vulnerability-scan-triage

name	vulnerability-scan-triage
description	Triage raw vulnerability-scanner output (Nessus/Qualys/Trivy/Grype/OpenVAS, cloud or container scans): normalize, deduplicate, validate, and cut false positives so the list is trustworthy before prioritization. Use when handed a scan export or a pile of findings that needs to become an actionable backlog.

Goal

A clean, deduplicated, validated finding set — false positives removed and each remaining item tied to a real affected asset — ready to feed vulnerability-prioritization.

Steps

1. Normalize — parse the export(s) into a common shape: CVE/identifier, title, affected asset(s), installed vs. fixed version, scanner severity, plugin/check ID, first-seen date. Merge multiple scanners into one inventory.
2. Deduplicate — collapse the same vuln on the same asset reported by multiple scanners or scans; group "same CVE across N assets" so you triage the vuln once, not N times.
3. Validate — separate confirmed from suspected. Check for known false-positive patterns: backported fixes (distro patched without bumping the version string), not-installed/not-loaded code paths, mitigations already in place, or a check that only inspects a banner. Mark each as confirmed / needs-verification / FP.
4. Enrich for context — attach asset criticality, environment (prod/non-prod), internet exposure, and data sensitivity from the CMDB/asset inventory. This is what later drives priority.
5. Hand off — produce the cleaned set and route to vulnerability-prioritization.

Output

A normalized finding table — identifier · affected assets · installed/fixed version · status (confirmed/FP/needs-verification) · scanner(s) · asset context — plus a short note on what was deduped and which FP patterns were applied. Use security-reporting for any formal writeup.

Notes

Garbage in, garbage out: prioritization is only as good as the triage. Backported patches are the most common false positive on Linux distros — verify against the distro's security tracker, not just the version number. Track first-seen dates so SLA clocks start correctly.