CISA Directives

https://www.cisa.gov/news-events/directives

Binding Operational Directives and Emergency Directives, high-priority defender signal. WebFetch HTTP 403 (re-confirmed 2026-05-08). REQUIRED: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives to discover /news-events/directives/{slug} hrefs, then `cisa page <full URL>` per directive for the body.. AVOID: WebFetch 403s the CISA UA, skip it, go straight to the bridge `cisa page` subcommand.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives` (reader-proxy, full body) to read BOD/ED text; the filtered listing `.../directives/all?f[0]=directive_type:35` works via `cisa page` too. | 2026-07-05 admiralty audit: A (primary-authority), CISA directives; bridge 403 is a known transport block (no demotion), directive series confirmed current via KEV references. Status stays active. | 2026-07-09: no RSS feed exists for directives; the listing DOES hydrate through the reader, `cisa page https://www.cisa.gov/news-events/directives` then grep /news-events/directives/<slug> hrefs for discovery (confirmed 2026-07-09: returns current BOD/ED links); new directives are also announced in the cisa-news feed (news.xml). | 2026-07-25: S1 reported no `cisa-directives` bridge subcommand in fetch_source.py; content reachable via `cisa page <advisory-url>`. fetch_method kept as-is pending a recipe; not demoted (403/tooling-gap, not source death). | 2026-08-04 run: RECIPE CONFIRMED, `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives` works and returns the full ED/BOD listing with drillable per-directive URLs. Caveat: the listing carries no per-item publish dates, so recency must come from the drilled directive page. Newest substantive item BOD 26-04 (2026-06-10), out of window. | 2026-08-16: unreachable this run for the same reason as cisa-advisories (direct 403 + reader pool exhausted). NOT demoted. No evidence a new directive published in-window. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: same cisa.gov condition, fourth consecutive run; rotation-priority source. NOT demoted. No evidence from any other source that a directive published in-window. | 2026-08-19: fifth consecutive unreachable run, same cisa.gov condition; rotation-priority source, NOT demoted. | 2026-09-07: S2 confirms the bridge/jina fetch of the directives listing still returns only the site's filter-facet JS shell (6th+ consecutive occurrence per prior notes) -- a recipe gap (no structured CISA directives feed/API identified yet), not an anti-bot block; not demoted, needs a recipe fix on a future run. | 2026-09-13 intel run (S1/S2): bridge/jina still return only the JS filter-facet shell; recipe gap persists, not demoted (403/anti-bot-shaped block, never demotes). | 2026-09-29: cisa.gov directives listing is unreadable in-container (Akamai 403 + jina 402) but the agent-side WebFetch tool reads the listing and the per-directive pages (listing: ED 25-03 V1/Supplemental, ED 26-03 V1, BOD 26-04 + Implementation Guidance, BOD 26-02; no dates on the listing, take the issue date from the detail page, e.g. BOD 26-04 = 2026-06-10). Cadence is roughly quarterly (ED 25-03 suppl. 2025-09-25, ED 26-03 2026-03-11, BOD 26-04 2026-06-10), so max_staleness_days 180. New directives are also announced in the cisa-news feed and KEV. (2026-09-29T2134Z-audit) | 2026-09-29: tier essential -> standard (roughly quarterly cadence, max_staleness_days 180; new directives also surface through cisa-news and KEV) and fetch_method bridge -> webfetch: Akamai refuses every in-container transport while agent-side WebFetch read the listing and item pages 7 of 7 times. source_health cannot run WebFetch, so it keeps reporting this record until the reader pool is refilled. (2026-09-29 operator-directed setup review) | Binding Operational Directives and Emergency Directives, high-priority defender signal. WebFetch HTTP 403 (re-confirmed 2026-05-08). REQUIRED: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives`. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → bridge: python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives to discover /news-events/directives/{slug} hrefs, then `cisa page <full URL>` per directive for the body.. AVOID: WebFetch 403s the CISA UA, skip it, go straight to the bridge `cisa page` subcommand.. | 2026-07-04: bridge (cisa page) upstream HTTP 403 again, consecutive_fetch_failures 2; 403 is transport blocking (does NOT demote per lifecycle rules). CISA KEV JSON API still works via the bridge. | 2026-07-05 root-cause confirmed: www.cisa.gov dynamic paths (/news-events/*, all .xml feeds, and the CSAF .well-known) are blocked by Akamai bot management (`Access Denied`, `Reference #18.*`) for EVERY UA/header combination tested (chrome/firefox/googlebot/curl/minimal/+Referer all 403), the block keys off the egress TLS/behavioural fingerprint, so it is unfixable from request headers. Only the STATIC /sites/default/files/feeds/ path (KEV JSON) is served. No reachable alternative for the advisory HTML content (search.gov results are a JS shell needing an API key; Wayback has no snapshots). SUBSTITUTE: `cisa-kev` JSON API for exploited-vuln ground truth + WebSearch corroboration for advisory narrative (covered_anyway). STAYS ACTIVE; a 403 is a transport block and NEVER demotes (hard rule). source_health.py now classifies this `bridge-blocked` (handled), not `needs-demote`, so the routine stops re-flagging it every run. | 2026-07-05 RECOVERED; CISA dynamic content is now reachable. The Akamai 403 on every UA still holds for a DIRECT fetch, but `tools/fetch_source.py` routes cisa.gov through the r.jina.ai reader proxy (server-side fetch, bypasses the Akamai fingerprint) for `cisa page` / `cisa feed`, and through the cisagov/CSAF GitHub mirror (raw.githubusercontent.com, not proxy-blocked) for `cisa csaf-recent` / `cisa csaf` (fully-structured ICS advisories). This SUPERSEDES the earlier KEV+WebSearch-substitute handling; the advisory/directive/news content itself is now fetchable with full detail. `cisa-kev` JSON remains the exploited-vuln ground truth. FETCH now works: `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives` (reader-proxy, full body) to read BOD/ED text; the filtered listing `.../directives/all?f[0]=directive_type:35` works via `cisa page` too. | 2026-07-05 admiralty audit: A (primary-authority), CISA directives; bridge 403 is a known transport block (no demotion), directive series confirmed current via KEV references. Status stays active. | 2026-07-09: no RSS feed exists for directives; the listing DOES hydrate through the reader, `cisa page https://www.cisa.gov/news-events/directives` then grep /news-events/directives/<slug> hrefs for discovery (confirmed 2026-07-09: returns current BOD/ED links); new directives are also announced in the cisa-news feed (news.xml). | 2026-07-25: S1 reported no `cisa-directives` bridge subcommand in fetch_source.py; content reachable via `cisa page <advisory-url>`. fetch_method kept as-is pending a recipe; not demoted (403/tooling-gap, not source death). | 2026-08-04 run: RECIPE CONFIRMED, `python3 tools/fetch_source.py cisa page https://www.cisa.gov/news-events/directives` works and returns the full ED/BOD listing with drillable per-directive URLs. Caveat: the listing carries no per-item publish dates, so recency must come from the drilled directive page. Newest substantive item BOD 26-04 (2026-06-10), out of window. | 2026-08-16: unreachable this run for the same reason as cisa-advisories (direct 403 + reader pool exhausted). NOT demoted. No evidence a new directive published in-window. | 2026-08-17: unreachable again, direct transport refused and the jina reader pool returned HTTP 402 on every rotating key, so the documented ladder had no last rung. Transport blocking plus an exhausted reader quota; NOT demoted. | 2026-08-18: same cisa.gov condition, fourth consecutive run; rotation-priority source. NOT demoted. No evidence from any other source that a directive published in-window. | 2026-08-19: fifth consecutive unreachable run, same cisa.gov condition; rotation-priority source, NOT demoted. | 2026-09-07: S2 confirms the bridge/jina fetch of the directives listing still returns only the site's filter-facet JS shell (6th+ consecutive occurrence per prior notes) -- a recipe gap (no structured CISA directives feed/API identified yet), not an anti-bot block; not demoted, needs a recipe fix on a future run. | 2026-09-13 intel run (S1/S2): bridge/jina still return only the JS filter-facet shell; recipe gap persists, not demoted (403/anti-bot-shaped block, never demotes). | 2026-09-29: the cisa.gov directives listing is unreadable in-container (Akamai 403 + jina 402). Observation only (CLAUDE.md forbids WebFetch on CISA): the agent-side WebFetch tool read the listing and the per-directive pages (listing: ED 25-03 V1/Supplemental, ED 26-03 V1, BOD 26-04 + Implementation Guidance, BOD 26-02; no dates on the listing, the issue date is on the detail page, e.g. BOD 26-04 = 2026-06-10). Cadence is roughly quarterly (ED 25-03 suppl. 2025-09-25, ED 26-03 2026-03-11, BOD 26-04 2026-06-10), so max_staleness_days 180. New directives are also announced in the cisa-news feed and KEV. (2026-09-29T2134Z-audit) | 2026-09-30 (v4.18, operator directive): WebFetch is now the sanctioned reader: WebFetch https://www.cisa.gov/directives with the outbound-links template for the directive list, then the directive page for its issue date and requirements. Directives also surface in the cisa-news listing and in KEV notes. source_health.py reports webfetch-only. (2026-09-30T0634Z-audit) | 2026-09-30: recipe confirmed (SR1): /directives and /news-events/directives return the same six links as relative URLs (prefix https://www.cisa.gov) and no dates; each directive's issue date is on its detail page (newest BOD 26-04, 2026-06-10). The older bridge-only lines are superseded. (2026-09-30T0634Z-audit) | 2026-09-30: with the plain outbound-links template the list can come back as names only, so ask the prompt for every item's title and href; that returned all six directive links. (2026-09-30T0634Z-audit) | 2026-09-30: with the reader pool refilled, the health probe reads this page through the reader's fallback and judges it relevant (12:31Z sweep); it reports webfetch-only only while the pool is empty. (2026-09-30T0634Z-audit)