Data Sources & Methodology

The authoritative catalog of vulnerabilities confirmed to have been actively exploited in the wild, maintained by the Cybersecurity and Infrastructure Security Agency. Federal agencies are mandated to remediate KEV entries within defined timelines under Binding Operational Directive 22-01. CyberGrind fetches this feed to power the CISA KEV Checker tool and the Blue Team Resources page.

A community-driven database of IP addresses reported for malicious activity including brute force attacks, port scanning, spam, and DDoS participation. Each IP carries a confidence-of-abuse score (0–100) based on report volume, recency, and reporter reputation. CyberGrind uses the AbuseIPDB API for the IP Reputation Check tool and as one of two data layers in the Global Threat Map.

An open source daily-updated blocklist aggregating malicious IPs from multiple threat intelligence sources. IPsum assigns a threat level (1–10) based on how many independent sources have flagged an IP. CyberGrind uses IPsum as one component of the OSINT Feeds layer in the Global Threat Map.

Proofpoint's open source threat intelligence feed providing IDS/IPS rules and IP blocklists for known malicious infrastructure. The compromised IPs feed covers hosts confirmed to be participating in attack campaigns. CyberGrind uses the open Emerging Threats blocklist as a component of the OSINT Feeds threat map layer.

Abuse.ch's tracker for botnet command-and-control infrastructure associated with banking trojans and ransomware families including Emotet, TrickBot, QakBot, and Dridex. Feodo Tracker provides a blocklist of active C2 IPs with malware family attribution. CyberGrind uses this feed as the third component of the OSINT Feeds threat map layer.

A MAC address OUI (Organizationally Unique Identifier) lookup service maintained by maclookup.app. OUI prefixes are registered with the IEEE and identify the hardware manufacturer associated with the first three octets of a MAC address. CyberGrind proxies lookup requests through a Cloudflare Worker to protect the API key and keep the key server-side. Results include vendor name, address, and block type (MA-L, MA-M, MA-S).

A data-driven probability model maintained by FIRST (Forum of Incident Response and Security Teams) that estimates the likelihood a given CVE will be exploited in the wild within the next 30 days. EPSS scores range from 0.0 to 1.0 and are updated daily based on threat intelligence and exploitation telemetry. CyberGrind uses EPSS scores in the CVE Research tool and the dedicated EPSS Scanner to help practitioners prioritize remediation beyond CVSS severity alone.

The U.S. government repository of standards-based vulnerability management data. NVD enriches CVE records published by MITRE with CVSS scores, CWE classifications, CPE applicability statements, and remediation references. CyberGrind queries the NVD CVE API v2.0 through the EPSS Worker to provide full CVE detail in the CVE Research tool.

The globally recognized knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. CyberGrind loads both the Enterprise and ICS ATT&CK matrices from local STIX 2.1 JSON snapshots to power the ATT&CK Browser tool. Snapshots are refreshed manually using scripts/fetch_attck.py when MITRE publishes a new version; GitHub Actions automation is planned to handle this on build.

A dedicated collector pulls the full CISA KEV catalog into the pipeline database on a 24-hour cycle, independently of the Cloudflare Worker used by the KEV Checker tool. This copy powers the Live CVEs tool, which provides filterable table views with overdue remediation highlighting.

URLhaus tracks malware distribution URLs reported by the security community. The collector fetches abuse.ch's public CSV export every hour and loads new IOC records into the pipeline database. Deduplication is applied before insert; inactive URLs are retained for historical reference.

A news collector aggregates RSS/Atom feeds from five security-focused publications every two hours: Krebs on Security, Bleeping Computer, The Hacker News, CISA Advisories, and SANS Internet Storm Center. Article bodies are not stored — only the title, link, source, publication date, and feed-provided summary excerpt. Deduplication is performed by URL hash.

MalwareBazaar is abuse.ch's repository of malware samples contributed by the security community. The collector fetches recent sample metadata every six hours — SHA256, MD5, SHA1, filename, file type, tags, malware family signature, first seen date, and reporter. Binary files are not downloaded or stored; metadata only.

VirusTotal file reports are proxied on-demand through the pipeline API to protect the API key and enforce free-tier quota. When a user submits a hash in the VT Lookup tool, the request is forwarded to VirusTotal's v3 file report endpoint and the result is returned directly — no caching is currently applied, so each lookup consumes quota.

A self-hosted MISP instance running in Docker on a local Ubuntu environment, subscribed to four community threat intelligence feeds: CIRCL OSINT Feed, Botvrij.eu, abuse.ch URLhaus, and Feodo Tracker. The pipeline collector queries MISP every six hours for actionable indicators (to_ids=True), pulling attributes including IP addresses, domains, URLs, and file hashes. IOCs are stored in the pipeline database with a source column to distinguish MISP-sourced indicators from abuse.ch direct feeds. On startup, a 30-day historical backfill is performed.

Primary source publications from the National Institute of Standards and Technology used as the factual foundation for Orange Book educational content. This includes NIST Cybersecurity Framework 2.0 (NIST CSWP 29), Special Publication 800-53 Rev. 5, FIPS 197 (AES), and supporting documents. NIST publications are in the public domain. All Orange Book articles derived from NIST sources include full reference lists with direct links to the primary documents.

A news aggregation API used to fetch cybersecurity headlines for the daily news posts published in the News section. Headlines are pulled from a curated set of security-focused publications and processed locally using Ollama (Llama 3.2) to generate practitioner commentary. The AI commentary is clearly identified and is generated from the provided headlines only — the model is explicitly instructed not to reference events outside the provided input to reduce hallucination risk.