Vulnerability Triage — Multi-Signal Workflow Assignment

Overview

This playbook automatically triages incoming Vulnerability entities using three contextual signals — EPSS score, threat actor and malware relationships, and CISA KEV status combined with CVSS severity — and assigns one of four workflow statuses: Act, Track, Scheduled, or Out-of-cycle. It is designed for security teams who want to automate first-pass vulnerability prioritisation based on additonal threat context rather than severity scores alone. The example triage logic follows a broadly SSVC-inspired approach, escalating to Act when a vulnerability is actively exploited or threat-linked, and de-prioritising lower-risk items to Track or Scheduled.

The four workflow statuses and the thresholds used at each decision point are fully configurable — teams should review and adapt the logic to match their own vulnerability management programme before activating the playbook.

---

Dependencies

The following workflow statuses must exist in the target OpenCTI environment before the playbook can function. These are applied to Vulnerability entities and must be created under Settings > Workflow if they do not already exist:

Status Label	Used When
Act	EPSS ≥ 0.8, or vulnerability is threat-linked, or in CISA KEV with CRITICAL/HIGH CVSS
Track	Not in CISA KEV, with LOW or MEDIUM CVSS severity
Scheduled	Not in CISA KEV, with HIGH or CRITICAL CVSS severity (but no other escalation signal)
Out-of-cycle	In CISA KEV but with LOW or MEDIUM CVSS severity

The status labels above reflect the default configuration. If your environment uses different status names, you can adapt the playbook nodes accordingly — see How to Use It below.

---

How to Use It

A. Import and configure

Import the playbook via Automation > Playbooks using the JSON file. Once imported, open the playbook editor and locate the six Set Status nodes. Each node contains a placeholder workflow status ID that must be replaced before the playbook will function:

Placeholder	Status to map	Nodes affected
REPLACE-WITH-ACT-STATUS-ID	Act	Set Status — Act (High EPSS), Set Status — Act (Threat-Linked), Set Status — Act (KEV Critical/High)
REPLACE-WITH-TRACK-STATUS-ID	Track	Set Status — Track
REPLACE-WITH-SCHEDULED-STATUS-ID	Scheduled	Set Status — Scheduled
REPLACE-WITH-OUT-OF-CYCLE-STATUS-ID	Out-of-cycle	Set Status — Out-of-cycle

B. Adapting the triage logic to your programme

The playbook is designed to be modified. Before activating, review each decision point against your organisation's vulnerability management policy:

• EPSS threshold — The default threshold is 0.8 (top ~5% of exploitability probability). If your programme uses a lower threshold, update the value in the Filter — EPSS Score Below Threshold node.
• Threat relationship types — The default checks for relationships to Malware, Threat-Actor-Group, Threat-Actor-Individual, and Intrusion-Set. If your programme also considers Campaign or Tool relationships as escalation signals, add these to the Filter — Related to Threat Actor or Malware node.
• CVSS severity bands — The default splits LOW/MEDIUM from HIGH/CRITICAL. If your programme treats HIGH and CRITICAL differently (e.g. HIGH → Scheduled, CRITICAL → Act), you can split the CVSS filter nodes and add additional branches.
• Workflow status names — If your environment uses different status labels (e.g. P1/P2/P3, or Immediate/Deferred), update both the status IDs and the label values in each Set Status node to match.
• Trigger scope — The playbook currently fires on both create and update events. If you only want to triage newly ingested vulnerabilities and not re-triage on every update, disable the update trigger in the Listen for Vulnerability Events node.

C. Activate the playbook

Once all placeholder IDs have been replaced and the logic reviewed, activate the playbook using the toggle in the playbook editor. No further manual interaction is required — the playbook will process Vulnerability entities automatically as they are created or updated.

---

Expected Outcome

Once active, every Vulnerability entity that enters or is updated in OpenCTI will be evaluated against the triage logic and assigned a workflow status. The table below summarises the routing:

Signal	Condition	Status assigned
EPSS score	≥ 0.8	Act
Threat relationships	Linked to Malware, Threat Actor, or Intrusion Set	Act
CISA KEV + CVSS	In KEV and CRITICAL or HIGH	Act
CISA KEV + CVSS	In KEV and LOW or MEDIUM	Out-of-cycle
Not in KEV + CVSS	Not in KEV and LOW or MEDIUM	Track
Not in KEV + CVSS	Not in KEV and HIGH or CRITICAL	Scheduled

Where to verify:

• Navigate to Analysis > Vulnerabilities and filter by workflow status to confirm entities are being assigned correctly.
• Check the Playbook execution history in the playbook editor to confirm the playbook is firing and processing entities without errors.

---

Performance Considerations

This playbook fires on every Vulnerability create and update event. In environments with high-volume vulnerability feeds, this may generate significant playbook execution load. If performance is a concern, consider restricting the trigger to create events only, or adding a creator filter to limit the trigger to specific ingestion sources.

---

Extending the Playbook

This playbook assigns workflow statuses but takes no further action. Depending on your programme, you may want to chain additional playbooks or actions after triage:

• Notification — Trigger a notification or ticket creation when a vulnerability is assigned Act status.
• Enrichment — Automatically enrich Act-status vulnerabilities with additional connector data (e.g. exploit availability, patch information).
• Case creation — Promote Act-status vulnerabilities into an IR Case for tracked remediation (see the companion Vulnerability Promotion — IR Case Creation playbook).
• Reporting — Use the workflow status as a filter in dashboards or scheduled reports to give stakeholders a live view of the vulnerability backlog by priority tier.