Skip to content

I7 — CVE Triage + SLA Dashboard — Test Runbook

Asset: I7 — CVE triage runbook (docs/runbooks/vuln/cve-triage.md) + the vuln-triage Grafana dashboard (modules/azure/grafana-dashboards/dashboards/snowops-vuln-triage.json). Closes the I vulnerability series (I1–I6 + I7). Milestone: M4.

Part A — Offline gate (~3 min, $0)

The J5 dashboards-as-code gate covers the new vuln-triage dashboard.

cd modules/azure/grafana-dashboards
./scripts/validate.sh            # or: python3 scripts/validate_dashboards.py

Acceptance: - [ ] Gate reports the dashboard set valid, including snowops-vuln-triage.json. - [ ] It has the required datasource (Azure Monitor) + workspace template variables and every non-row panel binds to the Azure Monitor datasource with an Azure query (ARG for the Defender sub-assessments, Log Analytics for the SecurityRecommendation aging).

Part B — Process + dashboard review (~5 min, $0)

  • Read cve-triage.md. Confirm the SLA bands (Critical 7d / High 30d / Medium 90d) match the dashboard's panel-4 query (SlaDays = case(...High,7, ...Medium,30, 90)). If the SLA policy changes, both must change together.
  • Confirm the triage flow ties the scanners (I1–I6) → severity → owner → E7 ticket → remediate or D5 waiver → dashboard verification.
  • Dashboard sections: Open findings (by severity + top vulnerable resources, Azure Resource Graph over microsoft.security/assessments/subassessments) and SLA aging (oldest open + SLA-breaching over time, from the continuously-exported SecurityRecommendation table).

Part C — Live (requires Defender for Cloud + continuous export to the J1 workspace)

  1. Deploy the dashboard via the J5 path: 
    cd modules/azure/grafana-dashboards
./scripts/deploy-dashboards.sh <grafana-name> <rg> "$(terraform output -raw workspace_id)"
  2. Open the SnowOps — Vulnerability Triage & SLA dashboard; panels render (no Unauthorized — the J5 instance identity has Monitoring Reader).
  3. Findings-by-severity matches Defender for Cloud's recommendations blade.
  4. The SLA-aging panels require Defender continuous export of SecurityRecommendation to the J1 workspace — if those panels are empty, enable continuous export (J2 DINE initiative path) first; the offline gate only checks structure, not data presence.
  5. Walk one Critical finding through cve-triage.md end to end: triage → ticket (E7) → remediate or waive (D5) → confirm it clears the dashboard.

Notes

  • The dashboard is detection/tracking, not enforcement — remediation happens in the owning module/app; waivers live in waivers/ (D5).
  • SLA aging is approximated from min(TimeGenerated) per finding (first-seen in the workspace), stated as the mechanism — no fabricated discovery dates.