What it does. Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-vulnerabilities-with-ssvc-framework, or copy the skill folder into ~/.claude/skills/triaging-vulnerabilities-with-ssvc-framework/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/triaging-vulnerabilities-with-ssvc-framework/SKILL.md

SKILL.md (verbatim)

name: triaging-vulnerabilities-with-ssvc-framework
description: Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific
  Vulnerability Categorization (SSVC) decision tree, weighing exploitation status
  (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability,
  and mission prevalence to output Track/Track*/Attend/Act decisions. Use when
  prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation
  planning beyond raw CVSS scores.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- ssvc
- vulnerability-triage
- cisa
- vulnerability-prioritization
- decision-tree
- cvss
- remediation
- risk-management
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Triaging Vulnerabilities with SSVC Framework

Overview

The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.

When to Use

• When managing security operations that require triaging vulnerabilities with ssvc framework
• When improving security program maturity and operational processes
• When establishing standardized procedures for security team workflows
• When integrating threat intelligence or vulnerability data into operations

Prerequisites

• Python 3.9+ with requests, pandas, and jinja2 libraries
• Access to CISA KEV catalog API and EPSS API from FIRST
• NVD API key (optional, for higher rate limits)
• Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys

SSVC Decision Points

1. Exploitation Status

Assess current exploitation activity:

• None - No evidence of active exploitation
• PoC - Proof-of-concept exists publicly
• Active - Active exploitation observed in the wild (check CISA KEV)

# Check if a CVE is in CISA Known Exploited Vulnerabilities catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
  python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"

2. Technical Impact

Determine scope of compromise if exploited:

• Partial - Limited to a subset of system functionality or data
• Total - Full control of the affected system, complete data access

3. Automatability

Evaluate if exploitation can be automated at scale:

• No - Requires manual, targeted exploitation per victim
• Yes - Can be scripted or worm-like propagation is possible

4. Mission Prevalence

How widespread is the affected product in your environment:

• Minimal - Limited deployment, non-critical systems
• Support - Supports mission-critical functions indirectly
• Essential - Directly enables core mission capabilities

5. Public Well-Being Impact

Potential consequences for physical safety and public welfare:

• Minimal - Negligible impact on safety or public services
• Material - Noticeable degradation of public services
• Irreversible - Loss of life, major property damage, or critical infrastructure failure

SSVC Decision Outcomes

Outcome	Action Required	SLA
Track	Monitor, remediate in normal patch cycle	90 days
Track*	Monitor closely, prioritize in next patch window	60 days
Attend	Escalate to senior management, accelerate remediation	14 days
Act	Apply mitigations immediately, executive-level awareness	48 hours

Workflow

Step 1: Ingest Vulnerability Data

import requests
import json

# Fetch CISA KEV catalog
kev_url = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
kev_data = requests.get(kev_url).json()
kev_cves = {v['cveID'] for v in kev_data['vulnerabilities']}

# Fetch EPSS scores for context
epss_url = "https://api.first.org/data/v1/epss"
epss_response = requests.get(epss_url, params={"cve": "CVE-2024-3400"}).json()

Step 2: Evaluate Each Decision Point

def evaluate_exploitation(cve_id, kev_set):
    """Determine exploitation status from CISA KEV and EPSS data."""
    if cve_id in kev_set:
        return "active"
    epss = requests.get(
        "https://api.first.org/data/v1/epss",
        params={"cve": cve_id}
    ).json()
    if epss.get("data"):
        score = float(epss["data"][0].get("epss", 0))
        if score > 0.5:
            return "poc"
    return "none"

def evaluate_technical_impact(cvss_vector):
    """Parse CVSS vector for scope and impact metrics."""
    if "S:C" in cvss_vector or "C:H/I:H/A:H" in cvss_vector:
        return "total"
    return "partial"

def evaluate_automatability(cvss_vector, cve_description):
    """Check if attack vector is network-based with low complexity."""
    if "AV:N" in cvss_vector and "AC:L" in cvss_vector and "UI:N" in cvss_vector:
        return "yes"
    return "no"

Step 3: Apply SSVC Decision Tree

def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
    """CISA SSVC decision tree implementation."""
    if exploitation == "active":
        if tech_impact == "total" or automatability == "yes":
            return "Act"
        if mission_prevalence in ("essential", "support"):
            return "Act"
        return "Attend"
    if exploitation == "poc":
        if automatability == "yes" and tech_impact == "total":
            return "Attend"
        if mission_prevalence == "essential":
            return "Attend"
        return "Track*"
    # exploitation == "none"
    if tech_impact == "total" and mission_prevalence == "essential":
        return "Track*"
    return "Track"

Step 4: Generate Triage Report

# Run the SSVC triage script against scan results
python3 scripts/process.py --input scan_results.csv --output ssvc_triage_report.json

# View summary
cat ssvc_triage_report.json | python3 -m json.tool | head -50

Integration with Vulnerability Scanners

Import from Nessus CSV

# Export Nessus scan as CSV, then process
python3 scripts/process.py \
  --input nessus_export.csv \
  --format nessus \
  --output ssvc_results.json

Import from OpenVAS

# Export OpenVAS results as XML
python3 scripts/process.py \
  --input openvas_report.xml \
  --format openvas \
  --output ssvc_results.json

Validation and Testing

# Test SSVC decision logic with known CVEs
python3 -c "
from scripts.process import ssvc_decision
# CVE-2024-3400 - Palo Alto PAN-OS command injection (KEV listed)
assert ssvc_decision('active', 'total', 'yes', 'essential', 'material') == 'Act'
# CVE-2024-21887 - Ivanti Connect Secure (PoC available)
assert ssvc_decision('poc', 'total', 'yes', 'support', 'minimal') == 'Attend'
print('All SSVC decision tests passed')
"

References

• CISA SSVC Framework
• CERT/CC SSVC Documentation
• CISA SSVC Guide PDF
• FIRST EPSS API
• CISA Known Exploited Vulnerabilities

Other files in this skill

• LICENSE
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

references/api-reference.md (verbatim)

API Reference: Triaging Vulnerabilities with SSVC Framework

SSVC Decision Outcomes

Decision	Action	Timeline
Act	Immediate remediation required	24-48 hours
Attend	Urgent, prioritize in current cycle	1-2 weeks
Track*	Monitor closely, schedule remediation	Next patch cycle
Track	Standard vulnerability management	Regular cadence

SSVC Decision Points

Decision Point	Values	Description
Exploitation	none, poc, active	Current exploitation activity
Technical Impact	partial, total	Scope of compromise if exploited
Automatability	no, yes	Can exploitation be automated?
Mission Prevalence	minimal, support, essential	Asset criticality to mission

Enrichment APIs

API	Endpoint	Purpose
CISA KEV	known_exploited_vulnerabilities.json	Active exploitation check
FIRST EPSS	api.first.org/data/v1/epss?cve=	Exploitation probability
NVD	services.nvd.nist.gov/rest/json/cves/2.0	CVSS scores, CWE

Decision Tree Key Paths

Exploitation	Impact	Automatability	Prevalence	Decision
Active	Total	any	any	Act
Active	Partial	Yes	any	Act
Active	Partial	No	Essential	Act
Active	Partial	No	Support	Attend
PoC	Total	Yes	any	Attend
PoC	Total	No	any	Track*
PoC	Partial	any	any	Track*
None	Total	any	any	Track*
None	Partial	any	any	Track

Python Libraries

Library	Version	Purpose
requests	>=2.28	CISA KEV and EPSS API queries
json	stdlib	Report generation
pathlib	stdlib	Output directory management

References

• CISA SSVC Guide: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
• SEI SSVC Paper: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=653459
• FIRST EPSS: https://www.first.org/epss/
• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

references/standards.md (verbatim)

Standards and References - SSVC Vulnerability Triage

Primary Standards

CISA SSVC Framework

• Source: Cybersecurity and Infrastructure Security Agency (CISA)
• URL: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
• Version: SSVC v2.0 (2022 revision by CISA with SEI)
• Purpose: Provides a decision-tree methodology for vulnerability prioritization based on five decision points specific to the stakeholder's context

CERT/CC SSVC Original Research

• Source: Carnegie Mellon University Software Engineering Institute
• URL: https://certcc.github.io/SSVC/
• Publication: "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization" (2019)
• Authors: Jonathan Spring, Eric Hatleback, Allen Householder, Art Manion, Deana Shick
• DOI: https://doi.org/10.1184/R1/12124386

CVSS v3.1 and v4.0

• Source: Forum of Incident Response and Security Teams (FIRST)
• URL: https://www.first.org/cvss/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
• Relevance: SSVC complements CVSS by adding contextual decision points beyond base score severity

EPSS - Exploit Prediction Scoring System

• Source: FIRST EPSS Special Interest Group
• URL: https://www.first.org/epss/
• API Endpoint: https://api.first.org/data/v1/epss
• Model Documentation: https://www.first.org/epss/model
• Relevance: EPSS probability scores inform the exploitation status decision point in SSVC

Regulatory and Compliance Context

CISA Binding Operational Directive 22-01

• Title: Reducing the Significant Risk of Known Exploited Vulnerabilities
• URL: https://www.cisa.gov/binding-operational-directive-22-01
• Relevance: Mandates federal agencies to remediate KEV-listed vulnerabilities within specified timeframes; SSVC aligns remediation priorities with BOD 22-01 requirements

NIST SP 800-40 Rev 4

• Title: Guide to Enterprise Patch Management Planning
• URL: https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final
• Relevance: Provides organizational context for patch management decisions that SSVC informs

NIST Cybersecurity Framework (CSF) 2.0

• Function: IDENTIFY (ID.RA - Risk Assessment)
• URL: https://www.nist.gov/cyberframework
• Relevance: SSVC directly supports the risk assessment category for vulnerability prioritization

Data Sources

CISA Known Exploited Vulnerabilities (KEV) Catalog

• URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• JSON Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• Update Frequency: Updated as new exploited vulnerabilities are confirmed

National Vulnerability Database (NVD)

• URL: https://nvd.nist.gov/
• API v2: https://services.nvd.nist.gov/rest/json/cves/2.0
• Relevance: Provides CVSS scores and vulnerability details used in SSVC decision points

MITRE CVE Program

• URL: https://cve.mitre.org/
• CVE List: https://www.cve.org/
• Relevance: CVE identifiers are the primary key for linking vulnerability data across SSVC decision points

references/workflows.md (verbatim)

Workflows - SSVC Vulnerability Triage

Workflow 1: Initial SSVC Triage Pipeline

Trigger

New vulnerability scan results imported from Nessus, Qualys, OpenVAS, or other scanner.

Steps

1. Ingest Scan Results

   • Parse scanner output (CSV, XML, or JSON format)
   • Extract CVE identifiers, affected hosts, CVSS vectors, and descriptions
   • Deduplicate findings by CVE + host combination

2. Enrich with External Intelligence

   • Query CISA KEV catalog JSON feed for exploitation status
   • Query FIRST EPSS API for exploitation probability scores
   • Query NVD API v2 for CVSS v3.1/v4.0 vectors and CWE mappings
   • Cache API responses to avoid rate limiting (NVD: 5 requests/30s without key, 50/30s with key)

3. Evaluate SSVC Decision Points

   • Exploitation: Map KEV membership to "Active", EPSS > 0.5 to "PoC", otherwise "None"
   • Technical Impact: Parse CVSS vector; if Scope:Changed or CIA all High, mark "Total"
   • Automatability: Network vector + Low complexity + No user interaction = "Yes"
   • Mission Prevalence: Cross-reference affected assets with CMDB criticality tags
   • Public Well-Being: Map asset function to safety impact categories

4. Apply Decision Tree

   • Walk the CISA SSVC decision tree with evaluated decision points
   • Assign outcome: Track, Track*, Attend, or Act

5. Generate Prioritized Report

   • Sort vulnerabilities by SSVC outcome (Act > Attend > Track* > Track)
   • Within each category, secondary sort by EPSS score descending
   • Output JSON report and CSV summary for ticketing integration

Workflow 2: Continuous SSVC Monitoring

Trigger

Daily scheduled job (cron or CI/CD pipeline).

Steps

1. Refresh CISA KEV Catalog

   curl -s -o /tmp/kev_catalog.json \
     "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
   

2. Check Previously Tracked CVEs Against Updated KEV

   • Compare current open vulnerabilities against latest KEV additions
   • If a previously "Track" or "Track*" CVE appears in KEV, re-evaluate to "Attend" or "Act"

3. Refresh EPSS Scores

   curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400,CVE-2024-21887" | \
     python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin)['data'], indent=2))"
   

4. Update SSVC Outcomes

   • Re-run decision tree for all open vulnerabilities with refreshed data
   • Flag any outcome changes (e.g., Track -> Attend)

5. Send Notifications

   • Slack/Teams webhook for any new "Act" or "Attend" outcomes
   • Email digest for "Track*" changes
   • Update Jira/ServiceNow tickets with new SSVC classification

Workflow 3: Asset-Context SSVC Enrichment

Trigger

New asset onboarded or asset criticality classification updated.

Steps

1. Import Asset Inventory

   • Pull from CMDB (ServiceNow, Snipe-IT, or similar)
   • Map each asset to mission prevalence category:
     • Minimal: development, test environments
     • Support: backup systems, monitoring infrastructure
     • Essential: production databases, authentication servers, customer-facing apps

2. Map Public Well-Being Impact

   • Healthcare systems, SCADA/ICS, transportation: Irreversible
   • Public web services, financial processing: Material
   • Internal tools, development systems: Minimal

3. Re-Evaluate Open Vulnerabilities

   • Apply updated asset context to all open vulnerability SSVC evaluations
   • Generate delta report showing outcome changes

Workflow 4: SSVC Metrics and Reporting

Trigger

Weekly/monthly reporting cycle.

Metrics to Track

Metric	Calculation	Target
Mean Time to Remediate (Act)	Avg days from Act classification to closure	< 2 days
Mean Time to Remediate (Attend)	Avg days from Attend classification to closure	< 14 days
SLA Breach Rate	% of vulns not remediated within SLA	< 5%
Act Backlog	Count of open Act-classified vulnerabilities	0
Attend Backlog	Count of open Attend-classified vulnerabilities	< 10
Coverage Rate	% of vulnerabilities processed through SSVC	> 95%

Report Generation

python3 scripts/process.py \
  --mode report \
  --input ssvc_results.json \
  --period weekly \
  --output ssvc_metrics_report.html

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.