triaging-vulnerabilities-with-ssvc-framework

# Triaging Vulnerabilities with SSVC Framework ## Overview The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: **Track**, **Track***, **Attend**, or **Act**. ## When to Use - When managing security operations that require triaging vulnerabilities with ssvc framework - When improving security program maturity and operational processes - When establishing standardized procedures for security team workflows - When integrating threat intelligence or vulnerability data into operations ## Prerequisites - Python 3.9+ with `requests`, `pandas`, and `jinja2` libraries - Access to CISA KEV catalog API and EPSS API from FIRST - NVD API key (optional, for higher rate limits) - Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys ## SSVC Decision Points ### 1. Exploitation Status Assess current exploitation activity: - **None** - No evidence of active exploitation - **PoC** - Proof-of-concept exists publicly - **Active** - Active exploitation observed in the wild (check CISA KEV) ```bash # Check if a CVE is in CISA Known Exploited Vulnerabilities catalog curl -s "https://www....