Daily CVE exploitation alerts for your Slack security channel

Every weekday at 8am, run an early-warning check on my CVE watchlist and post a prioritized exploitation summary to our security channel in Slack, but only on days when something on the watchlist is actually being exploited.

My watchlist is the set of CVEs that affect our stack and key vendors. Store the list of CVE IDs inside the workflow so I can maintain it over time. I will fill in the specific CVE IDs; treat that list as the input for each run. Post the alert into our security channel (I will specify the exact channel, for example #security).

Run a GreyNoise Bulk CVE Lookup across the entire watchlist in a single request to see which of those CVEs GreyNoise is currently observing under active internet exploitation, along with the exploitation trend and the number of attacking IPs it is seeing. For any CVE that looks notable, meaning it is actively exploited or its scanning and exploitation activity appears to be surging, call GreyNoise Retrieve CVE Information for that single CVE to pull the full timeline and observed exploitation detail so I can judge the trend and roughly how many IPs are involved.

Remember which watchlist CVEs were under active exploitation on the previous run. Flag any CVE that has newly crossed into active exploitation since the last run and lead the summary with those, since a fresh surge in activity often precedes wider attacks and new disclosures.

When at least one watchlist CVE is under active exploitation, post a prioritized summary to our security channel in Slack using the Slack Bot Send a Message action, posting as our automated bot rather than as a specific person. Order the summary by urgency and lead with anything newly exploited since the last run. For each flagged CVE include the exploitation trend (rising, steady, or declining), roughly how many attacking IPs GreyNoise is observing, and a one-line recommended action of patch now, monitor, or no action. Use Slack formatting so the message is easy to skim.

If nothing on the watchlist is under active exploitation that day, do not post to Slack at all. The channel should only light up when there is real exploitation activity worth acting on.