Data
Everything the site shows, as static JSON files. No API key, no rate limit, CORS enabled. Static files are an API with no operational risk, which is how this stays free.
Built 2026-08-23 05:47 UTC. Each file carries _built and the source versions it was computed from. Definitions are on /method; they will not change without a note on /changes.
Files
| Path | Contents |
|---|---|
| /data/kev-coverage.json | Every KEV CVE (1674) in compact form: id, v (vendor), p (product), n (name), d (dateAdded), s (state), g (sigma coverage), r (ransomware), t (technique ids), mt (mapping types), w (CWEs), y (year). Plus the full stats object. |
| /data/cve/<CVE-ID>.json | One CVE with all CISA fields, every CTID mapping object with its comments and references, per-technique status against ATT&CK v19.2, and Sigma rule ids. Example: CVE-2021-44228.json. |
| /data/technique/<T-ID>.json | One technique (700 files) with detection strategies, analytics (with log source references and mutable elements), Sigma rules (with author), and mapped KEV CVEs. Example: T1190.json. |
| /data/techniques.json | All live techniques with counts: strategies, analytics, Sigma rules, KEV CVEs. |
| /data/log-sources.json | All 261 log sources with channels, analytics, techniques and reachable KEV CVEs. |
| /data/stats.json | Every statistic on the site, with source hashes and commits. |
| /search.json | The search index: CVEs, techniques, log sources. |
| /feed.xml | RSS: weekly KEV additions and their detection knowledge state. |
Terms
The derived dataset is free to use. It is composed from sources with their own terms, which you inherit: ATT&CK content under MITRE's terms of use, CTID mappings under Apache-2.0, Sigma rule metadata under the Detection Rule License 1.1 — meaning any alert or message you generate from a Sigma rule must retain the author field, which every rule object here carries. CISA KEV is US Government work, treated as public domain. Details on /licences.
If you build on this, cite the build date and the source versions from stats.json; the numbers move as KEV does.