Vulners enrichment connector for OpenCTI

A CVE ID in your OpenCTI instance tells you a vulnerability exists. It doesn't tell you whether someone is actively exploiting it, what products are affected, or whether a proof-of-concept is floating around. The Vulners connector adds that context — on demand, for the CVEs your team is actually tracking. It works with a free API key (some enrichments are limited — details below), ships as a Docker image, and takes five minutes to deploy.

OpenCTI in thirty seconds

OpenCTI is an open-source threat intelligence platform built on STIX 2.1. Security teams use it to aggregate, correlate, and visualize threat data — from vulnerability tracking to incident response. It runs as a Docker stack and supports a modular connector architecture: import connectors pull data in, enrichment connectors add context to what's already there.

Vulners is an internal enrichment connector. It doesn't import bulk data on a schedule. It triggers when a Vulnerability entity appears in your instance — either automatically or when an analyst clicks the enrichment button — and writes structured STIX objects back.

What the connector enriches

Once a CVE ID appears in your investigation — imported from a feed, dropped by a STIX bundle, or created manually — Vulners adds:

Scoring and prioritization signals. EPSS score and percentile, CISA KEV status with first-seen-active date, complete CVSS vectors (v2, v3.1, v4.0) with all sub-scores populated, CWE classification, and the Vulners AI Score on a paid key — a proprietary risk ranking that combines CVSS, EPSS, and real-world exploitation data.

Semantic labels. The connector auto-generates descriptive labels from the vulnerability context — things like "Remote Code Execution," "Unauthenticated Upload," "Joomla Extension," specific product and version identifiers. These labels power OpenCTI's filtering, dashboarding, and playbook automation without manual tagging.

Affected software. Software observables linked to the vulnerability via STIX relationships. On a paid key, these carry full CPE strings and version ranges — and because they're proper STIX objects (not flat text), software entries that appear in multiple CVEs link to the same observable. That means you can pivot from any product to every CVE affecting it.

Exploits and tools. Tool entities representing known exploit PoCs, linked back to the vulnerability. If exploitation code exists, it shows up as a named, navigable object in your knowledge graph.

Intelligence reports. Report entities referencing vendor advisories, threat intel articles, and CISA alerts related to the CVE. On a paid key, you get the full set — titles, dates, and content. On a free key, the connector creates a summary stub with the count so you know the intelligence exists.

Relationships. STIX relationships (HAS, TARGETS) tying all of the above together. The enriched CVE isn't a richer flat record — it's a connected node in your knowledge graph with navigable links to software, exploits, and reports.

How it compares to the alternatives

The NVD/CVE connector imports vulnerability records — CVE ID, base CVSS score, NVD references. What it doesn't provide: affected software with CPE configurations (the #1 user-requested feature in the connector's issue tracker), exploit intelligence, vendor advisory aggregation, or EPSS. The CVSS vector is often partial. Vulners fills all of these — pulling CPE configurations from NVD, from CNAs that publish CPE as part of the CVE record, and from Vulners' own generated configs when available, or falling back to the CNA-provided affected data.

The FIRST EPSS connector adds a score and a percentile. That's it — one data point. Vulners enrichment includes EPSS as part of a broader picture alongside CISA KEV status, full CVSS vectors, semantic labels, affected software, and exploit references. You get EPSS without running a separate connector for it.

Bulk import connectors take the opposite approach: they pull every CVE, every exploit, every advisory from their API on a 24-hour cycle. Their own documentation warns this creates "a very large number of STIX objects and relationships" that may require a clustered OpenCTI deployment. Vulners doesn't work that way. As an internal enrichment connector, it fires only when a CVE appears in your instance. You get deep context on the vulnerabilities that matter to your organization, not a firehose of 200k+ records you'll never look at.

Setup

The connector is in the official OpenCTI connectors repository and ships as a pre-built Docker image.

Add it to your existing docker-compose.yml:

connector-vulners:
  image: opencti/connector-vulners:latest
  environment:
    - OPENCTI_URL=http://opencti:8080
    - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
    - CONNECTOR_ID=ChangeMe            # uuidgen
    - CONNECTOR_TYPE=INTERNAL_ENRICHMENT
    - CONNECTOR_NAME=Vulners
    - CONNECTOR_SCOPE=Vulnerability
    - CONNECTOR_AUTO=true
    - CONNECTOR_LOG_LEVEL=error
    - VULNERS_API_KEY=${VULNERS_API_KEY}
    - VULNERS_API_BASE_URL=https://vulners.com
    - VULNERS_MAX_TLP_LEVEL=TLP:AMBER
  restart: always

Set CONNECTOR_AUTO=true to enrich every new Vulnerability automatically, or false for manual enrichment via the UI.

The full configuration reference, manual deployment instructions, and a Mermaid data flow diagram are in the connector README.

Free key vs. paid key

The connector works with a free Vulners API key — no CVE limits, no quotas. Free enrichment populates EPSS, CISA KEV, full CVSS vectors, CWE classification, semantic labels, and data coverage counts (e.g., "72 affected products, 3 exploits, 10 reports"). Stub entities are created for software, exploits, and reports — clean single records reused across CVEs so your database stays tidy.

A trial or paid key unlocks the full experience: named software products with CPE strings and version ranges, exploit PoC names and details, complete intelligence reports with titles and dates, the Vulners AI Score, and cross-CVE software linking for pivot-based triage.

Try it

The free key already answers the critical triage questions — is this exploited? How many products are affected? What's the EPSS percentile? Is it in CISA KEV? — and the setup takes five minutes: one service in your docker-compose.yml, one API key, done.

Get your free API key to start enriching CVEs immediately. If you want to evaluate the full intelligence set — named products, exploit details, complete reports, cross-CVE pivoting — request a trial.