메뉴
Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/nexuslinkproductions/yuri-os --skill cyber-triaging-vulnerabilities-with-ssvc-framework명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
SOC 직업 분류 기준
| name | cyber-triaging-vulnerabilities-with-ssvc-framework |
| description | Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities. |
| source | mukul975/Anthropic-Cybersecurity-Skills |
| license | Apache-2.0 |
| authorized_lab | false |
| origin_frontmatter | name: triaging-vulnerabilities-with-ssvc-framework | description: Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific | Vulnerability Categorization (SSVC) decision tree framework to produce actionable | remediation priorities. | domain: cybersecurity | subdomain: vulnerability-management | tags: | - ssvc | - vulnerability-triage | - cisa | - vulnerability-prioritization | - decision-tree | - cvss | - remediation | - risk-management | version: '1.0' | author: mahipal | li |
| hide | true |
Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.
The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.
requests, pandas, and jinja2 librariesAssess current exploitation activity:
# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"
Determine scope of compromise if exploited:
Evaluate if exploitation can be automated at scale:
How widespread is the affected product in your environment:
Potential consequences for physical safety and public welfare:
| Outcome | Action Required | SLA |
|---|---|---|
| Track | Monitor, remediate in normal patch cycle | 90 days |
| Track* | Monitor closely, prioritize in next patch window | 60 days |
| Attend | Escalate to senior management, accelerate remediation | 14 days |
| Act | Apply mitigations immediately, executive-level awareness | 48 hours |
import requests
import json
# Fetch CISA KEV catalog
kev_url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev_data = requests.get(kev_url).json()
kev_cves = {v['cveID'] for v in kev_data['vulnerabilities']}
# Fetch EPSS scores for context
epss_url = "https://api.first.org/data/v1/epss"
epss_response = requests.get(epss_url, params={"cve": "CVE-2024-3400"}).json()
def evaluate_exploitation(cve_id, kev_set):
"""Determine exploitation status from CISA KEV and EPSS data."""
if cve_id in kev_set:
return "active"
epss = requests.get(
"https://api.first.org/data/v1/epss",
params={"cve": cve_id}
).json()
if epss.get("data"):
score = float(epss["data"][0].get("epss", 0))
if score > 0.5:
return "poc"
return "none"
def evaluate_technical_impact(cvss_vector):
"""Parse CVSS vector for scope and impact metrics."""
if "S:C" in cvss_vector or "C:H/I:H/A:H" in cvss_vector:
return "total"
return "partial"
def evaluate_automatability(cvss_vector, cve_description):
"""Check if attack vector is network-based with low complexity."""
if "AV:N" in cvss_vector and "AC:L" in cvss_vector and "UI:N" in cvss_vector:
return "yes"
return "no"
def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
"""CISA SSVC decision tree implementation."""
if exploitation == "active":
if tech_impact == "total" or automatability == "yes":
return "Act"
if mission_prevalence in ("essential", "support"):
return "Act"
return "Attend"
if exploitation == "poc":
if automatability == "yes" and tech_impact == "total":
return "Attend"
if mission_prevalence == "essential":
return "Attend"
return "Track*"
# exploitation == "none"
if tech_impact == "total" and mission_prevalence == "essential":
return "Track*"
return "Track"
# Run the SSVC triage script against scan results
python3 scripts/process.py --input scan_results.csv --output ssvc_triage_report.json
# View summary
cat ssvc_triage_report.json | python3 -m json.tool | head -50
# Export Nessus scan as CSV, then process
python3 scripts/process.py \
--input nessus_export.csv \
--format nessus \
--output ssvc_results.json
# Export OpenVAS results as XML
python3 scripts/process.py \
--input openvas_report.xml \
--format openvas \
--output ssvc_results.json
# Test SSVC decision logic with known CVEs
python3 -c "
from scripts.process import ssvc_decision
# CVE-2024-3400 - Palo Alto PAN-OS command injection (KEV listed)
assert ssvc_decision('active', 'total', 'yes', 'essential', 'material') == 'Act'
# CVE-2024-21887 - Ivanti Connect Secure (PoC available)
assert ssvc_decision('poc', 'total', 'yes', 'support', 'minimal') == 'Attend'
print('All SSVC decision tests passed')
"