Risk-based vulnerability prioritisation and automation
You merge findings from different scanners and sources into one model, score risk with privilege-path and threat context, test the model against past incidents and automate ticketing and dashboards.
Level 401 · 14 lessons · 12 practice labs
Lessons
Data sources
- Merging data sources: scanners, agents, cloud and code scanning
- Normalising findings into one model
- Tracking component vulnerabilities with a software bill of materials
- Short task: convert the output of two scanners into one table
The risk model
- A risk scoring model: likelihood, impact and context
- Privilege-path context: which vulnerability leads to a critical asset
- Updating priority with threat intelligence
- Testing the model: looking back at past incidents
- Short task: build a risk scoring model for a fictional organisation
Automation
- Pulling results automatically through scanner APIs
- Opening and closing tickets automatically by rule
- Vulnerability dashboards: views per owner and team
- Rapid impact analysis for an urgent vulnerability advisory
- Capstone: build an end-to-end risk-based prioritisation pipeline
Practice labs
- Convert two scanners' output into one table: Map two differently formatted scan outputs to common fields and merge them into one CSV table.
- Deduplicate the same finding across sources: Find repeats of the same asset and CVE across scanner, agent and code-scan records and fold them into one.
- Find affected components from a software bill of materials: Match Göktaşı Yazılım's application SBOM against the vulnerability database and report affected components with versions.
- Build a simple risk score from likelihood, impact and context: Calculate risk scores for ten findings with the given weights and compare the order with the CVSS order.
- Promote vulnerabilities that lead to critical assets: Find paths to the critical database on the network map and raise the scores of findings on those paths.
- Backtest the risk model against past incidents: Find where the vulnerabilities behind Lodoskaya Denizcilik's past incidents ranked in the model and adjust the weights.
- Pull results automatically from the scanner API: Write a short script that pulls the latest scan's findings from the lab scanner API and saves them in the common model.
- Open and close tickets automatically by rule: Write and test a rule that opens tickets for new high-risk findings and closes them when a rescan shows the fix.
- Build a vulnerability dashboard per owner and team: Produce dashboard data showing open risk, overdue items and trend per team from the merged findings table.
- Find affected assets after an urgent advisory: Search the inventory for the advisory's product and versions and list affected assets.
- Split affected assets by external exposure: Separate internet-facing assets among those affected and write an urgent measure for each.
- Run the end-to-end risk-based prioritisation pipeline: Chain data pull, merge, scoring and ticketing, and verify the output with a new scan.
About this course
You merge findings from different scanners and sources into one model, score risk with privilege-path and threat context, test the model against past incidents and automate ticketing and dashboards.
What you will learn
- Data sources
- The risk model
- Automation
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.