Before
Someone had to periodically download the latest vulnerability catalog, locate the correct SharePoint site and drive, and upload the CSV file manually. The process depended on someone remembering the update schedule and naming or storing each file consistently.
How it works
- A scheduled trigger starts the update process at the configured recurrence.
- The latest CISA Known Exploited Vulnerabilities catalog is retrieved and the designated SharePoint site and drive are identified.
- The catalog is uploaded as a dated CSV file so users can search it or use it for semantic research.
Workflow details
- Scheduled execution: The workflow starts automatically according to a predefined schedule, which can be configured for recurring updates such as weekly or monthly runs.
- Catalog retrieval: It downloads the current Known Exploited Vulnerabilities CSV catalog from CISA so the stored reference reflects the latest available catalog at the time of execution.
- Destination discovery: The workflow identifies the designated SharePoint site and its available drives before preparing the file upload, avoiding the need to manually locate the storage destination for each update.
- Dated file delivery: The retrieved catalog is uploaded as a CSV file with a date-based name such as `KEV-YYYY-MM-DD.csv`, making each scheduled output identifiable and available for search or use in semantic research workflows.
What changed
Catalog retrieval, destination lookup, file naming, and SharePoint upload now occur automatically on a recurring schedule. Users receive a consistently named catalog file in the designated drive without a manual download-and-upload handoff.
Work removed
Manually downloading the latest CISA catalog, locating the correct SharePoint site and drive, naming the dated CSV file, and uploading it for internal use.
Expected outcome
Each scheduled run can remove at least three recurring manual actions—retrieval, destination lookup, and upload—while keeping a dated KEV catalog available for internal research.
