cyber-triaging-vulnerabilities-with-ssvc-framework

name	cyber-triaging-vulnerabilities-with-ssvc-framework
description	Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: triaging-vulnerabilities-with-ssvc-framework | description: Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific | Vulnerability Categorization (SSVC) decision tree framework to produce actionable | remediation priorities. | domain: cybersecurity | subdomain: vulnerability-management | tags: | - ssvc | - vulnerability-triage | - cisa | - vulnerability-prioritization | - decision-tree | - cvss | - remediation | - risk-management | version: '1.0' | author: mahipal | li
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Triaging Vulnerabilities with SSVC Framework

Overview

The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.

When to Use

• When managing security operations that require triaging vulnerabilities with ssvc framework
• When improving security program maturity and operational processes
• When establishing standardized procedures for security team workflows
• When integrating threat intelligence or vulnerability data into operations

Prerequisites

• Python 3.9+ with requests, pandas, and jinja2 libraries
• Access to CISA KEV catalog API and EPSS API from FIRST
• NVD API key (optional, for higher rate limits)
• Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys

SSVC Decision Points

1. Exploitation Status

Assess current exploitation activity:

• None - No evidence of active exploitation
• PoC - Proof-of-concept exists publicly
• Active - Active exploitation observed in the wild (check CISA KEV)

# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"

2. Technical Impact

Determine scope of compromise if exploited:

• Partial - Limited to a subset of system functionality or data
• Total - Full control of the affected system, complete data access