Automated CVE Triaging with Composite Risk Scores

Описание и применение

Автоматизированный процесс оценки CVE, объединяющий данные NVD, EPSS и CISA KEV для расчёта комплексных оценок риска и приоритизации рекомендаций.

Задача

Manual CVE triage is time‑consuming and error‑prone, making it hard to prioritize vulnerabilities quickly.

Результат

The system significantly speeds up CVE triage, providing a clear, data‑driven prioritization that helps teams focus on the most critical vulnerabilities first.

Рабочий процесс

• 1. Trigger triage job for a set of CVEs.
• 2. Parallelly query NVD, EPSS, and CISA KEV APIs for each CVE.
• 3. Aggregate data and calculate a composite risk score per CVE.
• 4. Rank CVEs by score and generate a prioritized recommendation list.
• 5. Deliver results to security analysts via a dashboard or notification.

Доказательства

Automates CVE triaging by querying NVD, EPSS, and CISA KEV in parallel to calculate composite risk scores and deliver prioritized recommendations.

Источник