My manager asked me to research the fastest ways for our security operations center to start responding to zero-day exploit alerts effectively using current threat intel feeds.
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
My manager asked me to research the fastest ways for our security operations center to start responding to zero-day exploit alerts effectively using current threat intel feeds.
4 real searches · 1 real-search pass
2026 zero-day vulnerability threat intelligence SOC response CISA KEV EPSS FIRST official guidanceGoogle ↗
OBSERVED
CISA Known Exploited Vulnerabilities catalog official API advisories 2026Google ↗
OBSERVED
FIRST EPSS documentation daily probability exploitation officialGoogle ↗
OBSERVED
MISP threat intelligence platform feeds STIX TAXII official documentationGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 4 queries…
Searches and sources
ChatGPT4 real searches · gpt-6
2026 zero-day vulnerability threat intelligence SOC response CISA KEV EPSS FIRST official guidance Google ↗
CISA Known Exploited Vulnerabilities catalog official API advisories 2026 Google ↗
FIRST EPSS documentation daily probability exploitation official Google ↗
MISP threat intelligence platform feeds STIX TAXII official documentation Google ↗
- CISA KEV Catalog · cisa.gov
- FIRST EPSS · first.org
- EPSS Frequently Asked Questions · first.org
- NIST NVD · nvd.nist.gov
- MISP Project · misp-project.org
- Microsoft Security Response Center · msrc.microsoft.com
- Vulnerability management | Guidance | 2. Responding to active exploitation of vulnerabilities · ncsc.gov.uk
- Reducing the Significant Risk of Known Exploited Vulnerabilities · dejavu.org
- Integrate your own threat intelligence feeds | Google Security Operations | Google Cloud Documentation · docs.cloud.google.com
- CISA Releases Binding Operational Directive 26-04 on Prioritizing Security Updates Based on Risk · content.govdelivery.com
- Using EPSS · first.org
- CISA – BOD 26-04 Implementation Guidance · cisa.gov
Queries
4 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
2026 zero-day vulnerability threat intelligence SOC response CISA KEV EPSS FIRST official guidance OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
CISA Known Exploited Vulnerabilities catalog official API advisories 2026 OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
FIRST EPSS documentation daily probability exploitation official OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
MISP threat intelligence platform feeds STIX TAXII official documentation OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |