First EPSS

The First EPSS integration allows users to retrieve EPSS score from First EPSS API.

The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability (CVE) will be exploited in the wild.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

The First EPSS integration collects one type of data stream: vulnerability

EPSS scores are retrieved via the First EPSS API (https://api.first.org/data/v1/epss).

The package ships a latest transform that maintains the most recent EPSS score per CVE in the lookup index logs-first_epss_latest.vulnerability. The full EPSS catalog is re-ingested on every poll cycle, so the same CVE is re-ingested repeatedly with updated scores. The transform collapses those snapshots into the latest row per CVE, making it the preferred enrichment path.

You can enrich vulnerability findings at query time with the ES|QL LOOKUP JOIN command on vulnerability.id:

FROM logs-endpoint.vulnerability-*
| LOOKUP JOIN logs-first_epss_latest.vulnerability ON vulnerability.id
| KEEP vulnerability.id, first_epss.vulnerability.epss, first_epss.vulnerability.percentile, first_epss.vulnerability.date
| WHERE first_epss.vulnerability.epss IS NOT NULL

This integration has been tested against the EPSS API v1.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

For step-by-step instructions on how to set up an integration, see the Getting started guide.

This is the vulnerability dataset.

{
    "@timestamp": "2026-10-06T20:30:28.953Z",
    "agent": {
        "ephemeral_id": "e5f88865-29bd-48c3-84ca-f8b1dc6b8bd9",
        "id": "807d40d8-b29b-47c4-977a-97c9a1bce295",
        "name": "elastic-agent-86119",
        "type": "filebeat",
        "version": "9.5.4"
    },
    "data_stream": {
        "dataset": "first_epss.vulnerability",
        "namespace": "92826",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "807d40d8-b29b-47c4-977a-97c9a1bce295",
        "snapshot": false,
        "version": "9.5.4"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "first_epss.vulnerability",
        "ingested": "2026-10-06T20:30:31Z",
        "kind": "enrichment",
        "module": "first_epss",
        "type": [
            "info"
        ]
    },
    "first_epss": {
        "vulnerability": {
            "cve": "CVE-2024-8348",
            "date": "2024-08-31T00:00:00.000Z",
            "epss": 0.00045,
            "percentile": 0.16323
        }
    },
    "host": {
        "architecture": "aarch64",
        "containerized": false,
        "hostname": "elastic-agent-86119",
        "ip": [
            "172.19.0.2",
            "172.18.0.7"
        ],
        "mac": [
            "5A-D3-26-3D-57-B8",
            "9E-AD-92-9D-70-E9"
        ],
        "name": "elastic-agent-86119",
        "os": {
            "family": "",
            "kernel": "7.0.14-linuxkit",
            "name": "Wolfi",
            "platform": "wolfi",
            "type": "linux",
            "version": "20230201"
        }
    },
    "input": {
        "type": "cel"
    },
    "labels": {
        "is_transform_source": "true"
    },
    "vulnerability": {
        "id": "CVE-2024-8348",
        "reference": "https://api.first.org/data/v1/epss?pretty=true&cve=CVE-2024-8348"
    }
}

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.