Finding Triage
Finding triage literacy — severity, exploitability stub, asset context, false positive check, remediation owner — structured triage rows on YOUR `$DEVSEC_LAB` scan output.
Visual · t36_finding_triage
Finding triage = named prioritization rows. $DEVSEC_LAB. Original Cyberlium.
Scanner noise drowns signal without triage — name severity and exploitability rows on YOUR lab findings before pushing panic fixes to prod without ticket.
Finding triage literacy names: scanner severity category, exploitability stub category (EPSS/CVE context literacy), asset context category (lab vs prod literacy), false positive check category, and remediation owner stub category. Analyst documents finding triage register on `$DEVSEC_LAB` — three findings from Modules 6–8 scans with triage row each — without creating unauthorized prod tickets from lab notes, without marking all findings critical for drama, without hiding false positives dishonestly. Cyberlium teaches professional triage vocabulary — YOUR notes. Refused: unauthorized prod tickets, severity inflation, dishonest FP dismissal. Lab row: finding triage register (three findings, severity, exploitability, owner stub).
1. Named triage rows
Severity, exploitability, asset context, false positive check, owner — five literacy anchors.
Each finding cites lab scan UTC — not speculation.
Command guide
Try these commands — Named triage rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SSDF RV.2 — https://csrc.nist.gov/Projects/ssdf Bridgecrew Checkov — https://www.checkov.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/findings/devsec-findings-template.md" <<'EOF'
# DevSec Finding — YOUR template
- **ID:** DEVSEC-FND-001
- **Source:** checkov / gitleaks / trivy / ZAP baseline
- **Asset:** YOUR sample-repo / iac/main.tf / container/Dockerfile
- **Severity:** HIGH (lab)
- **Description:** S3 public access block disabled (intentional lab misconfig)
- **Recommendation:** set block_public_* = true; restrict SG to RFC1918
- **Owner:** platform engineering
- **Due:** +14d
Finding types: secret leak | IaC misconfig | container CVE | DAST alert | SBOM gap
EOFCommand — copy this
grep -E 'DEVSEC-FND|Recommendation|checkov|trivy' "$DEVSEC_LAB/findings/devsec-findings-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SSDF RV.2 (https://csrc.nist.gov/Projects/ssdf); Bridgecrew Checkov (https://www.checkov.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. False positive discipline
FP check documented with rationale — not silent dismiss or accept-all.
Link Module 6 Checkov and Module 7 Trivy rows — same finding thread.
3. Refused
No unauthorized prod tickets; no severity inflation; no dishonest FP handling.
Triage literacy supports prioritization — not alert theater.
4. What you ship: finding triage register
Three findings + severity + exploitability + owner stub + NEVER unauthorized prod ticket line.
5. What you record before the next lesson
Finding triage register path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Mark every Checkov finding critical and create employer prod Jira tickets from unauthorized lab notes.
- Right: Finding triage register from `$DEVSEC_LAB` scans. Next: Policy as Code.
Mission: finding triage register
1) Name five triage literacy rows. 2) Three findings from Modules 6–8. 3) Severity and exploitability each. 4) Write NEVER unauthorized prod ticket line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “FP check — minimum rationale literacy?”
APPLY: Finding triage literacy uses:
APPLY: True or False: All scanner findings should be marked critical.
APPLY: Triage register includes: