Triage CISA KEV vulnerabilities from Slack with interactive buttons
Build a scheduled workflow that pulls the CISA KEV catalog and filters for entries added today. Convert each to readable markdown and post to Slack with interactive buttons (e.g., Affected / Not affected / Investigate). On a button click, verify the Slack signature, present an intake form, and create a Tines case capturing the decision and details. Deduplicate against previously posted CVEs, handle empty days, and retry API errors. Output the KEVs posted and any cases created.
What this prompt builds
Post each newly added CISA KEV to Slack with triage buttons and open a case on intake.
The problem
The CISA Known Exploited Vulnerabilities catalog updates constantly, but teams don't have a fast way to review new entries and decide if they're affected. Critical, actively-exploited CVEs slip past unreviewed.
Solution and impact
This workflow fetches newly added KEVs daily, formats them, and posts each to Slack with interactive triage buttons, opening a Tines case when an analyst submits the intake. New exploited vulnerabilities get same-day human review and tracked follow-up.