performing-web-application-vulnerability-triage

name	performing-web-application-vulnerability-triage
description	Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to separate true positives from false positives and prioritize remediation. Use when working with performing web application vulnerability triage.
domain	cybersecurity
subdomain	vulnerability-management
tags	["web-application","vulnerability-triage","owasp","dast","sast","burp-suite","zap","false-positive","risk-rating"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]

Performing Web Application Vulnerability Triage

Overview

Web application vulnerability triage is the process of reviewing findings from DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools to validate true positives, dismiss false positives, assign risk ratings using the OWASP Risk Rating Methodology, and prioritize remediation. Effective triage reduces alert fatigue and focuses development teams on the vulnerabilities that matter most.

When to Use

Trigger phrases:

• "performing web application vulnerability triage"

• "Triage web application vulnerability findings from DAST/SAST scanners using OWAS"

• When conducting security assessments that involve performing web application vulnerability triage

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• DAST scan results (OWASP ZAP, Burp Suite, Acunetix)
• SAST scan results (Semgrep, SonarQube, Checkmarx, Snyk Code)
• Python 3.9+ with requests, beautifulsoup4
• Burp Suite Professional or OWASP ZAP for manual validation
• DefectDojo or similar for finding management

OWASP Risk Rating Methodology

This section covers owasp risk rating methodology for performing web application vulnerability triage.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Risk Calculation

Risk = Likelihood x Impact

Likelihood Factors (0-9 scale)

Factor Group	Factor	Description
Threat Agent	Skill Level	How technically skilled is the attacker?
Threat Agent	Motive	How motivated is the attacker?
Threat Agent	Opportunity	What resources/access are needed?
Threat Agent	Size	How large is the potential threat agent group?