Turning a CVE into a vulnerability advisory with zsazsa and Flowintel

In the previous post we used zsazsa to build a daily threat briefing from the material you already collect in MISP. We stay with the same approach, creating products from the information you have, but this time we focus on one of the most routine jobs for a CTI team: turning a CVE into a vulnerability advisory.

Create a daily threat briefing with zsazsa and MISP

By Koen Van Impe

June 8, 2026

Create a daily threat briefing with zsazsa and MISP

Introduction

zsazsa is a small application that supports day-to-day CTI work, including stakeholder management, handling PIRs, GIRs and RFIs, data collection, and the creation of threat intelligence products. No external tooling is required, MISP acts as the back-end storage layer. Events, reports, and the final intelligence products are all stored in MISP. A nice side effect is that those products are not limited to the usual notification channels like Mattermost or Teams; they can also be shared through the standard MISP sharing and distribution model, in the same way as threat events. You can find zsazsa on GitHub: https://github.com/cudeso/zsazsa/.