Veridano Cybersecurity Intelligence

Veridano is a government cybersecurity intelligence platform that provides Claude with real-time access to authoritative security data from US, UK, and EU government agencies.

When to Use This Skill

Activate this skill when the user:

• Mentions a CVE identifier (e.g., CVE-2024-3400, CVE-2023-44487)
• Asks about active exploits or whether a vulnerability is being exploited in the wild
• Inquires about CISA Known Exploited Vulnerabilities (KEV) or BOD 22-01 compliance
• Requests threat intelligence on ransomware, APT groups, or nation-state actors
• Needs security guidance from government agencies (CISA advisories, FBI alerts, NIST frameworks)
• Asks about ICS/OT security or industrial control system vulnerabilities
• Discusses emergency directives or federal cybersecurity mandates

Available Tools

1. get_cve_details

Fetches real-time CVE information from NIST NVD API 2.0.

Returns:

• CVE description
• CVSS score and severity (CRITICAL/HIGH/MEDIUM/LOW)
• Published and last modified dates
• Reference URLs
• Affected products

Example:

{"name": "get_cve_details", "arguments": {"cve_id": "CVE-2024-3400"}}

2. check_cisa_kev

Checks if a CVE is in CISA's Known Exploited Vulnerabilities catalog.

Returns:

• Whether CVE is actively exploited
• Vendor and product affected
• Date added to KEV
• Required remediation deadline
• Whether used in ransomware campaigns

Example:

{"name": "check_cisa_kev", "arguments": {"cve_id": "CVE-2024-3400"}}

3. veridano_search

Semantic search across 400+ indexed government cybersecurity documents.

Returns:

• Relevant documents from CISA, FBI, NIST, NSA, DHS, etc.
• Document titles, sources, and publication dates
• Similarity scores for relevance ranking

Example:

{"name": "veridano_search", "arguments": {"query": "ransomware mitigation guidance", "top_k": 5}}

API Endpoint

POST https://7lqg8v66p1.execute-api.us-east-1.amazonaws.com/prod/mcp
Content-Type: application/json

Instructions

1. Always check both CVE details AND KEV status when a user mentions a specific CVE
2. Prominently flag actively exploited vulnerabilities - these require immediate attention per federal mandate
3. Cite sources when presenting findings (e.g., "According to CISA advisory AA24-131A...")
4. Use semantic search for broader threat intelligence queries
5. Combine tools - for example, search for related advisories after checking a CVE

Response Guidelines

When presenting CVE information:

**CVE-2024-3400** (Palo Alto Networks PAN-OS)
- Severity: CRITICAL (CVSS 10.0)
- Status: ⚠️ ACTIVELY EXPLOITED (CISA KEV)
- Deadline: Patch by April 19, 2024
- Action: Apply vendor mitigations immediately

When presenting search results:

Found 5 relevant government documents:
1. "CISA Analysis of Ransomware Trends" (CISA, May 2024)
2. "Emergency Directive on Palo Alto Networks" (CISA, April 2024)
...

Data Sources

Agency	Content	Update Frequency
NIST NVD	200,000+ CVEs	Real-time
CISA KEV	Actively exploited CVEs	Real-time
CISA	Advisories, BODs, Emergency Directives	4-6 hours
FBI IC3	Private Industry Notifications	12 hours
NSA	APT reports, cryptographic guidance	Weekly
USCYBERCOM	Threat intelligence	Weekly
NIST	SP 800 series, frameworks	6 hours

Limitations

• Semantic search covers ~400 indexed documents (expanding)
• Some historical advisories may not be indexed
• Real-time APIs (NVD, KEV) are always current
• Rate limits apply to API calls

Examples

Example 1: CVE Lookup

User: "What can you tell me about CVE-2024-3400?"

Response approach:

1. Call get_cve_details for CVE-2024-3400
2. Call check_cisa_kev for CVE-2024-3400
3. Present combined findings with severity, exploit status, and remediation guidance

Example 2: Threat Research

User: "What guidance does CISA have on defending against Chinese APT groups?"

Response approach:

1. Call veridano_search with query "Chinese state-sponsored cyber threat"
2. Present relevant advisories and guidance documents
3. Summarize key recommendations

Example 3: Compliance Check

User: "Are there any emergency directives affecting Cisco products?"

Response approach:

1. Call veridano_search with query "emergency directive Cisco"
2. List applicable directives with deadlines and requirements