> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/configuration/settings/sec-intel-feeds.md).

# Security intelligence feeds

CISO Assistant can optionally enrich its vulnerability and security-advisory catalogues by polling external threat-intelligence feeds. These switches control which feeds are active and how the platform reaches them.

All feeds are **off by default** — they make outbound network calls, so opt in deliberately.

## Available feeds

* **KEV feed** (`kev_feed_enabled`) — CISA's [Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) list. Tags vulnerabilities that are confirmed to be exploited in the wild so they can be prioritised.
* **EPSS feed** (`epss_feed_enabled`) — FIRST's [Exploit Prediction Scoring System](https://www.first.org/epss/). Attaches a probabilistic exploitation score to each CVE, useful for prioritisation alongside CVSS severity.
* **NVD enrichment** (`nvd_enrich_enabled`) — pulls extra metadata from the [NIST National Vulnerability Database](https://nvd.nist.gov) (CWE mappings, affected configurations, references).

## Network

* **Network timeout** (`network_timeout`) — seconds to wait before giving up on a feed call. Default `30`, range `5`-`120`. Tune up if you're behind a slow egress proxy; tune down if you want feed failures to surface quickly rather than block other work.

## Operational notes

* Enabling a feed doesn't backfill the entire history — feeds are consulted from the moment they're enabled. To enrich historical entries, look for a "refresh" action on the relevant catalog (depends on the feed).
* Feed calls happen in background jobs (Huey workers), so toggling a feed doesn't block the request that saves the settings.
* Outbound HTTPS access to the feed endpoints is required. The platform doesn't ship with mirrored data.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/configuration/settings/sec-intel-feeds.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.