vuln-triage

Risk-based vulnerability triage and SLA reporting from scanner exports. Turns a flat list of findings into a prioritized worklist and program metrics. Pure Python standard library, no dependencies.

Goal: stop treating a scanner dump as a to-do list. Prioritize by real risk (exposure + known exploitation), track SLAs, and surface what is actually overdue.

What it does

• Reads findings from CSV or JSON
• Derives severity from CVSS when it is missing
• Scores priority using CVSS plus internet exposure, known exploit availability, and SLA breach
• Assigns remediation SLAs per severity and computes due dates and age
• Flags open findings that have breached SLA
• Emits a prioritized CSV and a program-metrics JSON (counts, breaches, average age)
• Exit code is non-zero when SLA breaches exist (useful in CI or a scheduled job)

Files

• vuln_triage.py - CLI and triage engine
• sample-findings.csv - example input
• test_vuln_triage.py - unit tests

Usage

# prioritized worklist to stdout, metrics summary to stderr
python3 vuln_triage.py sample-findings.csv

# write outputs to files, evaluate as of a fixed date
python3 vuln_triage.py sample-findings.csv \
  --output prioritized.csv --metrics metrics.json --asof 2026-08-01

# tighten SLAs
python3 vuln_triage.py sample-findings.csv --sla "critical=3,high=14"

Input columns (CSV) or keys (JSON findings[]): id, asset, title, cvss, severity, internet_facing, exploit_available, first_seen, status. severity is optional (derived from cvss); status defaults to open.

Test

python3 -m unittest -v

Disclaimer

This repository reflects personal study and practice. It contains no employer data, policies, or configuration. Default SLA windows are illustrative - adapt them to your own program. Provided as-is; validate against your own context.

License

MIT. See LICENSE.