/vulnerability-scan-triage

name: vulnerability-scan-triage
description: >-
  Triage raw vulnerability-scanner output (Nessus/Qualys/Trivy/Grype/OpenVAS,
  cloud or container scans): normalize, deduplicate, validate, and cut false
  positives so the list is trustworthy before prioritization. Use when handed a
  scan export or a pile of findings that needs to become an actionable backlog.

Goal

A clean, deduplicated, validated finding set — false positives removed and each remaining item tied to a real affected asset — ready to feed `vulnerability-prioritization`.

Steps

1. **Normalize** — parse the export(s) into a common shape: CVE/identifier, title, affected asset(s), installed vs. fixed version, scanner severity, plugin/check ID, first-seen date. Merge multiple scanners into one inventory. 2. **Deduplicate** — collapse the same vuln on the same asset reported by multiple scanners or scans; group "same CVE across N assets" so you triage the vuln once, not N times. 3. **Validate** — separate confirmed from suspected. Check for known false-positive patterns: backported fixes (distro patched without bumping the version string), not-installed/not-loaded code paths, mitigations already in place, or a check that only inspects a banner. Mark each as confirmed / needs-verification / FP. 4. **Enrich for context** — attach asset criticality, environment (prod/non-prod), internet exposure, and data sensitivity from the CMDB/asset inventory. This is what later drives priority. 5. **Hand off** — produce the cleaned set and route to `vulnerability-prioritization`.

Output

A normalized finding table — identifier · affected assets · installed/fixed version · status (confirmed/FP/needs-verification) · scanner(s) · asset context — plus a short note on what was deduped and which FP patterns were applied. Use `security-reporting` for any formal writeup.

Notes

Garbage in, garbage out: prioritization is only as good as the triage. Backported patches are the most common false positive on Linux distros — verify against the distro's security tracker, not just the version number. Track first-seen dates so SLA clocks start correctly.