Intelligence Module - Vulnerability Prioritization

Data Dictionary: Intelligence Module - Vulnerability Prioritization - Entitlements

This outlines the field types associated with the IP endpoint responses to which you are entitled if you purchase the Vulnerability Prioritization Intelligence Module.

Last Updated: 2025-10-08

Field Name	Field Type	Example	Description
id	string	CVE-2024-12345	The CVE ID.
details	object	{ "vulnerability_name": "Acme Inc Expoilt Attempt", "vulnerability_description": "Potentially allowing Acme Inc to exploit anvil drop on new users.", "cve_cvss_score": 4.5, "product": "Acme Inc", "vendor": "Anvil Drop", "published_to_nist_nvd": true }	Basic CVE details, including CVSS score (Common Vulnerability Scoring System), associated products & vendors, and NIST CVE recognition status.
details.vulnerability_name	string	Acme Inc. Exploit Attempt	Name of the vulnerability.
details.vulnerability_description	string	Potentially allowing Acme Inc to exploit anvil drop on new users."	Description of the vulnerability.
details.cve_cvss_score	float	4.5	Current CVSS score (Common Vulnerability Scoring System).
details.product	string	Acme Inc	Product(s) associated with the CVE.
details.vendor	string	Anvil Drop	Vendor(s) associated with the CVE.
details.published_to_nist_nvd	boolean	true	Whether this CVE is recognized by NIST.
timeline	object	{ "cve_published_date": "2024-05-28T19:15:10.060", "cve_last_updated_date": "2024-05-31T16:04:09.703", "first_known_published_date": "2024-05-27T00:00:00Z", "cisa_kev_date_added": "2024-05-30T00:00:00Z" }	Key timeline details about when the CVE was published, updated, and added to CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog).
timeline.cve_published_date	datetime	2024-05-28T19:15:10.060	Date when the CVE was published by NVD.
timeline.cve_last_updated_date	datetime	2024-05-31T16:04:09.703	Date when the CVE record was last updated.
timeline.first_known_published_date	datetime	2024-05-27T00:00:00Z	Date when the first exploit associated with the CVE was published.
timeline.cisa_kev_date_added	datetime	2024-05-30T00:00:00Z	Date CISA (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) added a KEV (Known Exploited Vulnerability) entry associated with the CVE.
exploitation_details	object	{ "attack_vector": "NETWORK", "exploit_found": true, "exploitation_registered_in_kev": true, "epss_score": 0.94504 }	Exploitation-related details pertaining to attack vector category, EPSS score (Exploit Prediction Scoring System), available exploits, and KEV (Known Exploited Vulnerabilities) registration.
exploitation_details.attack_vector	string	NETWORK	Attack vector category.
exploitation_details.exploit_found	boolean	true	Whether any known exploits are available.
exploitation_details.exploitation_registered_in_kev	boolean	true	Whether exploitation has been registered in the KEV (Known Exploited Vulnerabilities) database.
exploitation_details.epss_score	float	0.94504	EPSS score (Exploit Prediction Scoring System) associated with the exploitation.
exploitation_stats	object	{ "number_of_available_exploits": 60, "number_of_threat_actors_exploiting_vulnerability": 1, "number_of_botnets_exploiting_vulnerability": 0 }	Statistical data about exploitation, including number of exploits available, and number of threat actors and botnets exploiting the vulnerability.
exploitation_stats.number_of_available_exploits	integer	60	Total number of exploits available (public + commercial).
exploitation_stats.number_of_threat_actors_exploiting_vulnerability	integer	1	Total number of known threat actors exploiting the vulnerability.
exploitation_stats.number_of_botnets_exploiting_vulnerability	integer	0	Total number of botnets exploiting the vulnerability.
exploitation_activity	object	{ "activity_seen": true, "benign_ip_count_1d": 765, "benign_ip_count_10d": 765, "benign_ip_count_30d": 765, "threat_ip_count_1d": 0, "threat_ip_count_10d": 1, "threat_ip_count_30d": 14 }	Observed IPs scanning or exploiting the vulnerability today, in the last 10 days, and the last 30 days.
exploitation_activity.activity_seen	boolean	true	Whether GreyNoise has observed activity related to this CVE.
exploitation_activity.benign_ip_count_1d	integer	765	Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability today.
exploitation_activity.benign_ip_count_10d	integer	765	Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.
exploitation_activity.benign_ip_count_30d	integer	765	Total number of benign IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days.
exploitation_activity.threat_ip_count_1d	integer	0	Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability today.
exploitation_activity.threat_ip_count_10d	integer	1	Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 10 days.
exploitation_activity.threat_ip_count_30d	integer	14	Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days.