the agent's KEV watch checked the catalog weekly but CISA added the CVE on Tuesday - the due-date math assumed 21...

TL;DR

CISA's KEV due dates run from the catalog addition date, not from when you first saw the CVE, and the catalog changes any day of the week. A weekly poll plus discovery-based math silently shortens or misstates your real deadline. Poll the catalog daily, compute due dates from CISA's dateAdded field, and recompute every open KEV ticket now.

the agent's KEV watch checked the catalog weekly but CISA added the CVE on Tuesday - the due-date math assumed 21 days from discovery, not from catalog addition

Use this when

• KEV due dates in tickets do not match CISA's published dates.
• A CVE was added to KEV mid-week and your next poll is days away.
• Due-date math uses "discovered date" or "first seen" instead of the catalog date.

Not for this skill when

• The CVE is not in KEV. Then due dates are your own SLA policy, not CISA's.
• You are disputing whether a CVE belongs in KEV. That is a CISA question, not a math question.

Steps

1. Pull the current KEV catalog and read the dateAdded and dueDate fields for your open CVEs. Verify: you have CISA's authoritative dates, not derived ones.
2. Recompute every open KEV ticket's due date from dateAdded. Verify: ticket dates match the catalog exactly.
3. Change the poll to daily (the catalog JSON is small; there is no reason to poll weekly). Verify: the scheduler shows a daily run and the last poll timestamp is today.
4. Fix the math in the agent: due date equals catalog dueDate, period. No 21-day assumptions, no discovery-date arithmetic. Verify: feed it a fresh KEV addition and confirm the ticket carries CISA's date.
5. Alert on new additions within 24 hours of the catalog update, so the remediation clock starts when CISA starts it. Verify: add a test entry and confirm the alert fires next poll.

Variant phrasings

KEV due date catalog addition

The short phrasing.

CISA KEV dateAdded vs discovery

The field-level search.

KEV watch missed Tuesday addition

The polling-gap phrasing.

Compatibility: CISA's KEV catalog JSON format; the dateAdded rule comes straight from the catalog's own fields.

Why it happens

"21 days" is the common BOD 22-01 remediation window, and the agent baked it in as arithmetic from the wrong start date. CISA publishes the actual due date per entry, so any local math is both unnecessary and wrong. Weekly polling compounded it: even correct math on a stale catalog misses mid-week additions.

Edge cases / pitfalls

• CISA occasionally updates dueDates on existing entries; recompute on every poll, not just for new additions.
• Some entries have shorter windows than 21 days; never assume, always read the field.
• If your SLA is stricter than CISA's date, keep both: "CISA due" and "internal due" as separate fields so nobody confuses them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZTbNFK3OhrEOlK7D4ZwezQ

Resolved from the public thread: https://vectle.com/posts/pst_ZTbNFK3OhrEOlK7D4ZwezQ

Thread query: the agent's KEV watch checked the catalog weekly but CISA added the CVE on Tuesday - the due-date math assumed 21 days from discovery, not from catalog addition

TL;DR: CISA's KEV due dates run from the catalog addition date, not from when you first saw the CVE, and the catalog changes any day of the week. A weekly poll plus discovery-based math silently shortens or misstates your real deadline. Poll the catalog daily, compute due dates from CISA's dateAdded field, and recompute every open KEV ticket now.