KEV Sentinel AI

CISA KEV Vulnerability Triage & Remediation Agent

KEV Sentinel AI is a safe-by-default cybersecurity / DevOps / digital-forensics portfolio project. It checks the CISA Known Exploited Vulnerabilities catalog, reads scanner output from Trivy, Grype, SBOM scans, or demo data, matches CVEs, prioritizes risk, and produces manager-friendly and technical reports.

This project is designed to fit inside the netwkg07/full-devops-homelab-portfolio family as a capstone-style security automation lab that connects:

• Linux administration
• Docker and container security
• GitHub Actions CI/CD
• vulnerability management
• digital-forensics evidence handling
• safe incident-response reporting
• executive-ready documentation

Safety note: this project does not exploit vulnerabilities. It only scans, matches, scores, reports, and recommends defensive remediation.

---

What the agent does

The agent follows a simple SOC/DevSecOps loop:

1. Collect

   • Pull latest CISA KEV catalog when online.
   • Fall back to local cache when offline.
   • Ingest scanner findings from demo data, Trivy JSON, Grype JSON, SBOM scans, or local package inventory.

2. Analyze

   • Match CVEs against the KEV catalog.
   • Add context such as exposure, asset criticality, scanner source, and deadline.
   • Score risk using safe and explainable rules.

3. Recommend

   • Generate remediation guidance.
   • Identify urgent KEV findings.
   • Flag when scanner output needs validation.

4. Report

   • Write JSON for automation.
   • Write CSV for managers.
   • Write HTML executive report for screenshots and GitHub documentation.

---

Fast demo

cd kev-sentinel-ai
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python -m kev_sentinel_ai.cli demo --offline

Open the generated report:

xdg-open reports/kev_sentinel_report.html

Or view the raw outputs:

ls -la reports/
cat reports/kev_sentinel_report.json

---

Useful commands

Update the KEV cache

python -m kev_sentinel_ai.cli update-kev

Run demo mode with cached KEV data

python -m kev_sentinel_ai.cli demo --offline

Run against Trivy JSON output

trivy image --format json --output output/trivy-nginx.json nginx:latest
python -m kev_sentinel_ai.cli triage --scanner trivy --input output/trivy-nginx.json --target nginx:latest

Run against Grype JSON output

grype nginx:latest -o json > output/grype-nginx.json
python -m kev_sentinel_ai.cli triage --scanner grype --input output/grype-nginx.json --target nginx:latest

Generate local Linux package inventory

python -m kev_sentinel_ai.cli inventory --output output/local_inventory.json

---

Repository structure

kev-sentinel-ai/
├── README.md
├── requirements.txt
├── .gitignore
├── .github/workflows/ci.yml
├── config/
│   ├── agent.yml
│   ├── risk-scoring.yml
│   └── suppressions.yml
├── demo-data/
│   ├── sample_kev_cache.json
│   ├── sample_scanner_findings.json
│   └── sample_inventory.json
├── docs/
│   ├── architecture.md
│   ├── demo-script.md
│   ├── runbook.md
│   ├── safety.md
│   └── lessons-learned.md
├── kev_sentinel_ai/
│   ├── __init__.py
│   ├── agent.py
│   ├── cli.py
│   ├── kev.py
│   ├── models.py
│   ├── recommendations.py
│   ├── reports.py
│   ├── risk.py
│   ├── scanners.py
│   └── utils.py
├── output/
│   └── .gitkeep
├── reports/
│   └── .gitkeep
├── screenshots/
│   └── .gitkeep
└── tests/
    └── test_risk.py

---

Portfolio positioning

Project title: KEV Sentinel AI — CISA Vulnerability Triage & Remediation Agent

Short description: A safe-by-default DevSecOps and digital-forensics AI agent that checks scanner findings against CISA KEV, prioritizes actively exploited vulnerabilities, and produces executive, CSV, and JSON reports for remediation tracking.

Role description: I designed and built a defensive cybersecurity automation agent that combines vulnerability intelligence, scanner output, risk scoring, and incident-style reporting. The project demonstrates Linux, Python, DevOps automation, CISA KEV analysis, Docker/SBOM scanning workflows, and safe vulnerability management practices.

Skills shown:

• Python automation
• Linux security operations
• CISA KEV vulnerability intelligence
• Trivy and Grype scanner integration
• Docker image scanning
• SBOM scanning workflow
• CSV/JSON/HTML reporting
• GitHub Actions CI
• DevSecOps documentation
• digital-forensics style evidence collection
• safe remediation planning

---

GitHub topics

cybersecurity
cisa-kev
vulnerability-management
devsecops
digital-forensics
incident-response
python
linux
trivy
grype
sbom
docker
security-automation
portfolio-project

Real Trivy Scan Demo

This repository includes a real Trivy scan against nginx:latest.

Demo results:

• Total findings: 231
• CISA KEV matches: 0
• Critical findings: 0
• High findings: 0
• Reports generated in JSON, CSV, and HTML formats

The scan artifacts are stored in:

• demo-data/real-scans/trivy-nginx-latest.json
• demo-data/real-scans/kev_sentinel_report_nginx.json
• demo-data/real-scans/kev_sentinel_report_nginx.csv
• demo-data/real-scans/kev_sentinel_report_nginx.html