name: veridano-cybersecurity-intelligence
description: >
Real-time government cybersecurity intelligence from CISA, FBI, NIST, NSA, and 10+ agencies.
Use when discussing CVEs, vulnerabilities, threat actors, compliance, or security advisories.
Provides authoritative data via live API calls to NVD, CISA KEV, and 400+ indexed government documents.

Veridano Cybersecurity Intelligence

Veridano is a government cybersecurity intelligence platform that provides Claude with real-time access to authoritative security data from US, UK, and EU government agencies.

When to Use This Skill

Activate this skill when the user:
- Mentions a CVE identifier (e.g., CVE-2024-3400, CVE-2023-44487)
- Asks about active exploits or whether a vulnerability is being exploited in the wild
- Inquires about CISA Known Exploited Vulnerabilities (KEV) or BOD 22-01 compliance
- Requests threat intelligence on ransomware, APT groups, or nation-state actors
- Needs security guidance from government agencies (CISA advisories, FBI alerts, NIST frameworks)
- Asks about ICS/OT security or industrial control system vulnerabilities
- Discusses emergency directives or federal cybersecurity mandates

Available Tools

1. get_cve_details

Fetches real-time CVE information from NIST NVD API 2.0.

Returns:
- CVE description
- CVSS score and severity (CRITICAL/HIGH/MEDIUM/LOW)
- Published and last modified dates
- Reference URLs
- Affected products

Example:

{"name": "get_cve_details", "arguments": {"cve_id": "CVE-2024-3400"}}

2. check_cisa_kev

Checks if a CVE is in CISA's Known Exploited Vulnerabilities catalog.

Returns:
- Whether CVE is actively exploited
- Vendor and product affected
- Date added to KEV
- Required remediation deadline
- Whether used in ransomware campaigns

Example:

{"name": "check_cisa_kev", "arguments": {"cve_id": "CVE-2024-3400"}}

3. veridano_search

Semantic search across 400+ indexed government cybersecurity documents.

Returns:
- Relevant documents from CISA, FBI, NIST, NSA, DHS, etc.
- Document titles, sources, and publication dates
- Similarity scores for relevance ranking

Example:

{"name": "veridano_search", "arguments": {"query": "ransomware mitigation guidance", "top_k": 5}}

API Endpoint

POST https://7lqg8v66p1.execute-api.us-east-1.amazonaws.com/prod/mcp
Content-Type: application/json

Instructions

1. Always check both CVE details AND KEV status when a user mentions a specific CVE
2. Prominently flag actively exploited vulnerabilities - these require immediate attention per federal mandate
3. Cite sources when presenting findings (e.g., "According to CISA advisory AA24-131A...")
4. Use semantic search for broader threat intelligence queries
5. Combine tools - for example, search for related advisories after checking a CVE

Response Guidelines

When presenting CVE information:

**CVE-2024-3400** (Palo Alto Networks PAN-OS)
- Severity: CRITICAL (CVSS 10.0)
- Status: ⚠️ ACTIVELY EXPLOITED (CISA KEV)
- Deadline: Patch by April 19, 2024
- Action: Apply vendor mitigations immediately

When presenting search results:

Found 5 relevant government documents:
1. "CISA Analysis of Ransomware Trends" (CISA, May 2024)
2. "Emergency Directive on Palo Alto Networks" (CISA, April 2024)
...

Data Sources

Limitations

• Semantic search covers ~400 indexed documents (expanding)
• Some historical advisories may not be indexed
• Real-time APIs (NVD, KEV) are always current
• Rate limits apply to API calls

Examples

Example 1: CVE Lookup

User: "What can you tell me about CVE-2024-3400?"

Response approach:
1. Call get_cve_details for CVE-2024-3400
2. Call check_cisa_kev for CVE-2024-3400
3. Present combined findings with severity, exploit status, and remediation guidance

Example 2: Threat Research

User: "What guidance does CISA have on defending against Chinese APT groups?"

Response approach:
1. Call veridano_search with query "Chinese state-sponsored cyber threat"
2. Present relevant advisories and guidance documents
3. Summarize key recommendations

Example 3: Compliance Check

User: "Are there any emergency directives affecting Cisco products?"

Response approach:
1. Call veridano_search with query "emergency directive Cisco"
2. List applicable directives with deadlines and requirements