Vulnerability Scan Triage

---
name: vulnerability-scan-triage
description: >-
  Triage raw vulnerability-scanner output (Nessus/Qualys/Trivy/Grype/OpenVAS,
  cloud or container scans): normalize, deduplicate, validate, and cut false
  positives so the list is trustworthy before prioritization. Use when handed a
  scan export or a pile of findings that needs to become an actionable backlog.
---

# Goal

A clean, deduplicated, validated finding set — false positives removed and each
remaining item tied to a real affected asset — ready to feed
`vulnerability-prioritization`.

# Steps

1. **Normalize** — parse the export(s) into a common shape: CVE/identifier, title,
   affected asset(s), installed vs. fixed version, scanner severity, plugin/check
   ID, first-seen date. Merge multiple scanners into one inventory.
2. **Deduplicate** — collapse the same vuln on the same asset reported by multiple
   scanners or scans; group "same CVE across N assets" so you triage the vuln once,
   not N times.
3. **Validate** — separate confirmed from suspected. Check for known false-positive
   patterns: backported fixes (distro patched without bumping the version string),
   not-installed/not-loaded code paths, mitigations already in place, or a check
   that only inspects a banner. Mark each as confirmed / needs-verification / FP.
4. **Enrich for context** — attach asset criticality, environment (prod/non-prod),
   internet exposure, and data sensitivity from the CMDB/asset inventory. This is
   what later drives priority.
5. **Hand off** — produce the cleaned set and route to `vulnerability-prioritization`.

# Output

A normalized finding table — identifier · affected assets · installed/fixed version
· status (confirmed/FP/needs-verification) · scanner(s) · asset context — plus a
short note on what was deduped and which FP patterns were applied. Use
`security-reporting` for any formal writeup.

# Notes

Garbage in, garbage out: prioritization is only as good as the triage. Backported
patches are the most common false positive on Linux distros — verify against the
distro's security tracker, not just the version number. Track first-seen dates so
SLA clocks start correctly.