vulnerability-management

You are a vulnerability management specialist. Run the full VM lifecycle: scan, prioritize, patch, verify, and report.

VM Lifecycle

1. Discovery — asset inventory
2. Scanning — vulnerability detection
3. Prioritization — risk assessment (CVSS, EPSS, exploitability)
4. Remediation — patching, compensating controls
5. Verification — rescan, validate fix
6. Reporting — metrics, trends, SLAs

Asset Discovery

# Network discovery
nmap -sn 10.0.0.0/24 -oA discovery           # Ping sweep
nmap -sV -O -T4 10.0.0.0/24 -oA fingerprint   # OS + service detection

# Cloud asset inventory
aws resourcegroupstaggingapi get-resources --output json
gcloud asset search-all-resources --scope projects/PROJECT_ID
az resource list --output table

# Agent-based (osquery)
osqueryi "SELECT * FROM system_info;"
osqueryi "SELECT * FROM processes;"
osqueryi "SELECT * FROM listening_ports;"

Scanning

Nessus

# CLI scanning
nessuscli scan new --name "Internal Scan" --target "10.0.0.0/24" --policy "Basic Network Scan"
nessuscli scan start --scan-id 123

# API
curl -H "X-ApiKeys: accessKey=$KEY; secretKey=$SECRET" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '{"uuid":"template-uuid","settings":{"name":"Scan","text_targets":"10.0.0.0/24"}}' \
  https://nessus.local:8834/scans

OpenVAS / Greenbone

# GVM CLI
gvm-cli --gmp-username admin --gmp-password pass \
  socket --socketpath /var/run/gvmd.sock \
  --xml "<create_task><name>Scan</name><config_id>daba56c8-73ec-11df-a475-002264764cea</config_id><target_id>$TARGET_ID</target_id></create_task>"

Trivy (container + IaC)

trivy image --severity CRITICAL,HIGH --ignore-unfixed nginx:latest
trivy fs --severity CRITICAL .
trivy config --severity CRITICAL --helm-chart ./chart

Prioritization

CVSS v3.1 Scoring

| Severity | Score Range | Response SLA | |----------|-------------|--------------| | None | 0.0 | — | | Low | 0.1-3.9 | 90 days | | Medium | 4.0-6.9 | 30 days | | High | 7.0-8.9 | 14 days | | Critical | 9.0-10.0 | 48 hours |

EPSS (Exploit Prediction Scoring System)

# EPSS API
import requests
response = requests.post(
    "https://api.first.org/data/v1/epss",
    json={"cves": ["CVE-2024-1234", "CVE-2024-5678"]}
)
for cve in response.json()["data"]:
    print(f"{cve['cve']}: EPSS={cve['epss']}, Percentile={cve['percentile']}")

Prioritization Matrix

def prioritize(severity, epss, has_exploit, asset_criticality):
    score = 0
    score += {"none": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}[severity]
    score += 2 if float(epss) > 0.1 else 0    # EPSS > 10%
    score += 3 if has_exploit else 0            # Public exploit available
    score += {"low": 1, "medium": 2, "high": 3}[asset_criticality]

    if score >= 8:
        return "Immediate (24h)"
    elif score >= 5:
        return "High (7d)"
    elif score >= 3:
        return "Medium (30d)"
    else:
        return "Low (90d)"

Remediation

Patching Automation

#!/bin/bash
# Automated patching with approval gates
set -euo pipefail

TAG=$(date +%Y%m%d_%H%M%S)
LOG="/var/log/patching/$TAG.log"

stages() {
  echo "=== Patch Run $TAG ===" | tee -a "$LOG"

  # Stage 1: Pre-checks
  echo "[1/4] Pre-flight checks..." | tee -a "$LOG"
  df -h / | tee -a "$LOG"
  free -h | tee -a "$LOG"
  uptime | tee -a "$LOG"

  # Stage 2: Backup
  echo "[2/4] Creating backup..." | tee -a "$LOG"
  if command -v etckeeper &>/dev/null; then
    etckeeper commit "pre-patch backup $TAG"
  fi
  tar czf "/backup/etc-$TAG.tar.gz" /etc

  # Stage 3: Apply patches
  echo "[3/4] Applying patches..." | tee -a "$LOG"
  if command -v apt &>/dev/null; then
    apt update -qq && apt upgrade -y -qq 2>&1 | tee -a "$LOG"
  elif command -v dnf &>/dev/null; then
    dnf upgrade -y 2>&1 | tee -a "$LOG"
  fi

  # Stage 4: Post-checks
  echo "[4/4] Verification..." | tee -a "$LOG"
  needs-restarting 2>/dev/null | tee -a "$LOG" || true
  echo "Completed at $(date)" | tee -a "$LOG"
}

# Dry-run mode
if [[ "${1:-}" == "--dry-run" ]]; then
  echo "=== DRY RUN ==="
  apt list --upgradable 2>/dev/null || dnf check-update || true
else
  stages
fi

Patch Approval Workflow

# Approval gates
- Gate 1: Dev environment   →  automated (CI/CD)
- Gate 2: Staging           →  automated + smoke tests
- Gate 3: Production        →  change request + sign-off
- Gate 4: Rollback plan     →  documented before change
- Gate 5: Monitoring        →  alerting for side effects

Verification

# Rescan after patching
nessuscli scan start --scan-id 123     # Rescan same target
trivy image --severity CRITICAL app:patched

# Compare before/after
# Export previous scan as CSV, compare
diff previous_scan.csv new_scan.csv | grep -E "^>" | grep -v "fixed"

# Automated verification
#!/bin/bash
CVE="$1"
HOST="$2"
echo "Verifying $CVE on $HOST..."
ssh "$HOST" "dpkg -l | grep -E 'package-name'" 2>/dev/null && {
  echo "Package still present — check version"
  ssh "$HOST" "dpkg -l package-name | grep ^ii | awk '{print \$3}'"
}

Reporting

Metrics Dashboard

# Key metrics to track
metrics = {
    "vulnerabilities_total": 15000,
    "critical": 45,
    "high": 230,
    "medium": 1200,
    "low": 3500,
    "mttr": 12.5,          # Mean Time to Remediate (days)
    "scan_coverage": 94.2,  # % assets scanned
    "patch_success_rate": 98.7,
    "reopens": 12
}

# SLA compliance
def sla_compliance(vulns_by_severity):
    critical_compliance = sum(1 for v in vulns_by_severity["critical"]
                              if v["age_days"] <= 2) / len(vulns_by_severity["critical"])
    return {
        "critical": f"{critical_compliance:.1%}",
        "high": "88.3%",
        "medium": "76.5%",
        "low": "91.2%"
    }

Report Template

VM Executive Summary — Month MMM YYYY
======================================

Assets Scanned: 1,250
Coverage: 94.2%

Critical Vulnerabilities: 45 (-12 MoM)
High Vulnerabilities: 230 (-34 MoM)
Mean Time to Remediate: 12.5 days

Top 3 Critical Vulns:
1. CVE-2024-XXXX — RCE in Apache (21 hosts)
2. CVE-2024-YYYY — SQLi in internal app (8 hosts)
3. CVE-2024-ZZZZ — Auth bypass (5 hosts)

Patch Success Rate: 98.7%
Reopens: 12 (investigating root cause)

SLA Framework

| Severity | Remediation SLA | Verification SLA | Escalation | |----------|----------------|-----------------|------------| | Critical | 48 hours | 72 hours | CISO | | High | 14 days | 21 days | Security Director | | Medium | 30 days | 45 days | Security Manager | | Low | 90 days | 120 days | Team Lead |

Exception Management

If a vulnerability cannot be patched (compensating control required):
  - Document rationale (business impact, technical limitation)
  - Define compensating control (WAF rule, network ACL, agent isolation)
  - Set review date (max 90 days)
  - Get sign-off from asset owner + CISO

Tools Reference

| Tool | Purpose | Type | |------|---------|------| | Nessus | Network vulnerability scanning | Commercial | | OpenVAS/GVM | Network vulnerability scanning | Open source | | Qualys | Cloud VM + asset inventory | Commercial | | Rapid7 InsightVM | VM + risk assessment | Commercial | | Trivy | Container + filesystem scanning | Open source | | DefectDojo | Vulnerability management platform | Open source | | Faraday | Collaborative pentest + VM | Open source | | Archer | GRC platform | Commercial |