CVE Metadata Enrichment
Purpose
Enriches CVE nodes already created by other modules (image scanning, CrowdStrike, Semgrep, SentinelOne) with metadata from the National Vulnerability Database (CVSS, severity, references, problem types) and exploit-probability scores from the EPSS feed.
The module runs as a post-sync step after every CVE-producing module. It is enabled by default for every tenant — no setup is required for the default flow.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Optional Fields
| Field | Secret? | Description |
|---|---|---|
cve_metadata_nist_api_key |
Yes | (Optional) NVD API key for higher rate limits during enrichment |
Setup Steps
The module runs as soon as a CVE-producing sync (scan, CrowdStrike, Semgrep, SentinelOne) completes — no configuration required.
To raise the NVD rate limit on large enrichments:
- Request a key at https://nvd.nist.gov/developers/request-an-api-key.
- In SubImage, enter the key in
cve_metadata_nist_api_key(or its AWS Secret ARN) and save the module.