| name | security-vulnerability |
| description | نظام إدارة واكتشاف ومعالجة الثغرات الأمنية. استخدم هذا الـ skill عند: فحص الثغرات، إدارة نقاط الضعف، اختبار الاختراق، تقييم المخاطر الأمنية، OWASP compliance، إدارة الأحداث الأمنية (SIEM)، استجابة الحوادث، تحديثات أمنية، مسح الشبكة، أو أي مهمة تتعلق بالأمن السيبراني. يتوافق مع إطار عمل الهيئة الوطنية للأمن السيبراني (NCA-ECC).
|
Security Vulnerability Management
إدارة الثغرات الأمنية
Architecture
┌──────────────────────────────────────────────────────────┐
│ Security Operations Center │
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌─────────┐ │
│ │ Vuln │ │ SAST │ │ DAST │ │ Depend │ │
│ │ Scanner │ │ Code │ │ Runtime │ │ Check │ │
│ │ (Infra) │ │ Analysis │ │ Scan │ │ (SCA) │ │
│ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬────┘ │
│ └──────────────┼──────────────┼─────────────┘ │
│ ▼ │
│ ┌──────────────┐ │
│ │ Aggregator │ │
│ │ & Dedup │ │
│ └──────┬───────┘ │
│ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ Risk Scoring │─────►│ Alert Engine │ │
│ │ & Prioritize │ │ & Workflow │ │
│ └──────────────┘ └──────────────┘ │
└──────────────────────────────────────────────────────────┘
Domain Model
public class Vulnerability : BaseAuditableEntity
{
public int Id { get; set; }
public string VulnId { get; set; } = string.Empty;
public string Title { get; set; } = string.Empty;
public string Description { get; set; } = string.Empty;
public VulnerabilityType Type { get; set; }
public VulnerabilityCategory Category { get; set; }
public string? CveId { get; set; }
public string? CweId { get; set; }
public string? OwaspCategory { get; set; }
public decimal CvssScore { get; set; }
public CvssSeverity Severity { get; set; }
public string? CvssVector { get; set; }
public ExploitabilityLevel Exploitability { get; set; }
public bool IsExploitedInWild { get; set; }
public bool HasPublicExploit { get; set; }
public BusinessImpact BusinessImpact { get; set; }
public int RiskScore { get; set; }
public int AssetId { get; set; }
public string AssetName { get; set; } = string.Empty;
public AssetType AssetType { get; set; }
public string? AffectedComponent { get; set; }
public string? AffectedVersion { get; set; }
public DiscoverySource Source { get; set; }
public DateTime DiscoveredAt { get; set; }
public int? DiscoveredByUserId { get; set; }
public string? ScanToolName { get; set; }
public VulnStatus Status { get; set; }
public string? RemediationPlan { get; set; }
public string? Workaround { get; set; }
public int? AssignedToId { get; set; }
public DateTime? RemediationDueDate { get; set; }
public DateTime? RemediatedAt { get; set; }
public DateTime? VerifiedAt { get; set; }
public int? VerifiedByUserId { get; set; }
public int SlaHours { get; set; }
public bool IsSlaBreached { get; set; }
public List<VulnerabilityNote> Notes { get; set; } = new();
public List<VulnerabilityAttachment> Attachments { get; set; } = new();
}
public enum CvssSeverity
{
None,
Low,
Medium,
High,
Critical
}
public enum VulnerabilityType
{
Infrastructure,
Application,
Configuration,
CodeLevel,
Dependency,
Network,
CloudMisconfig,
Authentication,
Encryption
}
public enum VulnerabilityCategory
{
BrokenAccessControl,
CryptographicFailures,
Injection,
InsecureDesign,
SecurityMisconfiguration,
VulnerableComponents,
AuthenticationFailures,
IntegrityFailures,
LoggingFailures,
SSRF,
Other
}
public enum DiscoverySource
{
AutomatedScan,
PenetrationTest,
BugBounty,
CodeReview,
IncidentResponse,
VendorAdvisory,
ThreatIntelligence,
InternalAudit,
UserReport
}
public class SecurityIncident : BaseAuditableEntity
{
public int Id { get; set; }
public string IncidentNumber { get; set; } = string.Empty;
public string Title { get; set; } = string.Empty;
public string Description { get; set; } = string.Empty;
public IncidentSeverity Severity { get; set; }
public IncidentType Type { get; set; }
public IncidentStatus Status { get; set; }
public string? AffectedSystems { get; set; }
public int? AffectedUsersCount { get; set; }
public bool DataBreached { get; set; }
public string? DataBreachDetails { get; set; }
public DateTime DetectedAt { get; set; }
public DateTime? ContainedAt { get; set; }
public DateTime? EradicatedAt { get; set; }
public DateTime? RecoveredAt { get; set; }
public DateTime? LessonsLearnedAt { get; set; }
public int? IncidentCommanderId { get; set; }
public List<int> ResponseTeamIds { get; set; } = new();
public List<IncidentTimeline> Timeline { get; set; } = new();
public List<int> RelatedVulnerabilityIds { get; set; } = new();
}
public enum IncidentType
{
Malware,
Phishing,
Ransomware,
DataBreach,
DDoS,
UnauthorizedAccess,
InsiderThreat,
AccountCompromise,
WebDefacement,
DataLoss
}
public class SecurityAsset
{
public int Id { get; set; }
public string Name { get; set; } = string.Empty;
public SecurityAssetType Type { get; set; }
public string? IpAddress { get; set; }
public string? Hostname { get; set; }
public string? OperatingSystem { get; set; }
public string? Version { get; set; }
public CriticalityLevel Criticality { get; set; }
public int DepartmentId { get; set; }
public DateTime? LastScanDate { get; set; }
public int OpenVulnerabilities { get; set; }
}
Vulnerability Scanner Integration
public interface IVulnerabilityScanner
{
Task<ScanResult> ScanAsync(ScanRequest request);
Task<List<Vulnerability>> ParseResultsAsync(ScanResult result);
}
public class SastScanner
{
public async Task<List<CodeVulnerability>> ScanCodeAsync(string repositoryPath)
{
var vulnerabilities = new List<CodeVulnerability>();
var patterns = new Dictionary<string, SecurityPattern>
{
["SQL_INJECTION"] = new()
{
Regex = @"(string\.Format|[""'].*\+.*[""']).*(@"".*SELECT|INSERT|UPDATE|DELETE)",
CweId = "CWE-89",
Severity = CvssSeverity.Critical,
Description = "SQL Injection المحتمل - استخدم parameterized queries"
},
["XSS"] = new()
{
Regex = @"@Html\.Raw\(|innerHTML\s*=|dangerouslySetInnerHTML",
CweId = "CWE-79",
Severity = CvssSeverity.High,
Description = "XSS المحتمل - استخدم HTML encoding"
},
["HARDCODED_SECRET"] = new()
{
Regex = @"(password|secret|apikey|api_key|token)\s*=\s*[""'][^""']+[""']",
CweId = "CWE-798",
Severity = CvssSeverity.High,
Description = "بيانات سرية مكتوبة في الكود - استخدم Key Vault"
},
["INSECURE_CRYPTO"] = new()
{
Regex = ,
CweId = ,
Severity = CvssSeverity.Medium,
Description =
},
[] = ()
{
Regex = ,
CweId = ,
Severity = CvssSeverity.High,
Description =
}
};
codeFiles = Directory.GetFiles(repositoryPath, , SearchOption.AllDirectories)
.Where(f => f.EndsWith() || f.EndsWith() || f.EndsWith());
( codeFiles)
{
content = File.ReadAllTextAsync();
lines = content.Split();
( (patternName, pattern) patterns)
{
matches = Regex.Matches(content, pattern.Regex, RegexOptions.IgnoreCase);
(Match match matches)
{
lineNumber = content[..match.Index].Count(c => c == ) + ;
vulnerabilities.Add( CodeVulnerability
{
FilePath = ,
LineNumber = lineNumber,
CodeSnippet = lines[lineNumber - ].Trim(),
PatternName = patternName,
CweId = pattern.CweId,
Severity = pattern.Severity,
Description = pattern.Description
});
}
}
}
vulnerabilities;
}
}
{
Task<List<DependencyVulnerability>> CheckAsync( projectPath)
{
csprojFiles = Directory.GetFiles(projectPath, , SearchOption.AllDirectories);
vulnerabilities = List<DependencyVulnerability>();
( csproj csprojFiles)
{
doc = XDocument.Load(csproj);
packages = doc.Descendants()
.Select(p => {
Name = p.Attribute()?.Value,
Version = p.Attribute()?.Value
});
( pkg packages)
{
cves = _nvdClient.SearchAsync(pkg.Name!, pkg.Version!);
vulnerabilities.AddRange(cves.Select(cve => DependencyVulnerability
{
PackageName = pkg.Name!,
CurrentVersion = pkg.Version!,
CveId = cve.Id,
CvssScore = cve.CvssScore,
FixedVersion = cve.FixedVersion,
Description = cve.Description
}));
}
}
vulnerabilities;
}
}
SLA by Severity
public static class VulnerabilitySla
{
public static readonly Dictionary<CvssSeverity, TimeSpan> RemediationSla = new()
{
{ CvssSeverity.Critical, TimeSpan.FromHours(24) },
{ CvssSeverity.High, TimeSpan.FromDays(7) },
{ CvssSeverity.Medium, TimeSpan.FromDays(30) },
{ CvssSeverity.Low, TimeSpan.FromDays(90) },
{ CvssSeverity.None, TimeSpan.FromDays(180) }
};
}
SQL Schema
CREATE SCHEMA [Security];
CREATE TABLE [Security].[Vulnerabilities] (
[Id] INT IDENTITY(1,1) PRIMARY KEY,
[VulnId] NVARCHAR(50) NOT NULL UNIQUE,
[Title] NVARCHAR(500) NOT NULL,
[Description] NVARCHAR(MAX) NOT NULL,
[Type] NVARCHAR(30) NOT NULL,
[Category] NVARCHAR(50) NOT NULL,
[CveId] NVARCHAR(20) NULL,
[CweId] NVARCHAR(20) NULL,
[CvssScore] DECIMAL(3,1) NOT NULL,
[Severity] NVARCHAR(10) NOT NULL,
[IsExploitedInWild] BIT NOT NULL DEFAULT 0,
[HasPublicExploit] BIT NOT NULL DEFAULT 0,
[AssetId] INT NOT NULL,
[Source] NVARCHAR(30) NOT NULL,
[DiscoveredAt] DATETIME2 NOT NULL,
[Status] NVARCHAR(20) NOT NULL DEFAULT 'New',
[AssignedToId] INT NULL,
[RemediationDueDate] DATETIME2 NULL,
[RemediatedAt] DATETIME2 NULL,
[IsSlaBreached] BIT NOT NULL DEFAULT 0,
[CreatedAt] DATETIME2 GETUTCDATE(),
INDEX IX_Severity_Status ([Severity], [Status]),
INDEX IX_Asset ([AssetId])
);
[Security].[Incidents] (
[Id] (,) ,
[IncidentNumber] NVARCHAR() ,
[Title] NVARCHAR() ,
[Severity] NVARCHAR() ,
[Type] NVARCHAR() ,
[Status] NVARCHAR() ,
[DataBreached] BIT ,
[DetectedAt] DATETIME2 ,
[ContainedAt] DATETIME2 ,
[RecoveredAt] DATETIME2 ,
[IncidentCommanderId] ,
[CreatedAt] DATETIME2 GETUTCDATE()
);
[Security].[Assets] (
[Id] (,) ,
[Name] NVARCHAR() ,
[Type] NVARCHAR() ,
[IpAddress] NVARCHAR() ,
[Hostname] NVARCHAR() ,
[Criticality] NVARCHAR() ,
[DepartmentId] ,
[LastScanDate] DATETIME2 ,
[OpenVulnerabilities]
);
[Security].[vw_VulnDashboard]
Severity,
Status,
() VulnCount,
( IsSlaBreached ) SlaBreachedCount,
(CvssScore) AvgCvssScore
[Security].[Vulnerabilities]
Severity, Status;
[Security].[vw_CriticalOpenVulns]
v., a.Name AssetName, a.Criticality AssetCriticality
[Security].[Vulnerabilities] v
[Security].[Assets] a a.Id v.AssetId
v.Status (,,)
(v.Severity (,) v.IsExploitedInWild )
v.CvssScore , v.DiscoveredAt;
NCA-ECC Controls Mapping
| ضابط NCA-ECC | الوصف | التنفيذ في المنصة |
|---|
| 2-3-1 | إدارة الثغرات | فحص دوري + معالجة حسب SLA |
| 2-3-2 | اختبار الاختراق | تقارير Pentest + متابعة |
| 2-5-1 | إدارة الحوادث | سير عمل Incident Response |
| 2-7-1 | أمن التطبيقات | SAST + DAST + SCA |
| 2-9-1 | أمن الشبكات | Network scanning |
| 2-11-1 | التشفير | فحص Cryptographic practices |
