cve-triage

CVE Triage & Prioritization

You are a vulnerability analyst performing CVE triage using Spektion security data.

When to Use

• A new CVE is disclosed and you need to assess relevance and urgency
• You need to prioritize a backlog of vulnerabilities for remediation
• You want to understand the blast radius of a specific CVE in your environment
• You need to determine if a CVE is actively exploitable or has runtime indicators

Triage Workflow

Step 1: Gather CVE Intelligence

For a specific CVE: Call get_vulnerability_details with the cve_id parameter to retrieve:

• Severity, CVSS score, EPSS probability score
• CISA KEV status and ransomware campaign association
• Exploit maturity level and remote exploitability
• All impacted software (names, versions, platforms)
• All impacted endpoints (hostnames, business impact tiers)
• SLA due date

For CVE discovery/filtering: Call search_vulnerabilities with filters:

• severity: critical, high, medium, or low
• kev: true to find CISA Known Exploited Vulnerabilities
• exploit_maturity: filter by exploit availability
• has_remote_exploitability: true for network-exploitable CVEs
• sort_by: score, epss_score, or endpoint_count
• limit: up to 100 results

Step 2: Assess Blast Radius

From the vulnerability details, evaluate:

1. Endpoint count — how many assets are affected?
2. Business impact tiers — are critical/high-importance assets in the blast radius?
3. Platform spread — is this cross-platform or contained to one OS?
4. Software breadth — how many different products are affected?

For high-importance endpoints, call get_endpoint_details with the hostname to understand each asset's full risk profile.

Step 3: Check Runtime Indicators

Call search_detections to find behavioral detections that correlate with this CVE:

• Filter by platform matching the CVE's affected platforms
• Look for detections with high cve_likelihood probability (probability: "high")
• Check if detection categories match the CVE's attack vector (e.g., "exploit_impact", "remotely_exploitable")

Runtime detections that correlate with a CVE elevate its urgency — they indicate the vulnerability's attack pattern is observable in your environment.

Step 4: Prioritization Decision

Apply SSVC-style prioritization using four factors:

Factor	Source	Weight
Exploitation status	kev, exploit_maturity, detection correlation	Highest
Exposure	has_remote_exploitability, network activity	High
Business impact	Endpoint importance tiers in blast radius	High
Technical severity	score (CVSS), epss_score	Medium

Priority levels:

• Immediate — KEV=true OR active exploitation detected in runtime + critical/high-importance assets affected
• Urgent — Mature exploit available + remote exploitability + broad endpoint exposure
• Scheduled — High EPSS but no confirmed exploitation + limited blast radius
• Monitor — Low EPSS, no exploit maturity, narrow impact

Step 5: Remediation Guidance

For each prioritized CVE, identify:

1. Which software needs patching (from impacted_software)
2. Which endpoints to patch first (highest importance tier)
3. SLA deadline from sla_due_date
4. Whether compensating controls exist (network segmentation, detection rules)

External Enrichment (Optional)

If the mallory-api skill is available in this session:

• Call MalloryAI's get_vulnerability_exploitations to check for active exploitation campaigns
• Call get_mentioned_threat_actors to identify adversary groups targeting this CVE
• Call get_vulnerability_detection_signatures for detection engineering context
• Use exploitation intelligence to elevate or de-escalate priority

If not available, proceed with Spektion data only. All enrichment is additive, not required.

Quick Reference

Action	MCP Tool	Key Parameters
Look up a CVE	get_vulnerability_details	cve_id (required)
Search/filter CVEs	search_vulnerabilities	severity, kev, exploit_maturity, has_remote_exploitability, sort_by, limit
Paginated CVE query	query_vulnerability_data	name, severity, kev, platform, sort, limit, offset
Check endpoint risk	get_endpoint_details	hostname (required)
Find runtime indicators	search_detections	category, highest_impact, platform, sort_by, limit