CRAlert: Incident Response on a 24-Hour CRA Clock

Field notes

The workflow begins with one CycloneDX or SPDX SBOM per product release and compares its package URLs with EUVD and CISA exploitation sources; OSV is listed as informational and does not start a clock. Matches are labeled exact, probable, or weak before a notifier confirms awareness. The page describes an append-only incident trail with a hash chain, PDF or JSON export, and dossier fields arranged for copying into the Single Reporting Platform, which it says has no API.