One thing worth flagging on the "filter the feed on product" step: CISA's own JSON has no CPE or other stable identifier, just free-text vendorProject and product fields, and the split is inconsistent enough to trip up a plain substring search. In the raw feed, N-able N-central comes back as vendorProject "N-able", product "N-central" (not "N-able N-central"), Cisco Identity Services Engine is vendorProject "Cisco", product "Identity Services Engine", and Acronis Backup is vendorProject "Acronis", product "Backup" - a single generic word, on its own, that would just as easily match some other vendor's product also called "Backup" in a bigger asset list. Searching product alone either misses real hits (your inventory string like "Acronis Backup" doesn't appear anywhere in that field) or risks picking up unrelated ones (a one-word product name matching something you don't actually run). Matching on vendorProject plus product together seems safer than either field alone, otherwise the five-minute version of this exercise turns into an afternoon reconciling what actually matched.