# Vulnerability Triage Agent

## Overview

The `vulnerability-triage-agent` provides intelligent vulnerability triage and prioritization. It embodies the expertise of a Senior Security Analyst for analyzing vulnerability context, deduplicating findings, assessing exploitability, and generating actionable remediation recommendations.

## Persona

| Attribute | Value |
|-----------|-------|
| **Role** | Senior Security Analyst |
| **Experience** | 10+ years in vulnerability management |
| **Background** | SOC operations, penetration testing |
| **Philosophy** | "Risk-based prioritization enables effective remediation" |

## Core Principles

1. **Context Matters** - Consider business context, not just CVSS
2. **Exploitability First** - Prioritize what attackers can exploit
3. **Compensating Controls** - Factor in existing mitigations
4. **Efficiency** - Deduplicate and consolidate findings
5. **Actionable Output** - Provide clear guidance

## Expertise Areas

| Area | Capabilities |
|------|--------------|
| **Analysis** | Context assessment, severity evaluation |
| **Deduplication** | Cross-tool correlation, consolidation |
| **Exploitability** | Public exploits, attack surface |
| **Controls** | Compensating control evaluation |
| **SLA Tracking** | Compliance monitoring, escalation |
| **Recommendations** | Prioritized remediation guidance |

## Usage

### Within Babysitter Processes

```javascript
// In a process file
const result = await ctx.task(triageTask, {
  agentName: 'vulnerability-triage-agent',
  prompt: {
    role: 'Senior Security Analyst',
    task: 'Triage vulnerability scan results',
    context: {
      findings: await getScanResults(),
      assetInventory: await getAssetContext(),
      existingControls: await getControlsData()
    },
    instructions: [
      'Deduplicate findings across tools',
      'Assess exploitability and business impact',
      'Factor in compensating controls',
      'Prioritize by risk and SLA',
      'Generate remediation recommendations'
    ],
    outputFormat: 'JSON'
  }
});
```

### Direct Invocation

```bash
# Triage SAST/DAST findings
/agent vulnerability-triage-agent triage \
  --findings ./scan-results.json \
  --asset-context ./asset-inventory.json

# Prioritize with EPSS
/agent vulnerability-triage-agent prioritize \
  --findings ./vulnerabilities.json \
  --include-epss \
  --include-kev

# Generate remediation plan
/agent vulnerability-triage-agent remediation-plan \
  --findings ./triaged.json \
  --team-capacity ./team-capacity.json

# SLA compliance report
/agent vulnerability-triage-agent sla-report \
  --findings ./all-vulns.json \
  --sla-policy ./sla-policy.yaml
```

## Common Tasks

### 1. Multi-Tool Triage

```bash
/agent vulnerability-triage-agent triage \
  --sast-results ./semgrep.json \
  --dast-results ./zap-report.json \
  --sca-results ./trivy.json \
  --deduplicate true \
  --output ./triaged-findings.json
```

Output includes:
- Deduplicated finding list
- Cross-tool correlation
- Confidence levels
- Unified priority ranking

### 2. Risk-Based Prioritization

```bash
/agent vulnerability-triage-agent prioritize \
  --findings ./scan-results.json \
  --asset-criticality ./assets.json \
  --compensating-controls ./controls.json \
  --include-epss true
```

Provides:
- Risk-adjusted priorities
- EPSS-enhanced scoring
- Compensating control impact
- Business context integration

### 3. Remediation Planning

```bash
/agent vulnerability-triage-agent plan-remediation \
  --findings ./triaged.json \
  --team-capacity 5 \
  --sprint-duration 2w
```

Delivers:
- Prioritized remediation backlog
- Effort estimates
- Assignment recommendations
- Dependency mapping

### 4. SLA Tracking

```bash
/agent vulnerability-triage-agent track-sla \
  --findings ./all-vulnerabilities.json \
  --sla-policy ./sla-policy.yaml \
  --alert-threshold 0.8
```

Reports:
- SLA compliance status
- At-risk findings
- Escalation recommendations
- Trend analysis

## Process Integration

### Processes Using This Agent

| Process | Agent Role |
|---------|------------|
| `vulnerability-management.js` | Core triage and prioritization |
| `sast-pipeline.js` | SAST finding analysis |
| `dast-scanning.js` | DAST finding analysis |
| `sca-management.js` | Dependency vulnerability triage |

### Task Definition Example

```javascript
import { defineTask } from '@a5c-ai/babysitter-sdk';

const triageVulnerabilitiesTask = defineTask({
  name: 'triage-vulnerabilities',
  description: 'Triage and prioritize security findings',

  async run(inputs, taskCtx) {
    return {
      kind: 'agent',
      title: `Triage vulnerabilities for ${inputs.projectName}`,
      agent: {
        name: 'vulnerability-triage-agent',
        prompt: {
          role: 'Senior Security Analyst',
          task: 'Analyze and triage vulnerability findings',
          context: {
            findings: inputs.scanResults,
            assetContext: inputs.assetInventory,
            compensatingControls: inputs.existingControls,
            slaPolicy: inputs.slaPolicy
          },
          instructions: [
            'Deduplicate findings across all scan tools',
            'Assess CVSS, EPSS, and exploitability for each',
            'Evaluate compensating controls impact',
            'Calculate risk-adjusted priority',
            'Generate remediation recommendations',
            'Track SLA compliance status'
          ],
          outputFormat: 'JSON'
        },
        outputSchema: {
          type: 'object',
          required: ['triageSummary', 'triagedFindings', 'recommendations'],
          properties: {
            triageSummary: { type: 'object' },
            triagedFindings: { type: 'array' },
            recommendations: { type: 'array' },
            slaStatus: { type: 'object' }
          }
        }
      },
      io: {
        inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
        outputJsonPath: `tasks/${taskCtx.effectId}/result.json`
      }
    };
  }
});
```

## Priority Framework

### Priority Levels

| Priority | Criteria | SLA | Actions |
|----------|----------|-----|---------|
| P1 | Critical + exploitable + exposed | 24h | Immediate fix, isolate |
| P2 | High + exploitable OR critical + internal | 7d | Urgent fix planned |
| P3 | Medium + no exploit OR high + controlled | 30d | Scheduled fix |
| P4 | Low + controlled | 90d | Monitor, backlog |
| P5 | Informational OR false positive | N/A | Accept or close |

### EPSS Integration

| CVSS | EPSS >= 0.5 | EPSS 0.1-0.5 | EPSS < 0.1 |
|------|-------------|--------------|------------|
| 9.0+ | P1 | P1 | P2 |
| 7.0-8.9 | P1 | P2 | P2 |
| 4.0-6.9 | P2 | P3 | P3 |
| < 4.0 | P3 | P4 | P4 |

## Deduplication Strategy

### Matching Criteria

| Match Type | Confidence | Criteria |
|------------|------------|----------|
| Strong | High | Same CVE, same file/line |
| Probable | Medium | Same vuln type, similar location |
| Possible | Low | Same category, review required |

### Consolidation Rules

1. **Prefer verified** - Prioritize exploitability-confirmed findings
2. **Highest severity** - Keep highest severity when merging
3. **Preserve evidence** - Combine evidence from all sources
4. **Track sources** - Document all reporting tools

## Interaction Guidelines

### What to Expect

- **Deep analysis** of vulnerability context
- **Risk-adjusted** prioritization
- **Clear recommendations** with reasoning
- **SLA awareness** for compliance tracking

### Best Practices

1. Provide asset inventory for context
2. Include compensating control information
3. Share SLA policies for tracking
4. Include business criticality data

## Knowledge Base

### CVSS Score Interpretation

| Score | Severity | Typical Action |
|-------|----------|----------------|
| 9.0-10.0 | Critical | Immediate |
| 7.0-8.9 | High | Priority |
| 4.0-6.9 | Medium | Scheduled |
| 0.1-3.9 | Low | Backlog |

### Compensating Controls Impact

| Control | Mitigation | Risk Reduction |
|---------|------------|----------------|
| WAF | Injection attacks | 30% |
| MFA | Auth attacks | 70% |
| Network segmentation | Lateral movement | 40% |
| IDS/IPS | Known patterns | 20% |

## Related Resources

- [sast-analyzer skill](../../skills/sast-analyzer/) - SAST scanning
- [dast-scanner skill](../../skills/dast-scanner/) - DAST scanning
- [dependency-scanner skill](../../skills/dependency-scanner/) - SCA
- [threat-modeling-agent](../threat-modeling-agent/) - Threat analysis

## References

- [FIRST EPSS](https://www.first.org/epss/)
- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NIST NVD](https://nvd.nist.gov/)
- [CWE Database](https://cwe.mitre.org/)

## Version History

| Version | Date | Changes |
|---------|------|---------|
| 1.0.0 | 2026-01-24 | Initial release |

---

**Backlog ID:** AG-SEC-001
**Category:** Vulnerability Management
**Status:** Active
