The Problem
CISA's Known Exploited Vulnerabilities catalog is the single best "fix this now" signal in security — these aren't theoretical CVEs, they're being exploited in the wild today. But pulling KEV out of thousands of findings and grouping it into something a patch team can act on is tedious, manual, and easy to let slide.
What It Does
Laelaps instantly finds and tags every actively-exploited vulnerability in the estate. It works off the CISA-KNOWN-EXPLOITED cross-reference to tag all KEV assets at once, by catalog date, or by month in one click — and answers natural-language KEV hunts on top.
Key Capabilities
- KEV asset tagging — every asset carrying an actively-exploited vulnerability, tagged from the CISA-KNOWN-EXPLOITED cross-reference in your own findings.
- By-date and by-month roll-up tagging — slice the KEV backlog by catalog date, or tag an entire month in one click.
- Per-month distinct asset counts — see how many assets each month's wave touches before committing a patch window.
- Natural-language KEV queries — ask "which assets picked up KEV findings in March?" in plain English; Laelaps translates to SQL.
- Gated writes to the tagging log — every tag is proposed, human-approved, and recorded.
How It Works
Runs against the local navi.db built from your Tenable data: the vulns.xrefs field (CISA-KNOWN-EXPLOITED) with catalog dateAdded parsing for date- and month-level grouping. All writes are proposed, human-approved, and logged.
Who It's For
Vulnerability management leads who need a defensible "patch this first" list, and patch prioritization owners who plan remediation in waves, not one CVE at a time.
Proof Points
In a 268-asset reference environment, Laelaps surfaced 2,631 KEV findings across the estate — instantly grouped and taggable by month instead of buried in the general finding count.
Works Better With
Feeds the pack's heaviest hitters: Fenrir (KEV as foothold evidence), Pythia (KEV × AI assets), Heimdall (crypto migration priority), and On the Scent (executive exposure view).
Why It's Different
- Month-level bulk tagging — a quarter's KEV backlog becomes three tags, no per-date clicking.
- The exploitability backbone — the KEV signal Fenrir, Pythia, and Heimdall all prioritize against.
- Evidence-based — tags come from the KEV cross-reference in your actual findings, not a memorized CVE list.
- Gated, reviewable writes — every tag proposed, approved, and logged.