/security-triage

security-triage

Security scan finding triage — investigates findings from the daily vulnerability scanners.

Usage

./skills/security-triage/security-triage.sh <target_ip> "<finding_title>" <severity> [scanner] [category] [port]

Parameters

| Param | Required | Description | |-------|----------|-------------| | target_ip | Yes | Public IP that was scanned | | finding_title | Yes | Short finding identifier (CVE-ID, "New open port", etc.) | | severity | Yes | critical, high, medium | | scanner | No | nlsec01 or grsec01 (auto-detected from target IP) | | category | No | cve, port, tls, header, exposure (default: unknown) | | port | No | Affected port number |

What It Does

1. **NetBox lookup** — identifies which host/service maps to the target IP 2. **Baseline check** — verifies if finding is new vs already-known 3. **Scan context** — retrieves latest nmap/nuclei data from the scanner VM 4. **Quick service check** — for new port findings, identifies the service via nmap

Scanner Mapping

• `nlsec01` (NL, 10.0.181.X) → scans GR + VPS targets
• `grsec01` (GR, 10.0.X.X) → scans NL + VPS targets

Escalation

Deep verification (full nuclei re-scan, targeted nmap, testssl) is left to Claude Code (Tier 2). Claude Code can SSH directly to the scanner VMs for extended investigation.