Lion Cipher Lab
Turn a Greenbone scan report into a fix list people will actually action
- Cyber / Security Engineer
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Almost everybody can start a scan. Almost nobody can be handed 400 findings and calmly say which six get fixed this week and why. That gap is the entire job. Left untriaged, a scan report does real damage: it buries the two things that will actually get you breached under three hundred informational notes, it burns your credibility with the engineers you send it to when half of it turns out to be false positives from back-ported patches, and it lets an organisation believe it is doing vulnerability management when it is only doing vulnerability scanning. This lab teaches the part that turns a…
What you'll learn
- reading a single Greenbone/GVM finding properly: VT (NVT) name, OID, severity, CVE, detection method
- using Quality of Detection (QoD) as your first sort key instead of severity
- explaining why an authenticated scan and an unauthenticated scan of the same host disagree so violently
- a repeatable triage funnel: QoD, then severity, then exposure, then exploitability, then business context
- prioritising with CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS instead of raw CVSS
- hand-verifying a finding before you report it
- recognising the back-ported-patch false positive on Debian and RHEL
- exporting a report to CSV, XML and PDF and knowing which one is for whom
- writing a remediation ticket a stranger can actually close, and a defensible risk-acceptance line
- judgment: when a full authenticated scan beats a fast templated sweep, and when neither answers the question
Steps in this lab
- Where Part 1 stopped, and why the report is the actual job
- Take one finding apart: VT name, OID, severity, CVE, QoD, detection method
- QoD: the most under-used number in the whole report
- Authenticated vs unauthenticated — the single biggest lever on report quality
- The triage funnel, in order: QoD, severity, exposure, exploitability, business context
- Why 'fix all the criticals' is the wrong instruction — KEV and EPSS
- Verify by hand before you report it — the professional habit
- The canonical false positive: back-ported security patches make version banners lie
- Export the report — CSV, XML, PDF, and who each one is for
- Turn findings into tickets a stranger can close
- WHEN a full authenticated Greenbone scan is the right tool — and when it is not
- The better way, in six lines — and what you actually built today