triage-findings

# triage-findings ## When to Use - Processing vulnerability scan results that need prioritization - Multiple findings need deduplication and correlation - Determining which vulnerabilities to report first - Correlating findings across different tools or endpoints - Creating actionable remediation priority lists - Filtering false positives from valid findings - Assessing business impact of discovered vulnerabilities ## Quick Start Basic triage workflow: ```markdown ## Findings Triage Summary ### Critical Priority (Immediate Action Required) | CVE | CVSS | EPSS | KEV | Finding | Affected | | -------------- | ---- | ----- | --- | --------- | -------- | | CVE-2024-XXXXX | 9.8 | 87.5% | Yes | RCE in... | server01 | ### High Priority | CVE | CVSS | EPSS | KEV | Finding | Affected | | -------------- | ---- | ----- | --- | ---------- | --------------- | | CVE-2024-YYYYY | 8.1 | 23.4% | No | SQLi in... | app.example.com | ### Deduplicated (Same Root Cause) - CVE-2024-ZZZZZ: Found on 5 endpoints (single patch needed) ### False Positives Identified - Finding X: Version mismatch (patched version detected) ``` ## Step-by-Step Process ### Step 1: Collect All Findings **Aggregate from multiple sources:** ```markdown Sources to consolidate: - Automated scanner results (Nuclei, Burp, etc.) - Manual testing findings - Exploit agent confirmed vulnerabilities - Recon-discovered exposures Capture for each finding: 1. Vulnerability type/name 2. CVE ID (if applicable) 3. Affected endpoint/asset 4. Evidence/proof 5. Tool that found it 6. Timestamp discovered ``` **Initial Data Structure:** ```json { "findings": [ { "id": "FIND-001", "cve": "CVE-2024-12345", "type": "SQL Injection", "endpoint": "https://example.com/api/search", "parameter": "q", "evidence": "Response time delay confirmed", "tool": "manual", "timestamp": "2024-01-15T10:30:00Z" } ] } ``` ### Step 2: Deduplicate Findings **Deduplication Strategies:** | Strategy | When to Use | Example | | ---------- | ------------------------------ | ---------------------------- | | CVE-based | Same CVE across hosts | Log4j on 10 servers | | Root cause | Different symptoms, same issue | Multiple XSS from one sink | | Endpoint | Same vuln, different params | SQLi in ?id= and ?user= | | Component | Shared vulnerable library | jQuery 2.x across subdomains | **Deduplication Process:** ```markdown 1. Group by CVE ID (exact match) 2. Group by vulnerability type + root cause 3. Group by affected component/library 4. Identify parent/child relationships 5. Mark as: - UNIQUE: Distinct vulnerability - DUPLICATE: Same as another finding - RELATED: Connected but separate ``` **Example Deduplication:** ```markdown ## Before Deduplication (15 findings) - CVE-2024-1234 on server01 - CVE-2024-1234 on server02 - CVE-2024-1234 on server03 - SQLi in /api/users?id= - SQLi in /api/orders?id= - SQLi in /api/products?id= - XSS in search field - XSS in comment field ... ## After Deduplication (5 unique findings) 1. CVE-2024-1234 (3 affected hosts) 2. SQLi in ID parameters (3 endpoints, same sink) 3. XSS - Stored (2 injection points, different handlers) ... ``` ### Step 3: Enrich with CVSS Scores **CVSS 3.1 Severity Levels:** | Score | Severity | Priority | | -------- | -------- | ------------- | | 9.0-10.0 | Critical | Immediate | | 7.0-8.9 | High | 24-48 hours | | 4.0-6.9 | Medium | 1-2 weeks | | 0.1-3.9 | Low | Scheduled | | 0.0 | None | Informational | **Calculating Custom CVSS:** ```markdown For findings without CVE, calculate CVSS manually: Base Metrics: - Attack Vector: N(etwork)/A(djacent)/L(ocal)/P(hysical) - Attack Complexity: L(ow)/H(igh) - Privileges Required: N(one)/L(ow)/H(igh) - User Interaction: N(one)/R(equired) - Scope: U(nchanged)/C(hanged) - Confidentiality: N(one)/L(ow)/H(igh) - Integrity: N(one)/L(ow)/H(igh) - Availability: N(one)/L(ow)/H(igh) Common Patterns: - Unauthenticated RCE: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 - Auth SQLi: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 - Reflected XSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 - Info Disclosure: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 ``` ### Step 4: Add EPSS Exploit Probability **EPSS Overview:** ```markdown Exploit Prediction Scoring System (EPSS) v4 - Probability score: 0% to 100% - Predicts likelihood of exploitation in next 30 days - Data-driven ML model updated daily - Higher = more likely to be exploited EPSS Thresholds: - > 50%: Very high likelihood, prioritize immediately - 10-50%: Significant likelihood, high priority - 1-10%: Moderate likelihood, standard priority - < 1%: Low likelihood, can be scheduled ``` **Fetching EPSS Scores:** ```bash # Single CVE lookup curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-12345" # Multiple CVEs curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-12345,CVE-2024-67890" # Response format { "data": [ { "cve": "CVE-2024-12345", "epss": "0.87523", "percentile": "0.99421" } ] } ``` **EPSS Integration:** ```markdown | CVE | CVSS Base | EPSS Score | EPSS Percentile | Priority | | ------------- | --------- | ---------- | --------------- | ----------- | | CVE-2024-1234 | 9.8 | 87.5% | 99th | CRITICAL | | CVE-2024-5678 | 7.5 | 2.1% | 65th | MEDIUM | | CVE-2024-9012 | 9.1 | 0.3% | 32nd | HIGH (CVSS) | ``` ### Step 5: Check CISA KEV Catalog **Known Exploited Vulnerabilities:** ```markdown CISA KEV Catalog Importance: - Vulnerabilities actively exploited in the wild - Federal agencies must remediate by deadline - Highest priority for any organization - If in KEV = Critical priority regardless of CVSS KEV Check Process: 1. Download current KEV catalog (JSON) 2. Match CVE IDs against findings 3. Note remediation deadline 4. Flag as CRITICAL priority ``` **KEV Catalog Check:** ```bash # Download KEV catalog curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" \ -o kev.json # Check if CVE is in KEV jq '.vulnerabilities[] | select(.cveID=="CVE-2024-12345")' kev.json ``` **KEV Match Format:** ```markdown ## CISA KEV Match Found **CVE-2024-12345** is in CISA Known Exploited Vulnerabilities catalog - Vendor: Example Corp - Product: Example Server - Vulnerability: Remote Code Execution - Date Added: 2024-01-10 - Due Date: 2024-01-31 - Notes: Active exploitation observed **ACTION REQUIRED**: Remediate immediately (federal deadline applies) ``` ### Step 6: Apply Prioritization Matrix **Combined Scoring Matrix:** ```markdown Priority Calculation: CRITICAL (Score 100): - In CISA KEV catalog, OR - CVSS >= 9.0 AND EPSS > 50% HIGH (Score 75-99): - CVSS >= 9.0 with any EPSS, OR - CVSS 7.0-8.9 AND EPSS > 10%, OR - Confirmed exploitation in the wild MEDIUM (Score 50-74): - CVSS 7.0-8.9 with EPSS < 10%, OR - CVSS 4.0-6.9 with any exploitation evidence, OR - High business impact asset LOW (Score 25-49): - CVSS 4.0-6.9 with no exploitation evidence, OR - CVSS < 4.0 on important assets INFORMATIONAL (Score 0-24): - CVSS < 4.0 on non-critical assets, OR - Best practice violations ``` **Priority Score Formula:** ```markdown Base Score = CVSS_Score \* 10 Multipliers: - KEV listed: +50 (automatic CRITICAL) - EPSS > 50%: +30 - EPSS 10-50%: +20 - EPSS 1-10%: +10 - High-value asset: +15 - Internet-facing: +10 - Contains sensitive data: +10 Final Priority = min(Base Score + Multipliers, 100) ``` ### Step 7: Generate Triage Report **Triage Output Template:** ```markdown # Vulnerability Triage Report **Date:** YYYY-MM-DD **Scope:** [Target description] **Total Findings:** X **Unique Vulnerabilities:** Y **Duplicates Removed:** Z --- ## Executive Summary | Priority | Count | % of Total | | -------- | ----- | ---------- | | Critical | X | X% | | High | X | X% | | Medium | X | X% | | Low | X | X% | | Info | X | X% | --- ## Critical Findings (Immediate Action) ### CRIT-001: [Vulnerability Name] | Attribute | Value | | --------- | --------------------- | | CVE | CVE-YYYY-NNNNN | | CVSS | 9.8 (Critical) | | EPSS | 87.5% | | KEV | Yes (Due: YYYY-MM-DD) | | Affected | [endpoints] | **Evidence:** [Proof of vulnerability] **Recommendation:** [Specific fix] --- ## High Priority Findings [Similar format for High priority items] --- ## Deduplicated Findings Summary | Finding | Occurrences | Root Cause | | -------------- | ----------- | --------------- | | CVE-2024-XXXXX | 5 servers | Single patch | | XSS variants | 3 endpoints | Output encoding | --- ## False Positives Excluded | Finding | Reason for Exclusion | | --------- | -------------------- | | [Finding] | [Justification] | --- ## Remediation Priority Order 1. [CRIT-001] - CVE-2024-XXXXX - Patch immediately