Summary This source did not publish a separate summary. Review SKILL.md before using the skill.
Building Vulnerability Exception Tracking System
Overview
A vulnerability exception tracking system manages cases where vulnerabilities cannot be remediated within SLA timelines. It provides structured workflows for requesting exceptions, documenting compensating controls, obtaining risk acceptance approvals, and automatically expiring exceptions when their validity period ends. This ensures organizations maintain visibility into accepted risks while complying with frameworks like PCI DSS, SOC 2, and NIST CSF.
When to Use
When deploying or configuring building vulnerability exception tracking system capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Python 3.9+ with flask, sqlalchemy, requests, jinja2
PostgreSQL or SQLite database
Email/Slack integration for approval notifications
Vulnerability management platform API (DefectDojo, Qualys, Tenable)
Exception Request Workflow
Exception Categories
Category Description Max Duration Approver Level Remediation Delay Patch available but deployment blocked 30 days Team Lead + Security No Fix Available Vendor has not released a patch 90 days Security Director Business Critical System cannot be patched without outage 60 days VP Engineering + CISO False Positive Finding is not a real vulnerability Permanent
Compensating Control Alternative mitigation in place 180 days Security Architect
Required Fields for Exception Request exception_schema = {
"cve_id": "CVE-2024-XXXX",
"finding_id": "unique-finding-reference",
"asset_hostname": "prod-db-01.corp.local",
"severity": "high",
"cvss_score": 8.1,
"category": "remediation_delay",
"justification": "Database upgrade required before patch can be applied",
"compensating_controls": [
"WAF rule blocking exploit pattern deployed",
"Network segmentation restricting access to trusted VLANs only",
"Enhanced monitoring via Splunk alert for exploitation indicators"
],
"requested_expiration": "2024-06-15",
"requestor_email": "[email protected] ",
"approver_emails": ["[email protected] ", "[email protected] "],
"risk_rating": "medium",
}
Database Schema CREATE TABLE vulnerability_exceptions (
id SERIAL PRIMARY KEY,
cve_id VARCHAR(20) NOT NULL,
finding_id VARCHAR(100) NOT NULL,
asset_hostname VARCHAR(255),
severity VARCHAR(20),
cvss_score DECIMAL(3,1),
category VARCHAR(50) NOT NULL,
justification TEXT NOT NULL,
compensating_controls TEXT,
status VARCHAR(20) DEFAULT 'pending',
requested_by VARCHAR(255) NOT NULL,
approved_by VARCHAR(255),
requested_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
approved_at TIMESTAMP,
expires_at TIMESTAMP NOT NULL,
expired BOOLEAN DEFAULT FALSE,
risk_rating VARCHAR(20),
review_notes TEXT,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE exception_audit_log (
id SERIAL PRIMARY KEY,
exception_id INTEGER REFERENCES vulnerability_exceptions(id),
action VARCHAR(50) NOT NULL,
actor VARCHAR(255) NOT NULL,
details TEXT,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
CREATE INDEX idx_exception_status ON vulnerability_exceptions(status);
CREATE INDEX idx_exception_expires ON vulnerability_exceptions(expires_at);
CREATE INDEX idx_exception_cve ON vulnerability_exceptions(cve_id);
Implementation
Exception Request API from flask import Flask, request, jsonify
from datetime import datetime, timezone
import json
app = Flask(__name__)
@app.route("/api/exceptions", methods=["POST"])
def create_exception():
data = request.json
required = ["cve_id", "finding_id", "category", "justification", "expires_at", "requestor_email"]
for field in required:
if field not in data:
return jsonify({"error": f"Missing required field: {field}"}), 400
# Validate expiration does not exceed category maximum
max_days = {"remediation_delay": 30, "no_fix": 90, "business_critical": 60,
"false_positive": 365, "compensating_control": 180}
# Insert into database and notify approvers
return jsonify({"status": "pending", "id": "exc-12345"})
@app.route("/api/exceptions/<exc_id>/approve", methods=["POST"])
def approve_exception(exc_id):
approver = request.json.get("approver_email")
notes = request.json.get("notes", "")
# Update status to approved, record approver and timestamp
return jsonify({"status": "approved"})
@app.route("/api/exceptions/<exc_id>/reject", methods=["POST"])
def reject_exception(exc_id):
reviewer = request.json.get("reviewer_email")
reason = request.json.get("reason")
# Update status to rejected, record reviewer and reason
return jsonify({"status": "rejected"})
Expiration Checker (Daily Cron) # Check for expired exceptions daily
python3 scripts/process.py --check-expirations
# Generate monthly exception report
python3 scripts/process.py --report --output exception_report.json
Compensating Controls Documentation For each exception, compensating controls must address:
Detection : How will exploitation attempts be detected?Prevention : What barriers reduce exploitation likelihood?Response : What incident response procedures are in place?Monitoring : What continuous monitoring ensures controls remain effective?
References 