> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FIRST EPSS

> Reference for the Tracecat FIRST EPSS integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get time series

Action ID: `tools.first_epss.get_time_series`

Get an EPSS time series. Calls GET /data/v1/epss directly with scope=time-series for one CVE.

Reference: [https://api.first.org/epss/](https://api.first.org/epss/)

### Input fields

<ParamField path="cve" type="string" required>
  Filters by EPSS CVE ID. Multiple values are supported separated by commas. The maximum size accepted for this parameter is 2000 characters (including commas).
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the FIRST API.

  Default: `null`.
</ParamField>

<ParamField path="date" type="string | null">
  Date in the format YYYY-MM-DD (since April 14, 2021), shows the historic values for epss and percentile attributes.

  Default: `null`.
</ParamField>

## Lookup CVE scores

Action ID: `tools.first_epss.lookup_cve_scores`

Look up CVE scores. Calls GET /data/v1/epss directly for one or more CVE identifiers.

Reference: [https://api.first.org/epss/](https://api.first.org/epss/)

### Input fields

<ParamField path="cve" type="string" required>
  Filters by EPSS CVE ID. Multiple values are supported separated by commas. The maximum size accepted for this parameter is 2000 characters (including commas).
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the FIRST API.

  Default: `null`.
</ParamField>

<ParamField path="date" type="string | null">
  Date in the format YYYY-MM-DD (since April 14, 2021), shows the historic values for epss and percentile attributes.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Limits the maximun number of records to be shown. Should be an integer number between 0 and 10,000.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Offsets the list of records by this number. The first item is 0.

  Default: `null`.
</ParamField>

## Search scores

Action ID: `tools.first_epss.search_scores`

Search EPSS scores. Calls GET /data/v1/epss directly with FIRST API-native filters.

Reference: [https://api.first.org/epss/](https://api.first.org/epss/)

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the FIRST API.

  Default: `null`.
</ParamField>

<ParamField path="date" type="string | null">
  Date in the format YYYY-MM-DD (since April 14, 2021), shows the historic values for epss and percentile attributes.

  Default: `null`.
</ParamField>

<ParamField path="days" type="integer | null">
  Number of days since the EPSS score was added to the database (starting at 1, not affected by the date parameter).

  Default: `null`.
</ParamField>

<ParamField path="epss_gt" type="number | null">
  Only display CVEs with EPSS score greater or equal than the parameter.

  Default: `null`.
</ParamField>

<ParamField path="epss_lt" type="number | null">
  Only display CVEs with EPSS score lower or equal than the parameter.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Limits the maximun number of records to be shown. Should be an integer number between 0 and 10,000.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Offsets the list of records by this number. The first item is 0.

  Default: `null`.
</ParamField>

<ParamField path="percentile_gt" type="number | null">
  Only display CVEs with percentile greater or equal than the parameter.

  Default: `null`.
</ParamField>

<ParamField path="percentile_lt" type="number | null">
  Only display CVEs with percentile lower or equal than the parameter.

  Default: `null`.
</ParamField>

<ParamField path="q" type="string | null">
  Free text search at the CVE ID (allows partial matches).

  Default: `null`.
</ParamField>