Quilzomanual

Vulnerability prioritisation with KEV, EPSS, SSVC and VEX

What to work on, not sorted by severity alone.

In the adminVulnerabilities

The Vulnerabilities screen
Before anything is loaded, the screen says how to load it.

  1. Load what you run and what is known

    quilzo vuln import --bom sbom.json --where shop-api --osv osv/ --kev kev.json --epss epss.csv

  2. Say what you know about your machines

    quilzo vuln asset shop-api --exposure open --impact high --because "..."
quilzo vuln reach --source ./src --where shop-api

  3. Work the queue

    ToRun
    What to work onquilzo vuln queue
    The smallest upgrades that clear the mostquilzo vuln plan
    Leave one, until a datequilzo vuln accept CVE PKG --owner W --until DATE --because "..."
    Record that it does not apply, and whyquilzo vuln assess CVE-ID Go:example.com/lib not_affected --reason vulnerable_code_not_in_execute_path --because "..."
    Publish your decisions as OpenVEXquilzo vuln vex --author A --id URL