name: "Triage Prioritization"
category: assessment  # Current state: shows today's triage priorities regardless of time period
template: "triage_prioritization.html"
description: >
  Per-project vulnerability triage prioritization using a tiered-gates scoring model.
  Prioritizes findings based on reachability, exploitability, attack vector, EPSS, and CVSS.
  Gate 1: Reachable + Exploitable → CRITICAL. Gate 2: Not unreachable + NETWORK + EPSS > 90% → HIGH.
  Generates VEX triage recommendations (CRITICAL → IN_TRIAGE, unreachable → NOT_AFFECTED).
execution_order: 25  # After scans (10), alongside findings reports (20)
auto_run: false  # Only runs when explicitly requested with --recipe

parameters:
  top_components_limit: 15
  ai_prompt_bands:
    - CRITICAL

  # Gate definitions (DSL).  Evaluated in order; first match wins.
  # Override via --scoring-file with a top-level "gates:" key.
  gates:
    - name: GATE_1
      band: CRITICAL
      score: 100
      conditions:
        all:
          - field: reachability_score
            op: ">"
            value: 0
          - any:
              - field: has_exploit
                op: "=="
                value: true
              - field: in_kev
                op: "=="
                value: true

    - name: GATE_2
      band: HIGH
      score: 85
      conditions:
        all:
          - field: reachability_score
            op: ">="
            value: 0
          - field: attack_vector
            op: in
            value: ["NETWORK"]
          - field: epss_percentile
            op: ">"
            value: 0.9

  # Additive scoring weights (for findings that don't hit any gate)
  scoring_weights:
    reachable: 30
    unknown: 0
    unreachable: -15
    exploit: 25
    kev_only: 20
    vector_network: 15
    vector_adjacent: 10
    vector_local: 5
    vector_physical: 0
    epss_max: 20
    cvss_max: 10
    band_high_threshold: 70
    band_medium_threshold: 40
    band_low_threshold: 25
    vex_resolved: -50

query:
  endpoint: "/public/v0/findings"
  params:
    limit: 10000

transform_function: triage_prioritization_transform

output:
  table: true
  formats:
    - csv
    - xlsx
    - html
    - json
    - md
  charts:
    - name: band_distribution
      chart: bar
      title: "Priority Band Distribution"
      description: "Distribution of findings across risk priority bands (CRITICAL through INFO)."
      x_column: priority_band
      y_column: count
    - name: gate_funnel
      chart: bar
      title: "Gate Classification Funnel"
      description: "How findings flow through Gate 1 (Reachable+Exploit/KEV), Gate 2 (Not unreachable+NETWORK+EPSS>90%), and additive scoring."
      x_column: gate
      y_column: count
    - name: cvss_vs_band_heatmap
      chart: heatmap
      title: "CVSS Severity vs Priority Band"
      description: "Cross-tabulation showing how CVSS severity maps to triage priority bands. Highlights cases where CVSS alone would misclassify risk."
      x_column: priority_band
      y_column: severity
    - name: top_components
      chart: bar
      title: "Top 15 Riskiest Components"
      description: "Components with the highest triage scores, broken down by priority band."
      x_column: component_name
      y_column: avg_score
    - name: factor_radar
      chart: radar
      title: "Risk Factor Profiles by Project"
      description: "Radar chart comparing risk factor profiles across top projects."
      x_column: factor
      y_column: score
    - name: project_summary
      chart: bar
      title: "Project Risk Summary"
      description: "Per-project breakdown showing band counts and average triage scores."
      x_column: project_name
      y_column: total_findings
