Overview

Cyber KEV Triage builds a patch-priority plan by merging vulnerability severity, exploitation status, and the business criticality of affected assets. This supports CVE triage, patch ordering decisions, and remediation reporting.

How This Skill Works

The workflow collects vulnerabilities with CVE identifiers, CVSS scores, exploitation indicators, and affected assets. Each vulnerability is mapped to asset criticality, then scored and ranked into patch-priority tiers. The result is a concise remediation summary with due-window guidance, deterministically produced via scripts/kev_triage.py and informed by references/triage-method.md.

When to Use It

• During initial CVE triage when receiving vulnerability feeds and asset inventory
• Prioritizing patch order across a mixed environment (production, staging, and non-production assets)
• Preparing remediation reporting for security leadership or auditors
• Reassessing priorities when exploitation indicators change or new exploits emerge
• Generating a deterministic triage output for change management and remediation planning

Quick Start

1. Step 1: Run the deterministic triage tool: python3 scripts/kev_triage.py
2. Step 2: Ensure CVE, CVSS, exploitation indicators, and affected assets are collected and mapped to asset criticality
3. Step 3: Review the remediation summary and due-window guidance for action

Best Practices

• Collect CVE, CVSS, exploitation indicators, and affected asset data consistently to ensure accurate scoring
• Map vulnerabilities to asset criticality using authoritative asset inventories
• Utilize the deterministic kev_triage.py tool for repeatable triage outputs
• Review scoring rationale with references/triage-method.md to align with policy
• Keep remediation outputs defensive and actionable; avoid including exploit payloads

Example Use Cases

• A critical database server receives several CVEs; high priority is assigned based on asset criticality and exploitation status, shaping patch sequencing
• Production systems get tighter due-window guidance while non-production assets receive longer windows
• Vulnerabilities without exploitation indicators are deprioritized in favor of actively exploited issues
• Remediation reporting summarizes fixes, owners, and due dates for leadership review
• kev_triage.py outputs a deterministic triage result suitable for audit and change planning

Frequently Asked Questions