API & Integrations

Put Early Exploitation Intelligence into Your Workflow

Automation-ready delivery for vulnerability management, CTI, SOC, and MSSP workflows. Pro API for deeper evidence and available telemetry; RSS and JSON for monitoring.

Start 14-day Pro trialTalk to SalesRead API docs

Channels

Delivery Options

Choose the channel that matches your workflow — from free monitoring feeds to Enterprise automation.

Pro API

JSON access to early exploitation intelligence — warning status, confidence, evidence, limited sensor telemetry, PoCs, scanner integrations, mentions, tags, and IoCs — plus read-only Watch items and notifications and the Priority action queue. Self-serve at $599/mo.

Start 14-day Pro trial

Enterprise

Everything in Pro plus full sensor telemetry, attacker intelligence API, and outbound webhooks. Deployable rules for ModSecurity, Cloudflare, and AWS WAF. Connect Cloudflare once, then deploy a vulnerability's rules to the zones you selected.

Talk to Sales

Free KEV JSON Feed

Registered Free JSON API with summary KEV catalog fields. Requires a confirmed account and API token. Included with the 14-day Pro trial and after it ends.

Start 14-day Pro trial

Free KEV RSS Feed

Registered Free RSS with summary KEV catalog updates at GET /feeds/kevs.rss?token=…. Requires a confirmed account and personal feed URL from your dashboard. CISA KEV does not provide RSS. Previdian does.

Start 14-day Pro trial

Apps

Apps

Install Previdian in the tools your team already searches.

Splunk

Previdian for Splunk polls the Pro or Enterprise API, keeps a vulnerability lookup you can join to scanner findings, and indexes Watch notifications when the threat changes. Enterprise can also index raw observations and attacker infrastructure.

View on Splunkbase

Comparison

Free vs Pro Delivery

The Free KEV RSS Feed and Free KEV JSON Feed expose early exploitation warnings with summary fields. Pro API adds deeper evidence and immediate sensor telemetry.

Capability Free KEV RSS Feed Free KEV JSON Feed Pro API
Exploited CVE catalog Yes (token) Yes (token) Yes
Registration required Yes Yes Yes
Confidence scoring No No Yes
Sensor telemetry No No Immediate API access
Full CVSS breakdown Summary fields Summary fields Yes
PoCs and private PoCs No No Yes
Scanner integrations No No Yes
Mentions, tags, IoCs No No Yes
Virtual patch availability Yes Yes (token) Yes
Deployable virtual patch rules No No Enterprise only
Watch items and notifications No No Yes (read)
Priority queue and workflow No No Yes

Enterprise

Enterprise API

The Enterprise API namespace at /api/v2/enterprise/* mirrors Pro enrichment — including Watch (read) and Priority (queue plus workflow) — and adds full sensor telemetry, attacker intelligence, virtual patches, and webhooks. Requires an Enterprise subscription and X-API-Token authentication.

  • GET /api/v2/enterprise/attackers — ranked source IPs observed targeting Previdian sensors across KEV-attested vulnerabilities
  • GET /api/v2/enterprise/attackers/:ip — per-IP profile with cross-CVE context, geo, ASN, and raw request paths and payload samples
  • GET /api/v2/enterprise/virtual_patches — deployable ModSecurity, Cloudflare, and AWS WAF rules. Cloudflare can also be deployed from the vulnerability after you connect an account.
  • GET /api/v2/enterprise/watchlist/items — read-only Watch items (same payload as Pro)
  • GET /api/v2/enterprise/watchlist/autonomous — current Autonomous Watchlist (ranked vulnerabilities Previdian currently assesses)
  • GET /api/v2/enterprise/watchlist/notifications — pull Watch notifications (complement to outbound webhooks)
  • GET|PATCH /api/v2/enterprise/priority_items/:cve_id — Priority queue item and workflow update
Talk to Sales Virtual patches Attacker Intelligence Read API docs

Schema

Pro API Example Fields

Representative enriched fields available via GET /api/v2/pro/kevs — not exposed on the free public feed.

{
  "cve_id": "CVE-2024-1234",
  "title": "...",
  "affected_vendor": "...",
  "affected_product": "...",
  "description": "...",
  "references": ["..."],
  "cvss_score": 9.8,
  "cvss_v3_1": { "base_score": 9.8, "vector": "..." },
  "epss_score": 0.95,
  "exploit_status": { "exploited_in_the_wild": true },
  "cwes": [{ "cwe_id": "CWE-79", "name": "..." }],
  "tags": [{ "name": "wordpress", "colour": "#FF5733" }],
  "proof_of_concepts": [{ "poc_type": "github", "title": "...", "private": false, "quality_confidence": 0.87, "quality_assessed_by": "ai" }],
  "scanner_integrations": [{ "scanner": "Nuclei", "plugin_id": "..." }],
  "mentions": [{ "source": "...", "url": "...", "date": "..." }],
  "iocs": [{ "ioc_type": "ip", "value": "...", "first_seen_at": "..." }],
  "primary_source": { "name": "CISA", "url": "..." },
  "all_sources": [{ "name": "...", "url": "..." }]
}

Sensor telemetry, confidence scoring, and per-observation fields are available on Pro CVE endpoints and related Pro API resources. See the API docs for the full schema.

Start 14-day Pro trial Talk to Sales Read API docs

Automate

Ready to Plug Into Your Workflow?

Start with free RSS or JSON monitoring, upgrade to Pro for enriched automation, or talk to us about Enterprise telemetry and virtual patches.

Start 14-day Pro trial Talk to Sales Read API docs