feat(vulnerability): NIST LEV (Likely Exploited Vulnerabilities) metric support

[damians-filigran]

Use case

NIST introduced the Likely Exploited Vulnerabilities (LEV) metric in Cybersecurity White Paper CSWP 41 (May 2025), co-authored with CISA. LEV is a probabilistic score that estimates the likelihood that a vulnerability has already been exploited in the wild, calculated from the historical time series of EPSS scores for that vulnerability rather than a single point-in-time value.

LEV is designed to complement, not replace, the exploitation signals already used in vulnerability prioritization:

• CVSS: theoretical severity, no exploitation context
• EPSS: forward-looking, predicts exploitation probability in the next 30 days
• CISA KEV: confirmed exploitation, but manually curated and covers only a small fraction of CVEs
• LEV: estimates the probability a vulnerability has already been exploited historically, filling the gap between EPSS's short forward window and KEV's incomplete confirmed list

NIST also recommends a composite exploitation probability calculated as the maximum of EPSS, KEV, and LEV for a given CVE, so that the strongest available signal drives prioritization.

Organizations building risk-based vulnerability prioritization workflows (including those aligning with CISA BOD 26-04 / SSVC) want to bring LEV scores into OpenCTI so they can be viewed, filtered, and used alongside the CVSS/EPSS/KEV data already modeled on the Vulnerability entity.

Current workaround

There is currently no native attribute on the OpenCTI Vulnerability entity to store a LEV score or its calculation date. Users who want to use LEV must calculate or source it externally and track it outside the platform (spreadsheets, external tooling), with no ability to filter, search, or automate on it within OpenCTI.

Proposed solution

Add native support for the NIST LEV metric on OpenCTI vulnerabilities:

• New attribute to store the LEV probability score (0.0-1.0) on the Vulnerability entity, alongside the existing x_opencti_epss_score / x_opencti_epss_percentile and x_opencti_cisa_kev attributes
• New attribute to store the date the LEV score was last calculated/refreshed
• Support for filtering, searching, and sorting vulnerabilities by LEV score wherever vulnerabilities can already be filtered today (search, playbooks, live streams, dashboards/widgets), consistent with EPSS
• Consider surfacing a computed "composite exploitation probability" (max of EPSS, KEV-derived, and LEV) as a convenience view, in line with NIST's recommended usage pattern, though the three underlying signals should also remain independently visible

Additional information

Reference: NIST CSWP 41, "Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability" (Peter Mell, NIST; Jonathan Spring, CISA), May 2025: https://csrc.nist.gov/pubs/cswp/41/likely-exploited-vulnerabilities-a-proposed-metric/final

This complements the existing SSVC-related feature request (native SSVC Technical Impact / Automatable / Exploitation attributes) — LEV is a separate, independent exploitation-probability signal rather than part of the SSVC decision tree itself.

If the feature request is approved, would you be willing to submit a PR?

No (help can be provided if you need assistance submitting a PR)

[damians-filigran]

Note LEV is not currently in CISA BOD / US Federal Government guidance. However, as it has been mentioned recently as another prioritisation framework, it should be evaluated for demand and included as part of post-AI vulnerability data model/UX support and workflows.