devton/agentic-workflow-blueprint/triaging-vulnerabilities-with-ssvc-framework

agentic-workflows-blueprint.workflow.triaging-vulnerabilities-with-ssvc-framework

Goal

Prioritize vulnerability remediation using SSVC decision logic by combining exploitation intelligence, technical impact, and mission context into deterministic response classes.

Scope

• Applies to: vulnerability triage pipelines that need risk-based prioritization beyond CVSS-only scoring.
• Does not cover: direct patch deployment execution or vulnerability scanning itself.

Triggers

• "Prioritize vulnerabilities with SSVC"
• "Triage CVEs into Act/Attend/Track outcomes"
• "Combine KEV/EPSS with operational risk context"
• "Create SLA-based remediation priorities"

Inputs

• vulnerabilityDataset: source findings (scanner exports, SIEM feeds, asset mappings)
• threatIntelSources: KEV, EPSS, vendor advisories, exploit telemetry
• missionContext: business criticality and prevalence per asset/system
• technicalAttributes: CVSS vectors, exploitability hints, affected components
• triagePolicy: SLA mapping and escalation rules by SSVC outcome
• reportTarget (optional): output path/system for triage artifacts

Invariants

• SSVC outcomes must be reproducible from explicit decision inputs.
• Exploitation evidence quality must be documented for each decision.
• Critical mission systems receive stricter decision posture.
• Every triage outcome maps to an actionable remediation deadline.
• Exceptions or overrides require rationale and owner approval.

Procedure

1. Ingest and normalize findings

• Import vulnerability records and normalize identifiers (CVE, asset, component, environment).
• De-duplicate findings and retain traceability to source systems.

1. Collect exploitation intelligence

• Enrich findings with KEV presence, EPSS scores, and known PoC/active exploitation signals.
• Mark confidence level for each exploitation data point.

1. Evaluate SSVC decision points

• Classify exploitation status, technical impact, automatability, mission prevalence, and public-wellbeing impact.
• Record the evidence path for each classified field.

1. Apply SSVC decision tree

• Derive one of Act, Attend, Track*, Track per vulnerability.
• Resolve ties/ambiguities using predeclared triage policy rules.

1. Map outcomes to actions and SLAs

• Assign remediation owner, due date, and escalation path based on outcome class.
• Generate prioritized queues for operations and security teams.

1. Validate and calibrate

• Run test cases on known CVEs to verify decision consistency.
• Compare outcomes against historical incident lessons and adjust policy if needed.

1. Publish triage report

• Export machine-readable and human-readable triage outputs.
• Include unresolved data-quality gaps and recommended follow-ups.

Outputs

• SSVC triage report with per-vulnerability decision outcomes.
• Prioritized remediation backlog with SLA targets.
• Evidence ledger for decision-point inputs and confidence.
• Exception/override register with owner and rationale.

Review gate

• [ ] Every vulnerability has a deterministic SSVC outcome.
• [ ] Outcome-to-SLA mapping is explicit and actionable.
• [ ] Exploitation and impact inputs are traceable to evidence.
• [ ] Overrides/exceptions are documented and approved.
• [ ] Output supports both analyst review and automation ingestion.

References

• ../../SKILL.md
• ../review/SKILL.md
• ../changelog/SKILL.md