# how to automate CVE notification triage

## TL;DR

Pull CVE feeds into one normalized list keyed by CVE ID, filter it against the software you actually run, and route only the exploited or reachable ones to a human. Everything else goes to a digest or gets suppressed with a logged reason. Automation does not decide patching; it decides what deserves a human's attention.

```text
how to automate CVE notification triage
```

## Use this when

- CVE notifications from scanners, vendors, and mailing lists exceed manual triage capacity
- The same CVE arrives from three sources and gets triaged three times
- You want exploited-in-the-wild CVEs to page someone within hours
- Leadership wants a defensible, repeatable intake process

## Not for this skill when

- You are triaging one specific CVE right now (triage it by hand, that is faster)
- You have no inventory of what you run (build that first; filtering needs it)
- You need the executive summary format (different skill, different audience)

## Steps

### 1. Pick your sources and one key

Use the OSV API for dependency-level matches, NVD for breadth, and the CISA known-exploited catalog for the page-worthy set. Key every record by CVE ID so duplicates collapse.

```bash
curl -s "https://api.osv.dev/v1/querybatch" -X POST -H "Content-Type: application/json" --data "[request-body]"
```

Expected: a JSON response with vulnerability records per queried package. Build the request body from your lockfiles; the exact shape is in the OSV API docs. NVD and CISA each get their own fetcher writing into the same normalized table.

### 2. Normalize into a single queue

Map every source into the same fields: CVE ID, product, affected versions, fixed version, severity, published date, and exploitation signal. Dedupe on CVE ID, keeping the richest record.

Expected: one row per CVE, no duplicates. If the same CVE still appears twice, your key is wrong; check for whitespace or case differences in the ID.

### 3. Filter against your real inventory

Drop anything whose product and version range does not match what you run. This is the step that kills most of the noise.

Expected: the queue shrinks dramatically, often by 80 percent or more. Everything filtered out gets logged with the reason, so the decision is auditable later.

### 4. Route by urgency, not by severity score

Route rules that work: on the CISA exploited list goes to the on-call channel immediately; critical severity plus reachable code path goes to the security queue same-day; everything else goes to the weekly digest.

Expected: pages stay rare and meaningful; the digest stays skimmable. If the on-call channel fires more than a couple of times a month, your routing is too loose.

### 5. Keep a suppression log with reasons

False positives and accepted risks get suppressed by rule, each with a reason and an expiry date. Suppressions auto-expire so nothing is ignored forever.

Expected: a suppression list you can show an auditor. No expiry on suppressions is how real vulns hide for years.

### Variant: dependabot alert flood specifically

Route Dependabot PRs through the same queue: auto-merge patch-level bumps with passing tests, batch minor bumps weekly, and only hand-triage majors and anything the scanner marks reachable.

### Variant: weekend zero-day intake

The exploited-list fetcher runs on a short interval and pages directly, bypassing the digest. One narrow rule, tested monthly with a synthetic entry, beats a general "watch everything" job.

## Why this happens

Every scanner and feed speaks a different schema and has a different opinion of severity, so humans end up re-normalizing the same CVE in their heads repeatedly. A single normalized queue with inventory filtering moves that normalization into code, which is consistent and never gets tired.

## Edge cases and pitfalls

- Transitive dependencies: your inventory must include the full dependency tree, not just direct deps.
- Feeds disagree on version ranges: keep the union and note the conflict rather than picking one blindly.
- Embargoed or brand-new CVEs lag in NVD by hours; the vendor advisory is the early source.
- Over-suppression: expiring suppressions and quarterly reviews keep the list honest.
- Alerting on CVSS alone pages people for unreachable criticals while missing exploited mediums; exploitation signal must outrank the score.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5e_akrh7XcRzv-ZelsB1RA