[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFF3Y15DGQ07S7NRDFRPAR":3,"skill-same:01M6AFF3Y15DGQ07S7NRDFRPAR":126},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AFF3Y15DGQ07S7NRDFRPAR","implementing-vulnerability-sla-breach-alerting",null,"Build an automated SLA breach alerting system for vulnerability remediation, including a database schema for SLA tracking, breach detection logic, notification dispatch, a scheduled check runner, and a KPI\u002Fcompliance metrics dashboard. Use when implementing severity-based SLA timelines (critical\u002Fhigh\u002Fmedium\u002Flow), detecting and escalating SLA breaches, or building vulnerability remediation compliance reporting.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"sla","implementing vulnerability sla breach alerting","alerting","metrics","database","reporting","compliance","escalation","severity","cybersecurity","kpi","vulnerability-management","remediation","detection","vulnerability-sla","remediation-tracking","sla-breach","dashboard","2026-11-10 10:12:30",false,"---\nname: implementing-vulnerability-sla-breach-alerting\ndescription: Build an automated SLA breach alerting system for vulnerability remediation,\n  including a database schema for SLA tracking, breach detection logic, notification\n  dispatch, a scheduled check runner, and a KPI\u002Fcompliance metrics dashboard. Use\n  when implementing severity-based SLA timelines (critical\u002Fhigh\u002Fmedium\u002Flow), detecting\n  and escalating SLA breaches, or building vulnerability remediation compliance reporting.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- vulnerability-sla\n- remediation-tracking\n- alerting\n- compliance\n- sla-breach\n- vulnerability-management\n- escalation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n\n# Implementing Vulnerability SLA Breach Alerting\n\n## Overview\n\nVulnerability remediation SLAs define maximum timeframes for addressing security findings based on severity. This skill covers building an automated alerting system that tracks remediation timelines, detects SLA breaches, sends escalation notifications, and generates compliance reports. Industry-standard SLA targets are: Critical (24-48 hours), High (15-30 days), Medium (60 days), Low (90 days).\n\n\n## When to Use\n\n- When deploying or configuring implementing vulnerability sla breach alerting capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `jinja2`, `smtplib` libraries\n- Vulnerability management platform with API access (DefectDojo, Qualys, Tenable)\n- SMTP server or webhook endpoint (Slack, Microsoft Teams, PagerDuty)\n- Database for SLA tracking (PostgreSQL or SQLite)\n\n## SLA Policy Definition\n\n### Standard SLA Tiers\n\n| Severity | Remediation SLA | Grace Period | Escalation Level |\n|----------|----------------|--------------|-----------------|\n| Critical (CVSS 9.0-10.0) | 48 hours | 12 hours | VP Engineering + CISO |\n| High (CVSS 7.0-8.9) | 15 days | 5 days | Director of Engineering |\n| Medium (CVSS 4.0-6.9) | 60 days | 14 days | Team Lead |\n| Low (CVSS 0.1-3.9) | 90 days | 30 days | Asset Owner |\n\n### SLA Configuration File\n\n```yaml\n# sla_policy.yaml\nsla_tiers:\n  critical:\n    cvss_min: 9.0\n    cvss_max: 10.0\n    remediation_days: 2\n    grace_period_days: 0.5\n    escalation_contacts:\n      - ciso@company.com\n      - vp-engineering@company.com\n    pagerduty_severity: critical\n  high:\n    cvss_min: 7.0\n    cvss_max: 8.9\n    remediation_days: 15\n    grace_period_days: 5\n    escalation_contacts:\n      - security-director@company.com\n    pagerduty_severity: high\n  medium:\n    cvss_min: 4.0\n    cvss_max: 6.9\n    remediation_days: 60\n    grace_period_days: 14\n    escalation_contacts:\n      - team-lead@company.com\n    pagerduty_severity: warning\n  low:\n    cvss_min: 0.1\n    cvss_max: 3.9\n    remediation_days: 90\n    grace_period_days: 30\n    escalation_contacts:\n      - asset-owner@company.com\n    pagerduty_severity: info\n\nnotification_channels:\n  slack:\n    webhook_url: \"${SLACK_WEBHOOK_URL}\"\n    channel: \"#vulnerability-alerts\"\n  email:\n    smtp_host: smtp.company.com\n    smtp_port: 587\n    from_address: vuln-alerts@company.com\n  pagerduty:\n    api_key: \"${PAGERDUTY_API_KEY}\"\n    service_id: \"${PAGERDUTY_SERVICE_ID}\"\n\nalert_schedules:\n  approaching_breach:\n    percentage_elapsed: 80\n    frequency_hours: 24\n  at_breach:\n    notification: immediate\n    escalation: true\n  post_breach:\n    frequency_hours: 12\n    escalation_increase: true\n```\n\n## Workflow\n\n### Step 1: Database Schema for SLA Tracking\n\n```sql\nCREATE TABLE vulnerability_sla (\n    id SERIAL PRIMARY KEY,\n    cve_id VARCHAR(20) NOT NULL,\n    finding_id VARCHAR(100) NOT NULL,\n    asset_hostname VARCHAR(255),\n    severity VARCHAR(20) NOT NULL,\n    cvss_score DECIMAL(3,1),\n    discovered_at TIMESTAMP NOT NULL,\n    sla_deadline TIMESTAMP NOT NULL,\n    remediated_at TIMESTAMP,\n    status VARCHAR(20) DEFAULT 'open',\n    owner_email VARCHAR(255),\n    escalation_level INTEGER DEFAULT 0,\n    last_alert_sent TIMESTAMP,\n    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE INDEX idx_sla_status ON vulnerability_sla(status);\nCREATE INDEX idx_sla_deadline ON vulnerability_sla(sla_deadline);\nCREATE INDEX idx_sla_severity ON vulnerability_sla(severity);\n```\n\n### Step 2: SLA Breach Detection Logic\n\n```python\nfrom datetime import datetime, timedelta, timezone\nimport yaml\n\ndef load_sla_policy(policy_path=\"sla_policy.yaml\"):\n    with open(policy_path, \"r\") as f:\n        return yaml.safe_load(f)\n\ndef get_sla_tier(cvss_score, policy):\n    for tier_name, tier in policy[\"sla_tiers\"].items():\n        if tier[\"cvss_min\"] \u003C= cvss_score \u003C= tier[\"cvss_max\"]:\n            return tier_name, tier\n    return \"low\", policy[\"sla_tiers\"][\"low\"]\n\ndef calculate_sla_deadline(discovered_at, cvss_score, policy):\n    tier_name, tier = get_sla_tier(cvss_score, policy)\n    deadline = discovered_at + timedelta(days=tier[\"remediation_days\"])\n    return deadline, tier_name\n\ndef check_sla_status(discovered_at, sla_deadline, remediated_at=None):\n    now = datetime.now(timezone.utc)\n    if remediated_at:\n        if remediated_at \u003C= sla_deadline:\n            return \"remediated_within_sla\"\n        return \"remediated_breach\"\n    if now > sla_deadline:\n        overdue_days = (now - sla_deadline).days\n        return f\"breached_{overdue_days}d_overdue\"\n    remaining = sla_deadline - now\n    total_sla = sla_deadline - discovered_at\n    pct_elapsed = ((total_sla - remaining) \u002F total_sla) * 100\n    if pct_elapsed >= 80:\n        return \"approaching_breach\"\n    return \"within_sla\"\n```\n\n### Step 3: Notification Dispatch\n\n```python\nimport requests\nimport json\nimport smtplib\nfrom email.mime.text import MIMEText\nfrom email.mime.multipart import MIMEMultipart\n\ndef send_slack_alert(webhook_url, vuln_data, sla_status):\n    color = {\"breached\": \"#FF0000\", \"approaching_breach\": \"#FFA500\", \"within_sla\": \"#36A64F\"}\n    status_color = color.get(\"breached\" if \"breached\" in sla_status else sla_status, \"#808080\")\n    payload = {\n        \"attachments\": [{\n            \"color\": status_color,\n            \"title\": f\"Vulnerability SLA Alert: {vuln_data['cve_id']}\",\n            \"fields\": [\n                {\"title\": \"Severity\", \"value\": vuln_data[\"severity\"], \"short\": True},\n                {\"title\": \"CVSS\", \"value\": str(vuln_data[\"cvss_score\"]), \"short\": True},\n                {\"title\": \"Asset\", \"value\": vuln_data[\"asset_hostname\"], \"short\": True},\n                {\"title\": \"SLA Status\", \"value\": sla_status, \"short\": True},\n                {\"title\": \"Deadline\", \"value\": vuln_data[\"sla_deadline\"].strftime(\"%Y-%m-%d %H:%M UTC\"), \"short\": True},\n                {\"title\": \"Owner\", \"value\": vuln_data.get(\"owner_email\", \"Unassigned\"), \"short\": True},\n            ],\n        }]\n    }\n    requests.post(webhook_url, json=payload, timeout=10)\n\ndef send_pagerduty_alert(api_key, service_id, vuln_data, severity):\n    payload = {\n        \"routing_key\": api_key,\n        \"event_action\": \"trigger\",\n        \"payload\": {\n            \"summary\": f\"SLA Breach: {vuln_data['cve_id']} on {vuln_data['asset_hostname']}\",\n            \"severity\": severity,\n            \"source\": vuln_data[\"asset_hostname\"],\n            \"custom_details\": {\n                \"cve_id\": vuln_data[\"cve_id\"],\n                \"cvss_score\": vuln_data[\"cvss_score\"],\n                \"sla_deadline\": vuln_data[\"sla_deadline\"].isoformat(),\n            }\n        }\n    }\n    requests.post(\n        \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\",\n        json=payload, timeout=10\n    )\n\ndef send_email_alert(smtp_config, to_addresses, vuln_data, sla_status):\n    msg = MIMEMultipart(\"alternative\")\n    msg[\"Subject\"] = f\"[SLA {sla_status.upper()}] {vuln_data['cve_id']} - {vuln_data['severity']}\"\n    msg[\"From\"] = smtp_config[\"from_address\"]\n    msg[\"To\"] = \", \".join(to_addresses)\n    body = f\"\"\"\n    Vulnerability SLA Alert\n\n    CVE: {vuln_data['cve_id']}\n    Severity: {vuln_data['severity']} (CVSS {vuln_data['cvss_score']})\n    Asset: {vuln_data['asset_hostname']}\n    SLA Deadline: {vuln_data['sla_deadline'].strftime('%Y-%m-%d %H:%M UTC')}\n    Status: {sla_status}\n    Owner: {vuln_data.get('owner_email', 'Unassigned')}\n\n    Please take immediate action to remediate this vulnerability.\n    \"\"\"\n    msg.attach(MIMEText(body, \"plain\"))\n    with smtplib.SMTP(smtp_config[\"smtp_host\"], smtp_config[\"smtp_port\"]) as server:\n        server.starttls()\n        server.send_message(msg)\n```\n\n### Step 4: Scheduled SLA Check Runner\n\n```bash\n# Run SLA breach check every hour via cron\necho \"0 * * * * cd \u002Fopt\u002Fvuln-sla && python3 scripts\u002Fprocess.py --check-sla\" | crontab -\n\n# Manual check\npython3 scripts\u002Fprocess.py --check-sla --policy sla_policy.yaml\n\n# Generate SLA compliance report\npython3 scripts\u002Fprocess.py --report --period monthly --output sla_report.html\n```\n\n## SLA Metrics Dashboard\n\n### Key Performance Indicators\n\n```python\ndef calculate_sla_metrics(db_connection, period_start, period_end):\n    metrics = {\n        \"total_findings\": 0,\n        \"remediated_within_sla\": 0,\n        \"sla_breach_count\": 0,\n        \"mean_time_to_remediate\": {},\n        \"sla_compliance_rate\": 0.0,\n        \"current_overdue\": 0,\n    }\n    # Query findings in period grouped by severity\n    query = \"\"\"\n        SELECT severity, COUNT(*) as total,\n               SUM(CASE WHEN remediated_at \u003C= sla_deadline THEN 1 ELSE 0 END) as within_sla,\n               AVG(EXTRACT(EPOCH FROM (COALESCE(remediated_at, NOW()) - discovered_at))\u002F86400) as avg_days\n        FROM vulnerability_sla\n        WHERE discovered_at BETWEEN %s AND %s\n        GROUP BY severity\n    \"\"\"\n    return metrics\n```\n\n## References\n\n- [Vulnerability Management SLAs Guide](https:\u002F\u002Fhostedscan.com\u002Fblog\u002Fvulnerability-management-slas-guide)\n- [NIST SP 800-40 Rev 4 - Patch Management](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-40\u002Frev-4\u002Ffinal)\n- [PagerDuty Events API v2](https:\u002F\u002Fdeveloper.pagerduty.com\u002Fapi-reference\u002Fa7d81b0e9200f-send-an-event-to-pager-duty)\n- [Slack Incoming Webhooks](https:\u002F\u002Fapi.slack.com\u002Fmessaging\u002Fwebhooks)\n","# Implementing Vulnerability SLA Breach Alerting\n\n## Overview\n\nVulnerability remediation SLAs define maximum timeframes for addressing security findings based on severity. This skill covers building an automated alerting system that tracks remediation timelines, detects SLA breaches, sends escalation notifications, and generates compliance reports. Industry-standard SLA targets are: Critical (24-48 hours), High (15-30 days), Medium (60 days), Low (90 days).\n\n\n## When to Use\n\n- When deploying or configuring implementing vulnerability sla breach alerting capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `pandas`, `jinja2`, `smtplib` libraries\n- Vulnerability management platform with API access (DefectDojo, Qualys, Tenable)\n- SMTP server or webhook endpoint (Slack, Microsoft Teams, PagerDuty)\n- Database for SLA tracking (PostgreSQL or SQLite)\n\n## SLA Policy Definition\n\n### Standard SLA Tiers\n\n| Severity | Remediation SLA | Grace Period | Escalation Level |\n|----------|----------------|--------------|-----------------|\n| Critical (CVSS 9.0-10.0) | 48 hours | 12 hours | VP Engineering + CISO |\n| High (CVSS 7.0-8.9) | 15 days | 5 days | Director of Engineering |\n| Medium (CVSS 4.0-6.9) | 60 days | 14 days | Team Lead |\n| Low (CVSS 0.1-3.9) | 90 days | 30 days | Asset Owner |\n\n### SLA Configuration File\n\n```yaml\n# sla_policy.yaml\nsla_tiers:\n  critical:\n    cvss_min: 9.0\n    cvss_max: 10.0\n    remediation_days: 2\n    grace_period_days: 0.5\n    escalation_contacts:\n      - ciso@company.com\n      - vp-engineering@company.com\n    pagerduty_severity: critical\n  high:\n    cvss_min: 7.0\n    cvss_max: 8.9\n    remediation_days: 15\n    grace_period_days: 5\n    escalation_contacts:\n      - security-director@company.com\n    pagerduty_severity: high\n  medium:\n    cvss_min: 4.0\n    cvss_max: 6.9\n    remediation_days: 60\n    grace_period_days: 14\n    escalation_contacts:\n      - team-lead@company.com\n    pagerduty_severity: warning\n  low:\n    cvss_min: 0.1\n    cvss_max: 3.9\n    remediation_days: 90\n    grace_period_days: 30\n    escalation_contacts:\n      - asset-owner@company.com\n    pagerduty_severity: info\n\nnotification_channels:\n  slack:\n    webhook_url: \"${SLACK_WEBHOOK_URL}\"\n    channel: \"#vulnerability-alerts\"\n  email:\n    smtp_host: smtp.company.com\n    smtp_port: 587\n    from_address: vuln-alerts@company.com\n  pagerduty:\n    api_key: \"${PAGERDUTY_API_KEY}\"\n    service_id: \"${PAGERDUTY_SERVICE_ID}\"\n\nalert_schedules:\n  approaching_breach:\n    percentage_elapsed: 80\n    frequency_hours: 24\n  at_breach:\n    notification: immediate\n    escalation: true\n  post_breach:\n    frequency_hours: 12\n    escalation_increase: true\n```\n\n## Workflow\n\n### Step 1: Database Schema for SLA Tracking\n\n```sql\nCREATE TABLE vulnerability_sla (\n    id SERIAL PRIMARY KEY,\n    cve_id VARCHAR(20) NOT NULL,\n    finding_id VARCHAR(100) NOT NULL,\n    asset_hostname VARCHAR(255),\n    severity VARCHAR(20) NOT NULL,\n    cvss_score DECIMAL(3,1),\n    discovered_at TIMESTAMP NOT NULL,\n    sla_deadline TIMESTAMP NOT NULL,\n    remediated_at TIMESTAMP,\n    status VARCHAR(20) DEFAULT 'open',\n    owner_email VARCHAR(255),\n    escalation_level INTEGER DEFAULT 0,\n    last_alert_sent TIMESTAMP,\n    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP\n);\n\nCREATE INDEX idx_sla_status ON vulnerability_sla(status);\nCREATE INDEX idx_sla_deadline ON vulnerability_sla(sla_deadline);\nCREATE INDEX idx_sla_severity ON vulnerability_sla(severity);\n```\n\n### Step 2: SLA Breach Detection Logic\n\n```python\nfrom datetime import datetime, timedelta, timezone\nimport yaml\n\ndef load_sla_policy(policy_path=\"sla_policy.yaml\"):\n    with open(policy_path, \"r\") as f:\n        return yaml.safe_load(f)\n\ndef get_sla_tier(cvss_score, policy):\n    for tier_name, tier in policy[\"sla_tiers\"].items():\n        if tier[\"cvss_min\"] \u003C= cvss_score \u003C= tier[\"cvss_max\"]:\n            return tier_name, tier\n    return \"low\", policy[\"sla_tiers\"][\"low\"]\n\ndef calculate_sla_deadline(discovered_at, cvss_score, policy):\n    tier_name, tier = get_sla_tier(cvss_score, policy)\n    deadline = discovered_at + timedelta(days=tier[\"remediation_days\"])\n    return deadline, tier_name\n\ndef check_sla_status(discovered_at, sla_deadline, remediated_at=None):\n    now = datetime.now(timezone.utc)\n    if remediated_at:\n        if remediated_at \u003C= sla_deadline:\n            return \"remediated_within_sla\"\n        return \"remediated_breach\"\n    if now > sla_deadline:\n        overdue_days = (now - sla_deadline).days\n        return f\"breached_{overdue_days}d_overdue\"\n    remaining = sla_deadline - now\n    total_sla = sla_deadline - discovered_at\n    pct_elapsed = ((total_sla - remaining) \u002F total_sla) * 100\n    if pct_elapsed >= 80:\n        return \"approaching_breach\"\n    return \"within_sla\"\n```\n\n### Step 3: Notification Dispatch\n\n```python\nimport requests\nimport json\nimport smtplib\nfrom email.mime.text import MIMEText\nfrom email.mime.multipart import MIMEMultipart\n\ndef send_slack_alert(webhook_url, vuln_data, sla_status):\n    color = {\"breached\": \"#FF0000\", \"approaching_breach\": \"#FFA500\", \"within_sla\": \"#36A64F\"}\n    status_color = color.get(\"breached\" if \"breached\" in sla_status else sla_status, \"#808080\")\n    payload = {\n        \"attachments\": [{\n            \"color\": status_color,\n            \"title\": f\"Vulnerability SLA Alert: {vuln_data['cve_id']}\",\n            \"fields\": [\n                {\"title\": \"Severity\", \"value\": vuln_data[\"severity\"], \"short\": True},\n                {\"title\": \"CVSS\", \"value\": str(vuln_data[\"cvss_score\"]), \"short\": True},\n                {\"title\": \"Asset\", \"value\": vuln_data[\"asset_hostname\"], \"short\": True},\n                {\"title\": \"SLA Status\", \"value\": sla_status, \"short\": True},\n                {\"title\": \"Deadline\", \"value\": vuln_data[\"sla_deadline\"].strftime(\"%Y-%m-%d %H:%M UTC\"), \"short\": True},\n                {\"title\": \"Owner\", \"value\": vuln_data.get(\"owner_email\", \"Unassigned\"), \"short\": True},\n            ],\n        }]\n    }\n    requests.post(webhook_url, json=payload, timeout=10)\n\ndef send_pagerduty_alert(api_key, service_id, vuln_data, severity):\n    payload = {\n        \"routing_key\": api_key,\n        \"event_action\": \"trigger\",\n        \"payload\": {\n            \"summary\": f\"SLA Breach: {vuln_data['cve_id']} on {vuln_data['asset_hostname']}\",\n            \"severity\": severity,\n            \"source\": vuln_data[\"asset_hostname\"],\n            \"custom_details\": {\n                \"cve_id\": vuln_data[\"cve_id\"],\n                \"cvss_score\": vuln_data[\"cvss_score\"],\n                \"sla_deadline\": vuln_data[\"sla_deadline\"].isoformat(),\n            }\n        }\n    }\n    requests.post(\n        \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\",\n        json=payload, timeout=10\n    )\n\ndef send_email_alert(smtp_config, to_addresses, vuln_data, sla_status):\n    msg = MIMEMultipart(\"alternative\")\n    msg[\"Subject\"] = f\"[SLA {sla_status.upper()}] {vuln_data['cve_id']} - {vuln_data['severity']}\"\n    msg[\"From\"] = smtp_config[\"from_address\"]\n    msg[\"To\"] = \", \".join(to_addresses)\n    body = f\"\"\"\n    Vulnerability SLA Alert\n\n    CVE: {vuln_data['cve_id']}\n    Severity: {vuln_data['severity']} (CVSS {vuln_data['cvss_score']})\n    Asset: {vuln_data['asset_hostname']}\n    SLA Deadline: {vuln_data['sla_deadline'].strftime('%Y-%m-%d %H:%M UTC')}\n    Status: {sla_status}\n    Owner: {vuln_data.get('owner_email', 'Unassigned')}\n\n    Please take immediate action to remediate this vulnerability.\n    \"\"\"\n    msg.attach(MIMEText(body, \"plain\"))\n    with smtplib.SMTP(smtp_config[\"smtp_host\"], smtp_config[\"smtp_port\"]) as server:\n        server.starttls()\n        server.send_message(msg)\n```\n\n### Step 4: Scheduled SLA Check Runner\n\n```bash\n# Run SLA breach check every hour via cron\necho \"0 * * * * cd \u002Fopt\u002Fvuln-sla && python3 scripts\u002Fprocess.py --check-sla\" | crontab -\n\n# Manual check\npython3 scripts\u002Fprocess.py --check-sla --policy sla_policy.yaml\n\n# Generate SLA compliance report\npython3 scripts\u002Fprocess.py --report --period monthly --output sla_report.html\n```\n\n## SLA Metrics Dashboard\n\n### Key Performance Indicators\n\n```python\ndef calculate_sla_metrics(db_connection, period_start, period_end):\n    metrics = {\n        \"total_findings\": 0,\n        \"remediated_within_sla\": 0,\n        \"sla_breach_count\": 0,\n        \"mean_time_to_remediate\": {},\n        \"sla_compliance_rate\": 0.0,\n        \"current_overdue\": 0,\n    }\n    # Query findings in period grouped by severity\n    query = \"\"\"\n        SELECT severity, COUNT(*) as total,\n               SUM(CASE WHEN remediated_at \u003C= sla_deadline THEN 1 ELSE 0 END) as within_sla,\n               AVG(EXTRACT(EPOCH FROM (COALESCE(remediated_at, NOW()) - discovered_at))\u002F86400) as avg_days\n        FROM vulnerability_sla\n        WHERE discovered_at BETWEEN %s AND %s\n        GROUP BY severity\n    \"\"\"\n    return metrics\n```\n\n## References\n\n- [Vulnerability Management SLAs Guide](https:\u002F\u002Fhostedscan.com\u002Fblog\u002Fvulnerability-management-slas-guide)\n- [NIST SP 800-40 Rev 4 - Patch Management](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-40\u002Frev-4\u002Ffinal)\n- [PagerDuty Events API v2](https:\u002F\u002Fdeveloper.pagerduty.com\u002Fapi-reference\u002Fa7d81b0e9200f-send-an-event-to-pager-duty)\n- [Slack Incoming Webhooks](https:\u002F\u002Fapi.slack.com\u002Fmessaging\u002Fwebhooks)\n",{"name":5,"tags":55,"author":56,"domain":41,"license":15,"version":57,"nist_csf":58,"subdomain":43,"description":7,"mitre_attack":63},[46,47,34,38,48,43,39],"mahipal","1.0",[59,60,61,62],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[64,65,66],"T1190","T1203","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-vulnerability-sla-breach-alerting",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-vulnerability-sla-breach-alerting",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-vulnerability-sla-breach-alerting",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-vulnerability-sla-breach-alerting","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002FSKILL.md",true,[91,97,102,108,112,116,122],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Ftemplate.md","ASSET","资产文件",3236,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Fassets\u002Ftemplate.md",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",5758,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",2656,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",2532,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",9677,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",11675,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-vulnerability-sla-breach-alerting\u002Fscripts\u002Fprocess.py",[127,154,178,204,230,255],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[133],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[135,136,137,138,139,41,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[160],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[162,150,163,164,139,165,41,142,166,167,168,169,170,171,172,173,174,175,176,177],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":188,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[184,187],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[172,189,190,191,192,41,193,194,166,38,195,196,197,198,45,199,200,201,202,203],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[210],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,41,215,216,217,218,219,220,221,222,223,224,225,226,169,227,228,229],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[236],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[238,239,240,41,241,242,243,43,244,245,246,247,248,44,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[139,263,41,264,265,266,267,268,269,40,270,199,271,200,272,273,274,275,276,277],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]