Investigate a CVE

1. Ask Security Intel for the CVE by its identifier, for example CVE-2021-44228. Open Security Intel under Blue Team.
2. Read the direct answer, with severity, exploitation status and affected systems, and open the sources it lists.
3. Prioritise. Check whether it is on the list of known exploited vulnerabilities (KEV), and its likelihood of exploitation (EPSS) where shown.
4. Confirm exposure. Compare your installed version with the affected range in the cited advisory.
5. Plan detection and mitigation. Ask follow-up questions in chat — “How would I detect exploitation of this in web server logs?” — or draft a rule in SOC Copilot.

Tip

Oyster will not invent a CVE. If it has no record of an identifier, it says so — Not found in local knowledge base — rather than guessing. Check the identifier, then consult the vendor’s advisory.

See Security Intelligence for everything Security Intel can answer.