Cloud Vulnerability Triage & Contextualization

Objective: Triage top critical/high SCC vulnerability findings for a given project (${PROJECT_ID}). Enrich the CVEs with GTI, check for related exploitation activity in SIEM, and summarize findings for remediation prioritization, potentially adding context to a SOAR case.

Uses Tools:

• scc-mcp.top_vulnerability_findings
• scc-mcp.get_finding_remediation
• gti-mcp_search_vulnerabilities (or get_threat_intel for CVE summary)
• secops-mcp_search_security_events
• secops-mcp_lookup_entity (for affected resource)
• soar-mcp_post_case_comment (optional)
• You may ask follow up question (optional)

ADK Graph-Based Workflow Diagram

graph TD
    START(["START"]) --> extract_vuln_node["1. extract_vuln_node<br/><i>(Extract SCC Finding Payload)</i>"]
    extract_vuln_node --> query_scc_findings_node["2. query_scc_findings_node<br/><i>(SCC Findings & CVE Exploitability)</i>"]
    query_scc_findings_node --> vuln_severity_router{"3. vuln_severity_router<br/><i>(Event.actions.route)</i>"}

    vuln_severity_router -- "IMMEDIATE_PATCH" --> handle_immediate_patch_branch["4a. handle_immediate_patch_branch<br/><i>(Emergency Patch & Isolation)</i>"]
    vuln_severity_router -- "STANDARD_REMEDIATION" --> handle_standard_remediation_branch["4b. handle_standard_remediation_branch<br/><i>(Standard Patch Schedule)</i>"]

    handle_immediate_patch_branch --> document_vuln_report_node["5. document_vuln_report_node<br/><i>(SOAR Comment & Report Summary)</i>"]
    handle_standard_remediation_branch --> document_vuln_report_node

Sequence Diagram

sequenceDiagram
    participant User
    participant AutomatedAgent as Automated Agent (MCP Client)
    participant SCC as scc-mcp
    participant GTI as gti-mcp
    participant SIEM as secops-mcp
    participant SOAR as secops-soar %% Underlying tool for documentation
    participant ConfirmAction as skills/common/confirm-action/SKILL.md
    participant DocumentInSOAR as skills/common/document-in-soar/SKILL.md

    User->>AutomatedAgent: Triage top vulnerabilities for project `${PROJECT_ID}`
    AutomatedAgent->>SCC: top_vulnerability_findings(project_id=`${PROJECT_ID}`, max_findings=5)
    SCC-->>AutomatedAgent: List of Top Findings (F1, F2... with CVE, Resource, Score)

    Note over AutomatedAgent: Initialize triage_report
    loop For each Finding Fi
        Note over AutomatedAgent: Extract CVE Ci and Resource Ri from Finding Fi
        AutomatedAgent->>SCC: get_finding_remediation(finding_id=Fi_ID)
        SCC-->>AutomatedAgent: Remediation Steps for Fi
        Note over AutomatedAgent: Add remediation to triage_report

        AutomatedAgent->>GTI: search_vulnerabilities(query=Ci)
        GTI-->>AutomatedAgent: GTI details for CVE Ci (Exploitation status, related threats)
        Note over AutomatedAgent: Add GTI context to triage_report

        AutomatedAgent->>SIEM: lookup_entity(entity_value=Ri, hours_back=168) %% Check resource activity (e.g., IP/hostname) for 7 days
        SIEM-->>AutomatedAgent: SIEM Summary for Resource Ri
        Note over AutomatedAgent: Add resource activity summary to triage_report

        AutomatedAgent->>SIEM: search_security_events(text="Events related to CVE Ci or exploitation attempts on Ri", hours_back=168)
        SIEM-->>AutomatedAgent: Potential exploitation events
        Note over AutomatedAgent: Add relevant event findings to triage_report
    end

    Note over AutomatedAgent: Synthesize triage_report with findings, context, and prioritization based on Score/GTI/SIEM data

    %% Optional: Confirm SOAR Update
    AutomatedAgent->>ConfirmAction: Execute(Input: QUESTION_TEXT="Triage complete...", RESPONSE_OPTIONS=...)
    ConfirmAction-->>AutomatedAgent: Results: USER_RESPONSE

    %% Optional: Document in SOAR
    alt USER_RESPONSE contains "Yes" %% Assumes format "Yes, Case [ID]"
        Note over AutomatedAgent: Extract CASE_ID from USER_RESPONSE
        Note over AutomatedAgent: Prepare COMMENT_TEXT for SOAR
        AutomatedAgent->>DocumentInSOAR: Execute(Input: CASE_ID, COMMENT_TEXT="SCC Vuln Triage Summary...")
        DocumentInSOAR-->>AutomatedAgent: Results: COMMENT_POST_STATUS
    end

    AutomatedAgent->>AutomatedAgent: attempt_completion(result="Cloud vulnerability triage for project `${PROJECT_ID}` complete. Findings synthesized. SOAR case potentially updated.")

## Rubrics

The following rubric is used to evaluate the execution of this **Triage/Response** runbook by an LLM agent.

### Grading Scale (0-100 Points)

| Criteria | Points | Description |
| :--- | :--- | :--- |
| **Context & Enrichment** | 25 | Correctly extracted entities and enriched them with relevant context (GTI, SIEM). |
| **Analysis & Decision** | 25 | Analyzed the enriched data to make a sound decision (FP/TP, Escalate/Close). |
| **Action Execution** | 20 | Performed the required response actions (e.g., isolation, containment) correctly. |
| **Documentation** | 15 | Clearly documented findings and actions in the case/ticket. |
| **Operational Artifacts** | 15 | Produced required artifacts: Sequence diagram, execution metadata (date/cost), and summary. |

### Evaluation Criteria Details

#### 1. Context & Enrichment (25 Points)
- **10 pts**: Accurately extracted key entities (IPs, users, hashes) from the input.
- **15 pts**: Performed necessary enrichment (e.g., `enrich_ioc`) to gather reputation and history.

#### 2. Analysis & Decision (25 Points)
- **15 pts**: Interpreted the context correctly to determine the nature of the alert.
- **10 pts**: Reached a logical conclusion or next step (e.g., "Escalate to Tier 2" or "Isolate Host").

#### 3. Action Execution (20 Points)
- **10 pts**: Called the correct tools to perform response actions (if applicable) or investigative steps.
- **10 pts**: Verified the success of actions or handled errors appropriately.

#### 4. Documentation (15 Points)
- **15 pts**: Posted a comprehensive comment or update to the SOAR case summarizing the triage.

#### 5. Operational Artifacts (15 Points)
- **5 pts**: **Sequence Diagram**: Produced a Mermaid sequence diagram visualizing the steps taken.
- **5 pts**: **Execution Metadata**: Recorded the date, duration, and estimated token cost.
- **5 pts**: **Summary Report**: Generated a concise summary of the actions and outcomes.