem/vulnerabilities/search",
    {
        "type": "domain",
        "query": ASSET_DOMAIN,
        "query_tags": {"workflow": "zero-day-prioritization"},
    },
)

feed_cves = collect_cves(feed.get("vulnerabilities", []))
observed_cves = collect_cves(observed.get("results", observed))

print(
    json.dumps(
        {
            "asset": ASSET_DOMAIN,
            "matching_cves": sorted(feed_cves & observed_cves),
            "feed_only": sorted(feed_cves - observed_cves),
            "observed_only": sorted(observed_cves - feed_cves),
            "feed_cutoff_epoch": feed.get("metadata", {}).get("cutoff_epoch"),
        },
        indent=2,
    )
)

Triage the matches

For every matching CVE, retain:

Asset and affected location returned by the platform
CVE identifier and affected product evidence
CISA Known Exploited Vulnerabilities status
Exploit Prediction Scoring System value when present
Exploit records and source links
First observed time and latest confirmation time
Analyst disposition and remediation owner

Do not infer an affected asset from a product name alone. Require an observed platform finding or another verified match. A useful queue sorts by exploitation evidence, external reachability, asset importance, and remediation status without hiding those inputs behind a single score.

Non-OEM alternative

Professional or Enterprise integrations can retrieve GET /vulnerability-intelligence/feed and GET /enterprise/vulnerabilities, then apply KEV and exploit filters in the client. The standard feed does not accept the OEM-only kev and exploit_available request fields.

Knowledge Base

Guides

Requirements

Run the correlation

Triage the matches

Non-OEM alternative

​Requirements

​Run the correlation

​Triage the matches

​Non-OEM alternative

Requirements

Run the correlation

Triage the matches

Non-OEM alternative