<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-template-collections
description: >-
  Build and manage organized Nuclei template collections for teams and
  organizations. Covers repository structure, tagging conventions, metadata
  standards, versioning, distribution, and template lifecycle management.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - collections
  - organization
  - repository
  - metadata
  - distribution
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Template Collections

## Overview

Template collections organize detection templates into maintainable, shareable
repositories. Well-structured collections enable teams to quickly find relevant
templates, track coverage gaps, and distribute security checks consistently
across scanning infrastructure.

Mode: `[MODE: ARCHITECT]` — Template repository design and management.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ with template management | Required |
| Git for version control | Required |
| Understanding of organizational security scanning needs | Required |

## Key Concepts

### Repository Structure

```
nuclei-templates/
├── README.md
├── .nuclei-ignore               # Templates to skip
├── cves/
│   ├── 2024/
│   │   ├── CVE-2024-1234.yaml
│   │   └── CVE-2024-5678.yaml
│   └── 2025/
├── vulnerabilities/
│   ├── generic/
│   │   ├── sqli-error-based.yaml
│   │   └── xss-reflected.yaml
│   ├── wordpress/
│   └── apache/
├── misconfiguration/
│   ├── http-missing-headers.yaml
│   ├── cors-misconfiguration.yaml
│   └── directory-listing.yaml
├── exposures/
│   ├── configs/
│   ├── backups/
│   └── tokens/
├── technologies/
│   ├── tech-detect.yaml
│   └── waf-detect.yaml
├── default-logins/
├── workflows/
│   ├── wordpress-assessment.yaml
│   └── full-scan-workflow.yaml
└── helpers/
    └── wordlists/
```

### Template Naming Convention

```
# CVE templates
CVE-{YEAR}-{ID}.yaml

# Product vulnerability
{product}-{vulnerability-type}.yaml

# Generic detection
{category}-{specific-check}.yaml

# Technology detection
{technology}-detect.yaml

# Examples
CVE-2024-21762.yaml
apache-path-traversal.yaml
graphql-introspection.yaml
nginx-detect.yaml
```

### Tagging Standards

```yaml
# Tag hierarchy: category, product, type, tech
tags: cve,cve2024,apache,rce,critical

# Standard tag categories
# Vulnerability type: sqli, xss, ssrf, rce, lfi, rfi, idor, csrf
# Product: apache, nginx, wordpress, joomla, drupal
# Category: cve, misconfig, exposure, default-login, tech
# Severity: critical, high, medium, low, info
# Protocol: http, network, dns, ssl, file, headless
```

### Metadata Template

```yaml
id: collection-template-standard

info:
  name: Descriptive Vulnerability Name
  author: team-handle
  severity: high
  description: |
    One paragraph explaining what this template detects, why it matters,
    and what the security impact is.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-YYYY-NNNN
    - https://vendor.com/advisory
  classification:
    cve-id: CVE-YYYY-NNNN
    cwe-id: CWE-NNN
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.95
    epss-percentile: 0.99
  tags: cve,cve2024,product,vuln-type
  metadata:
    verified: true
    max-request: 1
    vendor: vendor-name
    product: product-name
    shodan-query: 'http.title:"product"'
    fofa-query: 'title="product"'
    google-query: 'intitle:"product" inurl:"/admin"'
```

### Collection Configuration

```yaml
# .nuclei-ignore — skip templates during bulk scans
helpers/
tests/
deprecated/
experimental/
*-dos.yaml
*-brute-force.yaml
```

### Template Update Automation

```yaml
# GitHub Actions: auto-update and validate
name: Template Collection CI
on:
  push:
    branches: [main]
  pull_request:
    paths: ['**/*.yaml']

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Nuclei
        run: go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

      - name: Validate All Templates
        run: nuclei -t . -validate -v

      - name: Count Templates by Severity
        run: |
          echo "Critical: $(grep -rl 'severity: critical' --include='*.yaml' | wc -l)"
          echo "High: $(grep -rl 'severity: high' --include='*.yaml' | wc -l)"
          echo "Medium: $(grep -rl 'severity: medium' --include='*.yaml' | wc -l)"
          echo "Low: $(grep -rl 'severity: low' --include='*.yaml' | wc -l)"
          echo "Info: $(grep -rl 'severity: info' --include='*.yaml' | wc -l)"

      - name: Check for Duplicates
        run: |
          grep -rh '^id:' --include='*.yaml' | sort | uniq -d > dupes.txt
          if [ -s dupes.txt ]; then
            echo "Duplicate template IDs found:"
            cat dupes.txt
            exit 1
          fi
```

### Coverage Tracking

```bash
# List all MITRE ATT&CK techniques covered
grep -rh 'attack\.' templates/ --include='*.yaml' | sort -u

# Count by tag
for tag in sqli xss ssrf rce lfi misconfig exposure; do
  count=$(grep -rl "tags:.*$tag" templates/ --include='*.yaml' | wc -l)
  echo "$tag: $count templates"
done

# Find templates without classification
grep -rL 'classification:' templates/ --include='*.yaml'
```

## Workflow

### Step 1: Inventory Collection

```bash
node scripts/agent.js --action inventory --template-dir templates/ \
  --output /tmp/collection-inventory.json
```

### Step 2: Validate Collection

```bash
node scripts/agent.js --action validate --template-dir templates/ \
  --output /tmp/collection-validation.json
```

### Step 3: Generate Coverage Report

```bash
node scripts/agent.js --action coverage --template-dir templates/ \
  --output /tmp/coverage-report.json
```

## Verification

- [ ] Consistent directory structure across the collection
- [ ] All templates pass syntax validation
- [ ] No duplicate template IDs
- [ ] Tags follow established conventions
- [ ] Classification metadata complete for CVE templates
- [ ] `.nuclei-ignore` excludes non-production templates
- [ ] README documents collection scope and usage
- [ ] CI pipeline validates on every PR

## References

- [Nuclei Templates Repository](https://github.com/projectdiscovery/nuclei-templates)
- [Template Contributing Guide](https://github.com/projectdiscovery/nuclei-templates/blob/main/CONTRIBUTING.md)
- [PDTM — Template Manager](https://docs.projectdiscovery.io/tools/pdtm/)
