Automating a MISP Vulnerability Attack Feed

This started as an IT capstone project and earned a permanent place in the lab. The idea is simple: pull vulnerability data from multiple sources, normalize it, and push it into MISP so I get timely, relevant alerts instead of drowning in every CVE ever published.

The pipeline

1. Collect. A scheduled Python job pulls from public CVE feeds and vendor advisories.
2. Normalize. Each item is mapped to a common schema — CVE ID, CVSS, affected products,

references.

1. Correlate. Items are matched against an inventory of the software actually running in the

lab, so irrelevant CVEs are dropped early.

1. Publish. Matches are pushed into MISP as events with attributes and tags.

sources -> collector.py -> normalize -> correlate(inventory) -> MISP events

Why MISP

MISP gives me sharing, correlation, and a clean API for downstream consumers. The Wazuh SIEM can query MISP indicators, which closes the loop: a new relevant CVE becomes a detection input, not just an email.

Lessons learned

• Correlate against inventory first. Relevance filtering is the difference between a useful

feed and an ignored one.

• Idempotency matters. Re-running the collector must not create duplicate MISP events.
• Rate limits are real. Backoff and caching kept the upstream sources happy.

Live

The feed runs continuously — see [feed.cybersecuritytechsolutions.com](https://feed.cybersecuritytechsolutions.com).