# Investigate a CVE

> Look up a CVE in Oyster's Security Intel, read its severity, exploitation status and affected versions, and plan detection and mitigation.

Source: https://documentation.redorca.ai/guides/blue-team/investigate-a-cve/
Last updated: 2026-11-01

1. **Ask Security Intel for the CVE by its identifier**, for example `CVE-2021-44228`. Open **Security Intel** under **Blue Team**.
2. **Read the direct answer**, with severity, exploitation status and affected systems, and open the sources it lists.
3. **Prioritise.** Check whether it is on the list of known exploited vulnerabilities (KEV), and its likelihood of exploitation (EPSS) where shown.
4. **Confirm exposure.** Compare your installed version with the affected range in the cited advisory.
5. **Plan detection and mitigation.** Ask follow-up questions in chat — "How would I detect exploitation of this in web server logs?" — or draft a rule in [SOC Copilot](https://documentation.redorca.ai/guides/blue-team/soc-copilot/).

:::tip
Oyster will not invent a CVE. If it has no record of an identifier, it says so — **Not found in local knowledge base** — rather than guessing. Check the identifier, then consult the vendor's advisory.
:::

See [Security Intelligence](https://documentation.redorca.ai/guides/security-intelligence/) for everything Security Intel can answer.