Threat Intelligence in a Box
(TIB)
CISA KEV + EPSS in your own Grafana. Sync the catalogues, cross-reference your VIB scans, and answer the only question that matters: out of all my CVEs, which ones are actually being exploited?
VIB tells you that you have 2,400 CVEs. Cool. Now what? TIB syncs the CISA Known Exploited Vulnerabilities catalogue (~1,200 CVEs with confirmed exploitation in the wild) and EPSS exploitation probability scores from FIRST.org, cross-references them against your VIB data, and gives you the actionable list: "out of 2,400 CVEs in my environment, 3 are on CISA KEV with active exploitation — fix those first." No API keys, no cloud accounts, fully self-hosted.
⚡ Quick Start
git clone https://github.com/matijazezelj/tib.git && cd tib
cp .env.example .env # optional: set VIB_VICTORIAMETRICS_URL for cross-referencing
make up
Open Grafana at http://localhost:3002 and the prioritisation dashboard lights up as soon as the first feed sync finishes.
🧠 The Problem TIB Solves
CVSS scores are theoretical. A CRITICAL CVSS 9.8 with zero real-world exploitation is less urgent than a HIGH CVSS 7.5 that’s being weaponised in active ransomware campaigns this week. The data to make that call exists — CISA publishes it, FIRST publishes it — but nobody’s wiring it into your fleet view for you.
TIB does exactly that:
- Pull CISA KEV — the canonical list of CVEs being actively exploited in the wild, maintained by CISA, updated almost daily.
- Pull EPSS — the Exploit Prediction Scoring System from FIRST.org, which scores every CVE on the probability of exploitation in the next 30 days (0.0–1.0).
- Cross-reference with VIB — if you’ve wired TIB to VIB’s VictoriaMetrics, every KEV match in your environment lights up with the image it’s in.
- Visualise — Grafana dashboard sorts your CVEs by what’s actually being exploited, not just what scores high on a calculator.
🛡️ What You Get
| Component | Technology | Purpose |
|---|---|---|
| tib-collector | Custom Go service | Syncs CISA KEV + EPSS feeds, pushes metrics |
| Storage | VictoriaMetrics (port 8430) | Time-series store for KEV/EPSS data |
| Visualization | Grafana (port 3002) | Pre-built prioritisation dashboard |
| VIB hook | VictoriaMetrics federation | Optional — cross-reference KEV matches against your fleet |
Works standalone (just shows you the CISA KEV + EPSS data on its own) or wired to VIB for full cross-referencing against the CVEs you actually have.
📊 Dashboard
The bundled Grafana dashboard answers the questions that matter:
| Panel | What it shows |
|---|---|
| KEV matches in environment | The headline number — how many CVEs you have that CISA confirms are being exploited |
| Top KEV matches by image | Which of your images have the actively-exploited CVEs |
| Ransomware-tagged matches | KEV entries flagged as used in ransomware campaigns — patch these first |
| CISA KEV due dates | CISA gives federal agencies a deadline; the same deadline is a useful pressure for you |
| EPSS distribution | Where your CVEs sit on the exploitation-probability curve |
| Top EPSS scores in your fleet | The CVEs not on KEV yet but with the highest predicted exploitation risk |
| Feed sync status | Last successful sync per feed, entries per feed, total KEV catalogue size |
🔗 VIB Integration
The whole point of TIB is the cross-reference. Standalone, it just shows you what’s in the public catalogues. Pointed at VIB, it tells you what’s exploitable in your environment.
# .env
VIB_VICTORIAMETRICS_URL=http://vib-victoriametrics:8428
The tib-collector queries VIB’s VictoriaMetrics for active CVEs across your fleet, intersects that set with the CISA KEV catalogue and EPSS scores, and emits tib_kev_match metrics tagged with image, severity, vendor, product, KEV due date, and whether the CVE is associated with known ransomware campaigns.
In XIB the suite wires this up automatically — tib-collector joins VIB’s network and the cross-referencing works out of the box.
📈 Metrics Pushed
Every sync emits the following to VictoriaMetrics:
| Metric | Labels | Description |
|---|---|---|
tib_kev_matches_in_environment |
— | KEV CVEs found in your environment |
tib_kev_match |
cve_id, image, severity, vendor, product, due_date, ransomware |
1 per active KEV match |
tib_cve_epss_score |
cve_id, image, severity |
EPSS exploitation probability (0–1) |
tib_cve_epss_percentile |
cve_id, image |
EPSS percentile rank |
tib_kev_total |
— | Total CVEs in CISA KEV catalogue |
tib_feed_entries_total |
feed |
Entries per feed |
tib_last_sync_timestamp |
feed |
Last successful sync per feed |
Alert on tib_kev_matches_in_environment > 0. Or tib_kev_match{ransomware="true"}. Or tib_cve_epss_score > 0.9. Whatever your patching SLA actually is.
⚙️ Configuration
| Variable | Default | Description |
|---|---|---|
GRAFANA_ADMIN_PASSWORD |
auto | Grafana admin password (auto-generated if unset) |
GRAFANA_PORT |
3002 |
Host port for Grafana |
VICTORIAMETRICS_PORT |
8430 |
Host port for VictoriaMetrics |
SYNC_INTERVAL_HOURS |
6 |
How often to refresh CISA KEV + EPSS feeds |
SYNC_ON_STARTUP |
true |
Run a sync immediately on container start |
VIB_VICTORIAMETRICS_URL |
(empty) | VIB VictoriaMetrics URL for CVE correlation |
No API keys. No registration. The CISA KEV catalogue and the EPSS API are both public — TIB just fetches and federates.
👥 Who This Is For
- DevOps / SecOps running VIB (or any CVE scanner) and drowning in a backlog they can’t realistically clear
- Anyone who’s ever asked “which of these 800 CVEs should I patch this week?” and gotten the answer “all of them”
- Teams under audit pressure who need to show evidence of risk-based prioritisation, not just “we patched everything CRITICAL”
- Homelabbers who want enterprise-grade threat intelligence without paying for VulnDB / Recorded Future / Mandiant
Who This Is NOT For
- Shops already paying for commercial vuln-intel (you have richer feeds already)
- Teams who don’t have a CVE scanner yet — start with VIB, then add TIB once you have data to cross-reference
- Anyone needing exploit detection / IoC matching at runtime — that’s a SIEM job; pair with SIB
🔗 Pairs Well With
- VIB — TIB without VIB is just the public CISA catalogue in your Grafana; with VIB, it becomes “what’s exploitable in my fleet”
- XIB — TIB joins the umbrella suite, wired to VIB automatically, single Grafana
- CIB — vulnerabilities, compliance, and exploitation risk all in one prioritisation view
📄 License
Apache 2.0 License — use it, modify it, build on it.
Ready to stop patching by CVSS score alone?
View on GitHub🚀 Need Help Getting Started?
Self-hosting is free and always will be. But if you'd rather have it deployed, configured, and maintained for you — I can help.