[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GHYGD08AS3GECPHQQ64B5":3,"skill-same:01M71GHYGD08AS3GECPHQQ64B5":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":14,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M71GHYGD08AS3GECPHQQ64B5","vulnerability-SKILL.md",null,">\n  Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"vulnerability SKILL md","skill md","vulnerability","vulnerability assessment","prioritize","integrate","remediation","openvas","scanning","qualys","nessus","track","siem","across","alerting","soc","workflow","when","assessment","discover","2026-11-10 10:12:30",false,"---\nname: vulnerability-SKILL.md\ndescription: \">\\n  Builds a structured vulnerability scanning workflow using tools\\\n  \\ like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation\\\n  \\ of security vulnerabilities across infrastructure. Use when SOC teams need to\\\n  \\ establish recurring vulnerability assessment processes, integrate scan results\\\n  \\ with SIEM alerting, and build remediation tracking dashboards.\"\n---\n# Building Vulnerability Scanning Workflow\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to establish or improve recurring vulnerability scanning programs\n- Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence\n- Vulnerability data must be integrated into SIEM for correlation with exploitation attempts\n- Remediation tracking needs formalization with SLA-based dashboards and reporting\n\n**Do not use** for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.\n\n## Prerequisites\n\n- Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS\u002FGreenbone)\n- Asset inventory with criticality classifications (business-critical, standard, development)\n- Network access from scanner to all target segments (agent-based or network scan)\n- SIEM integration for scan result ingestion and correlation\n- Patch management system (WSUS, SCCM, Intune) for remediation tracking\n\n## Workflow\n\n### Step 1: Define Scan Scope and Scheduling\n\nCreate scan policies covering all asset types:\n\n**Nessus Scan Configuration (API):**\n```python\nimport requests\n\nnessus_url = \"https:\u002F\u002Fnessus.company.com:8834\"\nheaders = {\"X-ApiKeys\": f\"accessKey={access_key};secretKey={secret_key}\"}\n\n# Create scan policy\npolicy = {\n    \"uuid\": \"advanced\",\n    \"settings\": {\n        \"name\": \"SOC Weekly Infrastructure Scan\",\n        \"description\": \"Weekly credentialed scan of all server and workstation segments\",\n        \"scanner_id\": 1,\n        \"policy_id\": 0,\n        \"text_targets\": \"10.0.0.0\u002F16, 172.16.0.0\u002F12\",\n        \"launch\": \"WEEKLY\",\n        \"starttime\": \"20240315T020000\",\n        \"rrules\": \"FREQ=WEEKLY;INTERVAL=1;BYDAY=SA\",\n        \"enabled\": True\n    },\n    \"credentials\": {\n        \"add\": {\n            \"Host\": {\n                \"Windows\": [{\n                    \"domain\": \"company.local\",\n                    \"username\": \"nessus_svc\",\n                    \"password\": \"SCAN_SERVICE_PASSWORD\",\n                    \"auth_method\": \"Password\"\n                }],\n                \"SSH\": [{\n                    \"username\": \"nessus_svc\",\n                    \"private_key\": \"\u002Fpath\u002Fto\u002Fnessus_key\",\n                    \"auth_method\": \"public key\"\n                }]\n            }\n        }\n    }\n}\n\nresponse = requests.post(f\"{nessus_url}\u002Fscans\", headers=headers, json=policy,\n                         verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\")  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\nscan_id = response.json()[\"scan\"][\"id\"]\nprint(f\"Scan created: ID {scan_id}\")\n```\n\n**Qualys VMDR Scan via API:**\n```python\nimport qualysapi\n\nconn = qualysapi.connect(\n    hostname=\"qualysapi.qualys.com\",\n    username=\"api_user\",\n    password=\"API_PASSWORD\"\n)\n\n# Launch vulnerability scan\nparams = {\n    \"action\": \"launch\",\n    \"scan_title\": \"Weekly_Infrastructure_Scan\",\n    \"ip\": \"10.0.0.0\u002F16\",\n    \"option_id\": \"123456\",  # Scan profile ID\n    \"iscanner_name\": \"Internal_Scanner_01\",\n    \"priority\": \"0\"\n}\n\nresponse = conn.request(\"\u002Fapi\u002F2.0\u002Ffo\u002Fscan\u002F\", params)\nprint(f\"Scan launched: {response}\")\n```\n\n### Step 2: Process and Prioritize Scan Results\n\nDownload results and apply risk-based prioritization:\n\n```python\nimport requests\nimport csv\n\n# Export Nessus results\nresponse = requests.get(\n    f\"{nessus_url}\u002Fscans\u002F{scan_id}\u002Fexport\",\n    headers=headers,\n    params={\"format\": \"csv\"},\n    verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n)\n\n# Parse and prioritize\nvulns = []\nreader = csv.DictReader(response.text.splitlines())\nfor row in reader:\n    cvss = float(row.get(\"CVSS v3.0 Base Score\", 0))\n    asset_criticality = get_asset_criticality(row[\"Host\"])  # From asset inventory\n\n    # Risk-based priority calculation\n    risk_score = cvss * asset_criticality_multiplier(asset_criticality)\n\n    # Boost score if actively exploited (check CISA KEV)\n    if row.get(\"CVE\") in cisa_kev_list:\n        risk_score *= 1.5\n\n    vulns.append({\n        \"host\": row[\"Host\"],\n        \"plugin_name\": row[\"Name\"],\n        \"severity\": row[\"Risk\"],\n        \"cvss\": cvss,\n        \"cve\": row.get(\"CVE\", \"N\u002FA\"),\n        \"risk_score\": round(risk_score, 1),\n        \"asset_criticality\": asset_criticality,\n        \"kev\": row.get(\"CVE\") in cisa_kev_list\n    })\n\n# Sort by risk score\nvulns.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n```\n\n**CISA KEV (Known Exploited Vulnerabilities) Check:**\n```python\nimport requests\n\nkev_response = requests.get(\n    \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n)\nkev_data = kev_response.json()\ncisa_kev_list = {v[\"cveID\"] for v in kev_data[\"vulnerabilities\"]}\n\n# Check if vulnerability is actively exploited\ndef is_actively_exploited(cve_id):\n    return cve_id in cisa_kev_list\n```\n\n### Step 3: Define Remediation SLAs\n\nApply SLA-based remediation timelines:\n\n| Priority | CVSS Range | Asset Type | SLA | Examples |\n|----------|-----------|------------|-----|---------|\n| **P1 Critical** | 9.0-10.0 + KEV | All assets | 24 hours | Log4Shell, EternalBlue on prod servers |\n| **P2 High** | 7.0-8.9 or 9.0+ non-KEV | Business-critical | 7 days | RCE without known exploit |\n| **P3 Medium** | 4.0-6.9 | Business-critical | 30 days | Authenticated privilege escalation |\n| **P4 Low** | 0.1-3.9 | Standard | 90 days | Information disclosure, low-impact DoS |\n| **P5 Informational** | 0.0 | Development | Next cycle | Best practice findings, config hardening |\n\n### Step 4: Integrate with SIEM for Exploitation Detection\n\nCorrelate vulnerability scan data with SIEM alerts to detect active exploitation:\n\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval vuln_key = Host.\":\".CVE\n| join vuln_key type=left [\n    search index=ids_ips sourcetype=\"snort\" OR sourcetype=\"suricata\"\n    | eval vuln_key = dest_ip.\":\".cve_id\n    | stats count AS exploit_attempts, latest(_time) AS last_exploit_attempt by vuln_key\n  ]\n| where isnotnull(exploit_attempts)\n| eval risk = \"CRITICAL — Vulnerability being actively exploited\"\n| sort - exploit_attempts\n| table Host, CVE, plugin_name, cvss_score, exploit_attempts, last_exploit_attempt, risk\n```\n\n**Alert when KEV vulnerabilities are detected on critical assets:**\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\" severity=\"Critical\"\n| lookup cisa_kev_lookup.csv cve_id AS CVE OUTPUT kev_status, due_date\n| where kev_status=\"active\"\n| lookup asset_criticality_lookup.csv ip AS Host OUTPUT criticality\n| where criticality IN (\"business-critical\", \"mission-critical\")\n| table Host, CVE, plugin_name, cvss_score, kev_status, due_date, criticality\n```\n\n### Step 5: Build Remediation Tracking Dashboard\n\n**Splunk Dashboard for Vulnerability Metrics:**\n```spl\n-- Open vulnerabilities by severity\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| stats count by severity\n| eval order = case(severity=\"Critical\", 1, severity=\"High\", 2, severity=\"Medium\", 3,\n                    severity=\"Low\", 4, 1=1, 5)\n| sort order\n\n-- SLA compliance tracking\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| eval sla_days = case(\n    severity=\"Critical\", 1,\n    severity=\"High\", 7,\n    severity=\"Medium\", 30,\n    severity=\"Low\", 90\n  )\n| eval days_open = round((now() - first_detected) \u002F 86400)\n| eval sla_status = if(days_open > sla_days, \"OVERDUE\", \"Within SLA\")\n| stats count by severity, sla_status\n\n-- Remediation trend over 90 days\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval is_open = if(status=\"open\", 1, 0)\n| eval is_closed = if(status=\"fixed\", 1, 0)\n| timechart span=1w sum(is_open) AS opened, sum(is_closed) AS remediated\n```\n\n### Step 6: Automate Remediation Ticketing\n\nCreate tickets automatically for high-priority findings:\n\n```python\nimport requests\n\nservicenow_url = \"https:\u002F\u002Fcompany.service-now.com\u002Fapi\u002Fnow\u002Ftable\u002Fincident\"\nheaders = {\n    \"Content-Type\": \"application\u002Fjson\",\n    \"Authorization\": f\"Bearer {snow_token}\"\n}\n\nfor vuln in vulns:\n    if vuln[\"risk_score\"] >= 8.0:\n        ticket = {\n            \"short_description\": f\"[VULN] {vuln['cve']} — {vuln['plugin_name']} on {vuln['host']}\",\n            \"description\": (\n                f\"Vulnerability: {vuln['plugin_name']}\\n\"\n                f\"CVE: {vuln['cve']}\\n\"\n                f\"CVSS: {vuln['cvss']}\\n\"\n                f\"Host: {vuln['host']}\\n\"\n                f\"Asset Criticality: {vuln['asset_criticality']}\\n\"\n                f\"CISA KEV: {'YES' if vuln['kev'] else 'NO'}\\n\"\n                f\"Risk Score: {vuln['risk_score']}\\n\"\n                f\"Remediation SLA: {'24 hours' if vuln['kev'] else '7 days'}\"\n            ),\n            \"urgency\": \"1\" if vuln[\"kev\"] else \"2\",\n            \"impact\": \"1\" if vuln[\"asset_criticality\"] == \"business-critical\" else \"2\",\n            \"assignment_group\": \"IT Infrastructure\",\n            \"category\": \"Vulnerability\"\n        }\n        response = requests.post(servicenow_url, headers=headers, json=ticket)\n        print(f\"Ticket created: {response.json()['result']['number']}\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System — standardized severity rating (0-10) for vulnerabilities |\n| **CISA KEV** | Known Exploited Vulnerabilities catalog — CISA-maintained list of vulnerabilities with confirmed active exploitation |\n| **Credentialed Scan** | Vulnerability scan using authenticated access for deeper detection than network-only scanning |\n| **Asset Criticality** | Business impact classification determining remediation priority (mission-critical, business-critical, standard) |\n| **Remediation SLA** | Service Level Agreement defining maximum time allowed to patch vulnerabilities by severity |\n| **EPSS** | Exploit Prediction Scoring System — ML-based probability score predicting likelihood of exploitation |\n\n## Tools & Systems\n\n- **Tenable Nessus \u002F Tenable.io**: Enterprise vulnerability scanner with 200,000+ plugin checks and compliance auditing\n- **Qualys VMDR**: Cloud-based vulnerability management with asset discovery, prioritization, and patching integration\n- **OpenVAS (Greenbone)**: Open-source vulnerability scanner with community-maintained vulnerability feed\n- **CISA KEV Catalog**: US government maintained list of actively exploited vulnerabilities requiring mandatory remediation\n- **Rapid7 InsightVM**: Vulnerability management platform with live dashboards and remediation project tracking\n\n## Common Scenarios\n\n- **Zero-Day Response**: New CVE published — run targeted scan for affected software, cross-reference with KEV and exploit databases\n- **Compliance Audit Prep**: Generate PCI DSS or HIPAA vulnerability report showing scan coverage and remediation status\n- **Post-Patch Verification**: Rescan patched systems to confirm vulnerability closure and update tracking dashboard\n- **Network Expansion**: New subnet added to infrastructure — onboard to scan scope with appropriate policy\n- **Third-Party Risk**: Scan externally-facing assets to validate vendor patch compliance before integration\n\n## Output Format\n\n```\nVULNERABILITY SCAN REPORT — Weekly Summary\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScan Date:    2024-03-16 02:00 UTC\nScan Scope:   10.0.0.0\u002F16 (1,247 hosts scanned)\nDuration:     4h 23m\nCoverage:     98.7% (16 hosts unreachable)\n\nFindings:\n  Severity     Count    New    CISA KEV\n  Critical     23       5      3\n  High         187      34     12\n  Medium       892      78     0\n  Low          1,456    112    0\n  Info         3,891    201    0\n\nTop Priority (P1 — 24hr SLA):\n  CVE-2024-21762  FortiOS RCE           3 hosts   KEV: YES\n  CVE-2024-1709   ConnectWise RCE       1 host    KEV: YES\n  CVE-2024-3400   Palo Alto PAN-OS RCE  2 hosts   KEV: YES\n\nSLA Compliance:\n  Critical: 82% within SLA (4 overdue)\n  High:     91% within SLA (17 overdue)\n  Medium:   88% within SLA (107 overdue)\n\nTickets Created: 39 (ServiceNow)\n```\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"vulnerability\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Building Vulnerability Scanning Workflow\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to establish or improve recurring vulnerability scanning programs\n- Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence\n- Vulnerability data must be integrated into SIEM for correlation with exploitation attempts\n- Remediation tracking needs formalization with SLA-based dashboards and reporting\n\n**Do not use** for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.\n\n## Prerequisites\n\n- Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS\u002FGreenbone)\n- Asset inventory with criticality classifications (business-critical, standard, development)\n- Network access from scanner to all target segments (agent-based or network scan)\n- SIEM integration for scan result ingestion and correlation\n- Patch management system (WSUS, SCCM, Intune) for remediation tracking\n\n## Workflow\n\n### Step 1: Define Scan Scope and Scheduling\n\nCreate scan policies covering all asset types:\n\n**Nessus Scan Configuration (API):**\n```python\nimport requests\n\nnessus_url = \"https:\u002F\u002Fnessus.company.com:8834\"\nheaders = {\"X-ApiKeys\": f\"accessKey={access_key};secretKey={secret_key}\"}\n\n# Create scan policy\npolicy = {\n    \"uuid\": \"advanced\",\n    \"settings\": {\n        \"name\": \"SOC Weekly Infrastructure Scan\",\n        \"description\": \"Weekly credentialed scan of all server and workstation segments\",\n        \"scanner_id\": 1,\n        \"policy_id\": 0,\n        \"text_targets\": \"10.0.0.0\u002F16, 172.16.0.0\u002F12\",\n        \"launch\": \"WEEKLY\",\n        \"starttime\": \"20240315T020000\",\n        \"rrules\": \"FREQ=WEEKLY;INTERVAL=1;BYDAY=SA\",\n        \"enabled\": True\n    },\n    \"credentials\": {\n        \"add\": {\n            \"Host\": {\n                \"Windows\": [{\n                    \"domain\": \"company.local\",\n                    \"username\": \"nessus_svc\",\n                    \"password\": \"SCAN_SERVICE_PASSWORD\",\n                    \"auth_method\": \"Password\"\n                }],\n                \"SSH\": [{\n                    \"username\": \"nessus_svc\",\n                    \"private_key\": \"\u002Fpath\u002Fto\u002Fnessus_key\",\n                    \"auth_method\": \"public key\"\n                }]\n            }\n        }\n    }\n}\n\nresponse = requests.post(f\"{nessus_url}\u002Fscans\", headers=headers, json=policy,\n                         verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\")  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\nscan_id = response.json()[\"scan\"][\"id\"]\nprint(f\"Scan created: ID {scan_id}\")\n```\n\n**Qualys VMDR Scan via API:**\n```python\nimport qualysapi\n\nconn = qualysapi.connect(\n    hostname=\"qualysapi.qualys.com\",\n    username=\"api_user\",\n    password=\"API_PASSWORD\"\n)\n\n# Launch vulnerability scan\nparams = {\n    \"action\": \"launch\",\n    \"scan_title\": \"Weekly_Infrastructure_Scan\",\n    \"ip\": \"10.0.0.0\u002F16\",\n    \"option_id\": \"123456\",  # Scan profile ID\n    \"iscanner_name\": \"Internal_Scanner_01\",\n    \"priority\": \"0\"\n}\n\nresponse = conn.request(\"\u002Fapi\u002F2.0\u002Ffo\u002Fscan\u002F\", params)\nprint(f\"Scan launched: {response}\")\n```\n\n### Step 2: Process and Prioritize Scan Results\n\nDownload results and apply risk-based prioritization:\n\n```python\nimport requests\nimport csv\n\n# Export Nessus results\nresponse = requests.get(\n    f\"{nessus_url}\u002Fscans\u002F{scan_id}\u002Fexport\",\n    headers=headers,\n    params={\"format\": \"csv\"},\n    verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n)\n\n# Parse and prioritize\nvulns = []\nreader = csv.DictReader(response.text.splitlines())\nfor row in reader:\n    cvss = float(row.get(\"CVSS v3.0 Base Score\", 0))\n    asset_criticality = get_asset_criticality(row[\"Host\"])  # From asset inventory\n\n    # Risk-based priority calculation\n    risk_score = cvss * asset_criticality_multiplier(asset_criticality)\n\n    # Boost score if actively exploited (check CISA KEV)\n    if row.get(\"CVE\") in cisa_kev_list:\n        risk_score *= 1.5\n\n    vulns.append({\n        \"host\": row[\"Host\"],\n        \"plugin_name\": row[\"Name\"],\n        \"severity\": row[\"Risk\"],\n        \"cvss\": cvss,\n        \"cve\": row.get(\"CVE\", \"N\u002FA\"),\n        \"risk_score\": round(risk_score, 1),\n        \"asset_criticality\": asset_criticality,\n        \"kev\": row.get(\"CVE\") in cisa_kev_list\n    })\n\n# Sort by risk score\nvulns.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n```\n\n**CISA KEV (Known Exploited Vulnerabilities) Check:**\n```python\nimport requests\n\nkev_response = requests.get(\n    \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n)\nkev_data = kev_response.json()\ncisa_kev_list = {v[\"cveID\"] for v in kev_data[\"vulnerabilities\"]}\n\n# Check if vulnerability is actively exploited\ndef is_actively_exploited(cve_id):\n    return cve_id in cisa_kev_list\n```\n\n### Step 3: Define Remediation SLAs\n\nApply SLA-based remediation timelines:\n\n| Priority | CVSS Range | Asset Type | SLA | Examples |\n|----------|-----------|------------|-----|---------|\n| **P1 Critical** | 9.0-10.0 + KEV | All assets | 24 hours | Log4Shell, EternalBlue on prod servers |\n| **P2 High** | 7.0-8.9 or 9.0+ non-KEV | Business-critical | 7 days | RCE without known exploit |\n| **P3 Medium** | 4.0-6.9 | Business-critical | 30 days | Authenticated privilege escalation |\n| **P4 Low** | 0.1-3.9 | Standard | 90 days | Information disclosure, low-impact DoS |\n| **P5 Informational** | 0.0 | Development | Next cycle | Best practice findings, config hardening |\n\n### Step 4: Integrate with SIEM for Exploitation Detection\n\nCorrelate vulnerability scan data with SIEM alerts to detect active exploitation:\n\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval vuln_key = Host.\":\".CVE\n| join vuln_key type=left [\n    search index=ids_ips sourcetype=\"snort\" OR sourcetype=\"suricata\"\n    | eval vuln_key = dest_ip.\":\".cve_id\n    | stats count AS exploit_attempts, latest(_time) AS last_exploit_attempt by vuln_key\n  ]\n| where isnotnull(exploit_attempts)\n| eval risk = \"CRITICAL — Vulnerability being actively exploited\"\n| sort - exploit_attempts\n| table Host, CVE, plugin_name, cvss_score, exploit_attempts, last_exploit_attempt, risk\n```\n\n**Alert when KEV vulnerabilities are detected on critical assets:**\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\" severity=\"Critical\"\n| lookup cisa_kev_lookup.csv cve_id AS CVE OUTPUT kev_status, due_date\n| where kev_status=\"active\"\n| lookup asset_criticality_lookup.csv ip AS Host OUTPUT criticality\n| where criticality IN (\"business-critical\", \"mission-critical\")\n| table Host, CVE, plugin_name, cvss_score, kev_status, due_date, criticality\n```\n\n### Step 5: Build Remediation Tracking Dashboard\n\n**Splunk Dashboard for Vulnerability Metrics:**\n```spl\n-- Open vulnerabilities by severity\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| stats count by severity\n| eval order = case(severity=\"Critical\", 1, severity=\"High\", 2, severity=\"Medium\", 3,\n                    severity=\"Low\", 4, 1=1, 5)\n| sort order\n\n-- SLA compliance tracking\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| eval sla_days = case(\n    severity=\"Critical\", 1,\n    severity=\"High\", 7,\n    severity=\"Medium\", 30,\n    severity=\"Low\", 90\n  )\n| eval days_open = round((now() - first_detected) \u002F 86400)\n| eval sla_status = if(days_open > sla_days, \"OVERDUE\", \"Within SLA\")\n| stats count by severity, sla_status\n\n-- Remediation trend over 90 days\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval is_open = if(status=\"open\", 1, 0)\n| eval is_closed = if(status=\"fixed\", 1, 0)\n| timechart span=1w sum(is_open) AS opened, sum(is_closed) AS remediated\n```\n\n### Step 6: Automate Remediation Ticketing\n\nCreate tickets automatically for high-priority findings:\n\n```python\nimport requests\n\nservicenow_url = \"https:\u002F\u002Fcompany.service-now.com\u002Fapi\u002Fnow\u002Ftable\u002Fincident\"\nheaders = {\n    \"Content-Type\": \"application\u002Fjson\",\n    \"Authorization\": f\"Bearer {snow_token}\"\n}\n\nfor vuln in vulns:\n    if vuln[\"risk_score\"] >= 8.0:\n        ticket = {\n            \"short_description\": f\"[VULN] {vuln['cve']} — {vuln['plugin_name']} on {vuln['host']}\",\n            \"description\": (\n                f\"Vulnerability: {vuln['plugin_name']}\\n\"\n                f\"CVE: {vuln['cve']}\\n\"\n                f\"CVSS: {vuln['cvss']}\\n\"\n                f\"Host: {vuln['host']}\\n\"\n                f\"Asset Criticality: {vuln['asset_criticality']}\\n\"\n                f\"CISA KEV: {'YES' if vuln['kev'] else 'NO'}\\n\"\n                f\"Risk Score: {vuln['risk_score']}\\n\"\n                f\"Remediation SLA: {'24 hours' if vuln['kev'] else '7 days'}\"\n            ),\n            \"urgency\": \"1\" if vuln[\"kev\"] else \"2\",\n            \"impact\": \"1\" if vuln[\"asset_criticality\"] == \"business-critical\" else \"2\",\n            \"assignment_group\": \"IT Infrastructure\",\n            \"category\": \"Vulnerability\"\n        }\n        response = requests.post(servicenow_url, headers=headers, json=ticket)\n        print(f\"Ticket created: {response.json()['result']['number']}\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System — standardized severity rating (0-10) for vulnerabilities |\n| **CISA KEV** | Known Exploited Vulnerabilities catalog — CISA-maintained list of vulnerabilities with confirmed active exploitation |\n| **Credentialed Scan** | Vulnerability scan using authenticated access for deeper detection than network-only scanning |\n| **Asset Criticality** | Business impact classification determining remediation priority (mission-critical, business-critical, standard) |\n| **Remediation SLA** | Service Level Agreement defining maximum time allowed to patch vulnerabilities by severity |\n| **EPSS** | Exploit Prediction Scoring System — ML-based probability score predicting likelihood of exploitation |\n\n## Tools & Systems\n\n- **Tenable Nessus \u002F Tenable.io**: Enterprise vulnerability scanner with 200,000+ plugin checks and compliance auditing\n- **Qualys VMDR**: Cloud-based vulnerability management with asset discovery, prioritization, and patching integration\n- **OpenVAS (Greenbone)**: Open-source vulnerability scanner with community-maintained vulnerability feed\n- **CISA KEV Catalog**: US government maintained list of actively exploited vulnerabilities requiring mandatory remediation\n- **Rapid7 InsightVM**: Vulnerability management platform with live dashboards and remediation project tracking\n\n## Common Scenarios\n\n- **Zero-Day Response**: New CVE published — run targeted scan for affected software, cross-reference with KEV and exploit databases\n- **Compliance Audit Prep**: Generate PCI DSS or HIPAA vulnerability report showing scan coverage and remediation status\n- **Post-Patch Verification**: Rescan patched systems to confirm vulnerability closure and update tracking dashboard\n- **Network Expansion**: New subnet added to infrastructure — onboard to scan scope with appropriate policy\n- **Third-Party Risk**: Scan externally-facing assets to validate vendor patch compliance before integration\n\n## Output Format\n\n```\nVULNERABILITY SCAN REPORT — Weekly Summary\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScan Date:    2024-03-16 02:00 UTC\nScan Scope:   10.0.0.0\u002F16 (1,247 hosts scanned)\nDuration:     4h 23m\nCoverage:     98.7% (16 hosts unreachable)\n\nFindings:\n  Severity     Count    New    CISA KEV\n  Critical     23       5      3\n  High         187      34     12\n  Medium       892      78     0\n  Low          1,456    112    0\n  Info         3,891    201    0\n\nTop Priority (P1 — 24hr SLA):\n  CVE-2024-21762  FortiOS RCE           3 hosts   KEV: YES\n  CVE-2024-1709   ConnectWise RCE       1 host    KEV: YES\n  CVE-2024-3400   Palo Alto PAN-OS RCE  2 hosts   KEV: YES\n\nSLA Compliance:\n  Critical: 82% within SLA (4 overdue)\n  High:     91% within SLA (17 overdue)\n  Medium:   88% within SLA (107 overdue)\n\nTickets Created: 39 (ServiceNow)\n```\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"vulnerability\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvuln\u002Fscanning\u002Fvulnerability","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill vulnerability-SKILL.md",{"tool":62,"command":63},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill vulnerability-SKILL.md",{"tool":65,"command":66},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill vulnerability-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002FSKILL.md",true,[70,76,80,84,90],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"index.json","REFERENCE","参考文档",1156,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002Findex.json",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fapi-reference.md",1780,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002Freferences\u002Fapi-reference.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Findex.json",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002Freferences\u002Findex.json",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",6296,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002Fscripts\u002Fagent.py",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":82,"sourceHtmlUrl":92},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fscanning\u002Fvulnerability\u002Fscripts\u002Findex.json",[94,120,142,164,186,202],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,101,128,104,129,130,131,118,132,133,134,37,135,136,106,137,138,139,140,141],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":148,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[149,150,151,152,153,154,118,132,155,133,156,157,106,139,158,159,160,161,162,163],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,171,172,173,174,175,176,107,177,118,119,178,179,180,181,182,183,184,185,106],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[193,194,102,195,173,175,196,107,197,177,118,119,133,198,199,200,201,185,106,108],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[209,102,173,210,196,107,211,212,118,119,213,214,215,216,217,218,106,108,219,220],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]