triaging-vulnerabilities-with-ssvc-framework

Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.

Aller à l'installation

Dépôt: xalgord/xalgorix
Dernière activité de la source: 6 juin 2026 à 16:41
Langue détectée de SKILL.md: anglais
Étoiles: 813
Forks: 146

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Retour à la recherche Retour à l’installation

name	triaging-vulnerabilities-with-ssvc-framework
description	Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
domain	cybersecurity
subdomain	vulnerability-management
tags	["ssvc","vulnerability-triage","cisa","vulnerability-prioritization","decision-tree","cvss","remediation","risk-management"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]

Triaging Vulnerabilities with SSVC Framework

Overview

The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.

When to Use

When managing security operations that require triaging vulnerabilities with ssvc framework
When improving security program maturity and operational processes
When establishing standardized procedures for security team workflows
When integrating threat intelligence or vulnerability data into operations

Common Misconfigurations & Verification

Exploitation status from CVSS — verify Exploitation is driven by CISA KEV/EPSS evidence, not severity.
Automatability misjudged — verify AV:N/AC:L/UI:N maps to "yes" only with real worm/scriptability, not assumption.
Mission prevalence guessed — verify Essential/Support/Minimal comes from asset inventory, not a default.
Decision tree drift — verify outcomes against the reference cases in the validation tests (Act/Attend) after any logic change.
Outcome→SLA not enforced — verify Act=48h and Attend=14d actually drive ticketing deadlines.
Stale KEV feed — verify the catalog refreshes before triage so "Active" status is current.

Prerequisites

Python 3.9+ with requests, pandas, and jinja2 libraries
Access to CISA KEV catalog API and EPSS API from FIRST
NVD API key (optional, for higher rate limits)
Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys

SSVC Decision Points

1. Exploitation Status

Assess current exploitation activity:

None - No evidence of active exploitation
PoC - Proof-of-concept exists publicly
Active - Active exploitation observed in the wild (check CISA KEV)

# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s  | \
  python3 -c

Outcome	Action Required	SLA
Track	Monitor, remediate in normal patch cycle	90 days
Track*	Monitor closely, prioritize in next patch window	60 days
Attend	Escalate to senior management, accelerate remediation	14 days
Act	Apply mitigations immediately, executive-level awareness	48 hours

import requests
import json

# Fetch CISA KEV catalog
kev_url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev_data = requests.get(kev_url).json()
kev_cves = {v['cveID'] for v in kev_data['vulnerabilities']}

# Fetch EPSS scores for context
epss_url = "https://api.first.org/data/v1/epss"
epss_response = requests.get(epss_url, params={"cve": "CVE-2024-3400"}).json()

def evaluate_exploitation(cve_id, kev_set):
    """Determine exploitation status from CISA KEV and EPSS data."""
    if cve_id in kev_set:
        return "active"
    epss = requests.get(
        "https://api.first.org/data/v1/epss",
        params={"cve": cve_id}
    ).json()
    if epss.get("data"):
        score = float(epss["data"][0].get("epss", 0))
        if score > 0.5:
            return "poc"
    return "none"

def evaluate_technical_impact(cvss_vector):
    """Parse CVSS vector for scope and impact metrics."""
    if "S:C" in cvss_vector or "C:H/I:H/A:H" in cvss_vector:
        return "total"
    return "partial"

def evaluate_automatability(cvss_vector, cve_description):
    """Check if attack vector is network-based with low complexity."""
    if "AV:N" in cvss_vector and "AC:L" in cvss_vector and "UI:N" in cvss_vector:
        return "yes"
    return "no"

def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
    """CISA SSVC decision tree implementation."""
    if exploitation == "active":
        if tech_impact == "total" or automatability == "yes":
            return "Act"
        if mission_prevalence in ("essential", "support"):
            return "Act"
        return "Attend"
    if exploitation == "poc":
        if automatability == "yes" and tech_impact == "total":
            return "Attend"
        if mission_prevalence == "essential":
            return "Attend"
        return "Track*"
    # exploitation == "none"
    if tech_impact == "total" and mission_prevalence == "essential":
        return "Track*"
    return "Track"

# Run the SSVC triage script against scan results
python3 scripts/process.py --input scan_results.csv --output ssvc_triage_report.json

# View summary
cat ssvc_triage_report.json | python3 -m json.tool | head -50

# Export Nessus scan as CSV, then process
python3 scripts/process.py \
  --input nessus_export.csv \
  --format nessus \
  --output ssvc_results.json

# Export OpenVAS results as XML
python3 scripts/process.py \
  --input openvas_report.xml \
  --format openvas \
  --output ssvc_results.json

# Test SSVC decision logic with known CVEs
python3 -c "
from scripts.process import ssvc_decision
# CVE-2024-3400 - Palo Alto PAN-OS command injection (KEV listed)
assert ssvc_decision('active', 'total', 'yes', 'essential', 'material') == 'Act'
# CVE-2024-21887 - Ivanti Connect Secure (PoC available)
assert ssvc_decision('poc', 'total', 'yes', 'support', 'minimal') == 'Attend'
print('All SSVC decision tests passed')
"