<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-vulnerability-prioritization
description: >-
  Prioritize vulnerabilities using CVSS, EPSS, SSVC, KEV, and asset criticality
  scoring. Combines exploit prediction, threat intelligence context, and business
  impact to rank remediation order beyond raw severity scores.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - vulnerability-prioritization
  - cvss
  - epss
  - ssvc
  - kev
  - risk-scoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Vulnerability Prioritization

## Overview

Raw CVSS scores alone produce alert fatigue — most environments have thousands of
Critical/High findings. Effective prioritization layers exploit probability (EPSS),
known exploitation status (CISA KEV), stakeholder-specific decision trees (SSVC),
and asset criticality to surface the vulnerabilities that actually matter.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling and EPSS API queries |
| Nessus Professional | `nessuscli update --all` |
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| jq | `apt install jq` or `brew install jq` |
| curl | HTTP client for EPSS/KEV APIs |

## Key Concepts

### EPSS — Exploit Prediction Scoring System

EPSS provides a probability (0–1) that a CVE will be exploited in the wild within
30 days. Query the FIRST EPSS API:

```bash
# Single CVE lookup
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

# Bulk lookup (comma-separated)
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-3400,CVE-2023-44228" \
  | jq '.data[] | {cve, epss, percentile}'

# All CVEs above 0.5 probability
curl -s "https://api.first.org/data/v1/epss?epss-gt=0.5&limit=100" | jq '.data'
```

### CISA KEV — Known Exploited Vulnerabilities

```bash
# Download current KEV catalog
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" \
  -o kev_catalog.json

# Check if a CVE is in KEV
jq '.vulnerabilities[] | select(.cveID == "CVE-2024-3400")' kev_catalog.json

# Count KEV entries by vendor
jq '[.vulnerabilities[].vendorProject] | group_by(.) | map({vendor: .[0], count: length}) | sort_by(-.count) | .[:10]' kev_catalog.json
```

### SSVC — Stakeholder-Specific Vulnerability Categorization

SSVC decision trees replace numeric scores with action-oriented outcomes:

| Decision Point | Values |
|---|---|
| Exploitation | None / PoC / Active |
| Automatable | No / Yes |
| Technical Impact | Partial / Total |
| Mission Prevalence | Minimal / Support / Essential |

Outcomes: **Defer**, **Scheduled**, **Out-of-Cycle**, **Immediate**

### Combined Priority Score

```python
def calculate_priority(cvss: float, epss: float, in_kev: bool, asset_tier: int) -> float:
    """Weighted priority: EPSS 40%, CVSS-normalized 20%, KEV 25%, Asset 15%."""
    kev_score = 1.0 if in_kev else 0.0
    asset_score = {1: 1.0, 2: 0.7, 3: 0.4, 4: 0.1}.get(asset_tier, 0.1)
    return (epss * 0.40) + ((cvss / 10) * 0.20) + (kev_score * 0.25) + (asset_score * 0.15)
```

### Nessus Export and Enrichment

```bash
# Export scan results via Nessus API
curl -sk -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/export" \
  -d 'format=csv' -o scan_results.csv

# Parse CVEs from Nessus CSV and enrich with EPSS
awk -F',' '{print $2}' scan_results.csv | grep '^CVE-' | sort -u | \
  xargs -I{} curl -s "https://api.first.org/data/v1/epss?cve={}" | \
  jq -r '.data[] | [.cve, .epss, .percentile] | @tsv'
```

### nuclei Severity Filtering

```bash
# Scan and filter by critical+high only
nuclei -u https://target.example.com -severity critical,high -json -o high_findings.json

# Tag-based scan for known-exploited templates
nuclei -u https://target.example.com -tags kev -json -o kev_findings.json
```

## Workflow

1. **Collect** — Export vulnerability scan results (Nessus CSV, OpenVAS XML, nuclei JSON)
2. **Enrich** — Query EPSS scores, KEV status, and asset inventory for each CVE
3. **Score** — Calculate combined priority using weighted formula
4. **Classify** — Apply SSVC decision tree for action categories
5. **Rank** — Sort by priority score descending; group by remediation owner
6. **Report** — Generate prioritized remediation list with SLA deadlines

## Detection

```yaml
title: Vulnerability Prioritization Detection
id: cd949809-ae72-4fc3-9b7b-935827d0d222
status: experimental
description: Detects suspicious activity related to implementing vulnerability prioritization techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*vulnerability*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| EPSS data current | API `date` field is within last 24 hours |
| KEV catalog fresh | `curl -sI` shows `Last-Modified` within 7 days |
| All CVEs enriched | No CVEs in scan results missing EPSS/KEV lookup |
| Priority scores valid | All scores between 0.0 and 1.0 |
| SSVC outcomes assigned | Every finding has Defer/Scheduled/Out-of-Cycle/Immediate |

## References

- [FIRST EPSS API](https://www.first.org/epss/api)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA SSVC Guide](https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc)
- [CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)
