sightings_search

cloud.nttzen.secdb/zen-secdb · Verify this server

Search real-world vulnerability sightings in SecDB. ## What this tool does Retrieves information about where and how a vulnerability appears in the real world, including: - Exploit-DB, Metasploit modules, PoCs - Scanner plugins (Nessus, OpenVAS/Greenbone) - Vendor advisories - Social/media references (Reddit, Mastodon, Bluesky) - MISP threat-intel sightings ## When to use this tool Use this tool when the user asks: - "Is this CVE exploited in the wild?" - "Is there a PoC or exploit available?" - "Does Nessus or OpenVAS have a plugin for this CVE?" - "Is this vulnerability being discussed online?" - "Show me all advisories/exploits for this CVE/product." ## Inputs Any of the following may be used: - **cve_id**: search by specific CVE - **query**: full-text search (name, product, advisory ID, exploit reference, etc.) - **category**: filter sightings by type (e.g., `exploit`, `nasl`, `advisory`, `scanner`, `poc`, `social`, `misp`) - **status**: filter by sighting state (`exploited`, `mitigated`, `seen`, `confirmed`, etc.) ## Outputs Returns an array of sightings, typically containing: - `cve_id` - `status` - `category` - `reference` - `details` (object with additional structured data) ## LLM usage guidelines - Use `cve_id` when the question targets a specific vulnerability. - Use `query` for broad or exploratory searches. - Only use valid enum values for `category` and `status`. - Use this tool instead of assuming exploitation, PoCs, or plugin availability.