Search National Advisories
search_national_advisoriesSearch national CERT advisories and government campaign advisories by words, exact CVE id, vendor, product, country, publisher, advisory type, ATT&CK technique, authoring agency or date. Served: NCSC-NL (Netherlands), CERT-EU (EU institutions) and CERT-FR (ANSSI, France) vulnerability advisories (advisory_type=vulnerability; CERT-FR avis and alertes from 2024 onward), CERT-FR CTI reports (publisher=cert-fr, advisory_type=threat_report), and U.S. federal campaign advisories hosted by FBI IC3 (publisher=ic3, advisory_type=campaign: Cybersecurity Advisories and FLASH reports authored by U.S. federal agencies alone, such as FBI, CISA and NSA; co-authored advisories are not served). Use technique= (e.g. T1190; a parent id also matches its sub-techniques) to ask which current campaigns report a technique. Poll with since= (published or updated on or after a date) to read only what is new since your last read. vendor and product match the CERT's published product tree where the CERT publishes CSAF (NCSC-NL), the title and summary text for the others, CERT-FR's affected systems as published (vendor and product), and, for every publisher, the vendor and product of the CVEs the advisory names (NVD CPE or the CISA KEV entry). Each row's vendor_product_match says which basis applied (products_as_published, affected_systems_as_published, title_summary_text or linked_cves) and vendor_product_linked_cves lists the matching CVEs; the response's vendor_product_coverage counts the in-scope advisories for which only title and summary text could be checked, so a miss there does not mean those advisories are unrelated. as_published.summary_truncated is true when a summary was cut at a sentence boundary. Each row keeps the publisher's own title, severity and summary under as_published (never re-scored or translated), our CVE, KEV and EPSS joins under linked, a citation to the advisory on the publisher's own site with its licence (CERT-EU rows carry a CC BY attribution_notice, CERT-FR rows a Licence Ouverte 2.0 attribution_notice), and its freshness (published_at, updated_at as published, fetched_at). Campaign rows add authoring_agencies, product_id, the ATT&CK technique ids asserted (with the backing passage for the technique you filtered on), attack_version and observation_window as the advisory states them (null when it does not), and withheld_blocks: the count and markers of blocks credited to third parties that are not served. Pass a row's advisory_id (also in its _citation.params) to get_national_advisory for affected products, every technique passage, mitigations and revision history. Example instruction: "Using Ansvar, list the national CERT advisories published since 2026-10-01 for vendor Ivanti, check each one against the products and versions in our asset inventory, and tell me which affect us and what to patch first."
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "search_national_advisories"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | Words in the advisory title or summary (any language) | |
| since | No | Published or updated on/after (YYYY-MM-DD) | |
| cve_id | No | Exact CVE id the advisory names | |
| vendor | No | Vendor name (substring, case-insensitive) | |
| country | No | Publishing country (EU = CERT-EU, US = IC3 campaign advisories, FR = CERT-FR) | |
| product | No | Product name (substring, case-insensitive) | |
| publisher | No | Publisher key (ic3 = U.S. federal campaign advisories hosted by FBI IC3; cert-fr = CERT-FR, ANSSI) | |
| technique | No | MITRE ATT&CK technique id a campaign advisory asserts (parent id also matches sub-techniques) | |
| advisory_type | No | vulnerability = CERT vulnerability advisories; campaign = government reports of observed attacker behaviour; threat_report = CERT-FR CTI reports (threat and incident reports) | |
| authoring_agency | No | Authoring agency of a campaign advisory (acronym) |