Plataforma de priorização contextual

Contexto operacional sem distorcer o CVSS oficial.

Compare scores, controles, exposição e criticidade para transformar vulnerabilidades em decisões priorizadas, explicáveis e auditáveis.

official_cvsspermanece imutávelcontextual_environmentalorienta a prioridade

Ver visão geral Entender metodologia

Visão geral

Estado atual da análise

Métricas derivadas dos artefatos de comparação e da trilha ambiental carregada.

Achados6Vulnerabilidades comparadas

Avaliações12Estados antes e depois

Rebaixados2Menor prioridade contextual

Inalterados4Contexto sem mudança

Elevados0Maior prioridade contextual

Delta médio-0,3Variação ambiental média

Distribuição contextual

Impacto das evidências locais

6 achados

Rebaixados2

Inalterados4

Elevados0

Explorador contextual

Entenda o impacto de uma evidência

O explorador não recalcula nem substitui o CVSS oficial. Ele explica a mudança registrada na prioridade ambiental.

F-001

CVE-2016-0036

Ativo A-CORP-SRV · SYS

Rebaixado

CVSS oficial8,8Alto

Ambiental antes8,8MAV N

Ambiental depois8,0MAV A

Investigação

Achados e comparações

Filtre ativos, CVEs, tipos e efeitos para localizar rapidamente as decisões relevantes.

Antes e depois

Comparação entre o cenário ambiental inicial e o cenário apoiado pelas evidências locais.

Comparação ambiental antes e depois
Finding	Ativo	CVE	Tipo	Antes	Depois	Delta	MAV	Efeito
F-001	A-CORP-SRV	CVE-2016-0036	SYS	8,8	8,0	-0,8	N → A	Rebaixado
F-002	POS-01	CVE-2016-0469	SYS	7,8	7,8	0,0	L → L	Inalterado
F-003	ADMIN-01	CVE-2016-3234	APP	8,8	8,0	-0,8	N → A	Rebaixado
F-004	WIRELESS-LEGACY-01	CVE-2016-1619	APP	7,8	7,8	0,0	N → N	Inalterado
F-005	CORE-SW-01	CVE-2016-6441	SYS	9,7	9,7	0,0	A → A	Inalterado
F-006	CORE-SW-01	CVE-2016-6428	SYS	8,8	8,8	0,0	A → A	Inalterado

Linhas detalhadas de avaliaçãoCR, IR, AR, MAV e compatibilidade das evidências12

Linhas detalhadas de avaliação ambiental
Finding	Estado	Ativo	CVE	Ambiental	CR	IR	AR	MAV	Evidência
F-001	before	A-CORP-SRV	CVE-2016-0036	8,8	M	M	H	N	Compatível
F-001	after	A-CORP-SRV	CVE-2016-0036	8,0	M	M	H	A	Compatível
F-002	before	POS-01	CVE-2016-0469	7,8	H	H	H	L	Compatível
F-002	after	POS-01	CVE-2016-0469	7,8	H	H	H	L	Compatível
F-003	before	ADMIN-01	CVE-2016-3234	8,8	M	M	M	N	Compatível
F-003	after	ADMIN-01	CVE-2016-3234	8,0	M	M	M	A	Compatível
F-004	before	WIRELESS-LEGACY-01	CVE-2016-1619	7,8	L	L	M	N	Compatível
F-004	after	WIRELESS-LEGACY-01	CVE-2016-1619	7,8	L	L	M	N	Compatível
F-005	before	CORE-SW-01	CVE-2016-6441	9,7	M	H	H	A	Compatível
F-005	after	CORE-SW-01	CVE-2016-6441	9,7	M	H	H	A	Compatível
F-006	before	CORE-SW-01	CVE-2016-6428	8,8	M	H	H	A	Compatível
F-006	after	CORE-SW-01	CVE-2016-6428	8,8	M	H	H	A	Compatível

Baseline real

Varredura automatizada Trivy

Resultado mais recente do pipeline local aplicado ao repositório monitorado.

0achados detectados

0Críticos

0Altos

0Médios

0Baixos

Ativo: local-repository
Scanner: trivy

Watcher IA

Validação automatizada

Evidências ligadas a decisões reproduzíveis. A adjudicação humana independente permanece uma etapa comparativa futura.

1Decisões

1Aceitas

0Sinalizadas

100%Concordância

Confiança média0,7

Reprodutibilidade

Execuções validadas

Cenários determinísticos preservados para comparação, auditoria e repetição dos resultados.

1 execução

Execuções determinísticas de validação
Run	Achados	Avaliações	Rebaixados	Inalterados	Elevados	Delta médio
pci_segmented_lab_20260517_143146before_after_comparison.csv	6	12	2	4	0	-0,267

Como funciona

Uma decisão em três camadas rastreáveis

A plataforma mantém o score oficial separado das evidências utilizadas para ajustar prioridade, tratamento e urgência operacional.

CVSS oficial

O score técnico original permanece preservado como referência normativa e comparável.

official_cvss

Evidências ambientais

Exposição, segmentação, criticidade, controles e impacto são associados ao ativo.

evidence

Prioridade contextual

A decisão resultante apresenta delta, justificativa e trilha de auditoria sem reescrever o score oficial.

contextual_environmental

Princípio central:priorização contextual não é uma nova versão do CVSS e não substitui a avaliação técnica oficial.

Transparência

Manifesto e trilha de auditoria

Os artefatos completos permanecem disponíveis para inspeção técnica sem dominar a experiência principal.

Manifesto da execuçãoArquivos, hashes, contagens e contexto do run

{
  "run_id": "pci_segmented_lab_20260517_143146",
  "case": "pci_segmented_lab",
  "case_dir": "cases/pci_segmented_lab",
  "generated_at_utc": "2026-05-17T19:30:29.074650+00:00",
  "assessments": 12,
  "findings": 6,
  "summary": {
    "findings": 6,
    "downgraded": 2,
    "unchanged": 4,
    "upgraded": 0,
    "mean_delta": -0.267,
    "max_abs_delta": 0.8
  },
  "case_files": [
    {
      "path": "cases/pci_segmented_lab/assets.csv",
      "sha256": "f348bc0c10b9894892cd4cfed79190f3b8dfc2233526afe70cc4d8f6a0377fa5",
      "bytes": 751
    },
    {
      "path": "cases/pci_segmented_lab/business_impact.yaml",
      "sha256": "eaa6d46dd3a91c9d3cbcf090be5ee9044cd757ed5db10cb4ae494349bba5095b",
      "bytes": 906
    },
    {
      "path": "cases/pci_segmented_lab/case_description.md",
      "sha256": "18c1168db19845fcddf3b03262f0f0d244635d6ab7df3adbc690116751f31856",
      "bytes": 495
    },
    {
      "path": "cases/pci_segmented_lab/expected_expert_labels.yaml",
      "sha256": "a2e89a91c21c6ee9e3d8dea2580b6740ec26fb887e344f1fd90d959999578057",
      "bytes": 473
    },
    {
      "path": "cases/pci_segmented_lab/firewall_rules.yaml",
      "sha256": "0c8d0ba4049050db629617ffdc0a4b2c8b5fe0c5c9c1c4904b21d1687a890ced",
      "bytes": 732
    },
    {
      "path": "cases/pci_segmented_lab/pci_scope.yaml",
      "sha256": "80bf6f7ecc5d26ec8a1ad4510211cb2ba7e2aaf5eb57b766675ec44ba04d7250",
      "bytes": 554
    },
    {
      "path": "cases/pci_segmented_lab/topology.yaml",
      "sha256": "70537fc983385d18aef91982287b9e2ba23db47e9f37c4e59237cc48b3f8aeef",
      "bytes": 932
    },
    {
      "path": "cases/pci_segmented_lab/vulnerabilities.csv",
      "sha256": "ac225fd148bc8ccc65e69ab886bf01224c16b2a55753d0c2cd473a4e2363b00c",
      "bytes": 968
    }
  ],
  "output_files": [
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/article_table_env_effects.md",
      "sha256": "04132c81295a6e80433d3e46505372fe29da7c18e8d3d8ad824aafe10d4e3b19",
      "bytes": 701
    },
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/assessments.json",
      "sha256": "5020a785ff93a22a2989630fa1571ddae6f09595bc3b28dddfb98a9524ac7e58",
      "bytes": 15025
    },
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/audit_trace.jsonl",
      "sha256": "253ceedd05e2c995de8f8d099e46eb55f8120cd4e00af98793b6fea2a21680c2",
      "bytes": 6750
    },
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/before_after_comparison.csv",
      "sha256": "016de34d3f3adebf879c6af3f9e8e4a914c314c9fe28b0e6739221736baab163",
      "bytes": 816
    },
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/report.md",
      "sha256": "d5da012f7da30d3fc40fb05299eb3238b60b7eefbc3b4fcf4481efc088e4755e",
      "bytes": 7249
    },
    {
      "path": "outputs/runs/pci_segmented_lab_20260517_143146/summary.csv",
      "sha256": "ccea8222a58b4ab88219d8201c4ee6ebb70f35025dcec7035175d15d511a9234",
      "bytes": 890
    }
  ]
}

Eventos de auditoriaEvidências e justificativas em ordem determinística

[
  {
    "finding_id": "F-001",
    "asset_id": "A-CORP-SRV",
    "cve": "CVE-2016-0036",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=A-CORP-SRV scope_before=in_scope role=corporate_service"
  },
  {
    "finding_id": "F-001",
    "asset_id": "A-CORP-SRV",
    "cve": "CVE-2016-0036",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-001",
    "asset_id": "A-CORP-SRV",
    "cve": "CVE-2016-0036",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=A-CORP-SRV scope_after=out_of_scope role=corporate_service"
  },
  {
    "finding_id": "F-001",
    "asset_id": "A-CORP-SRV",
    "cve": "CVE-2016-0036",
    "state": "after",
    "metric": "MAV",
    "source": "assets.csv + firewall_rules.yaml",
    "reason": "base AV=N but external_exposure_after=internal_only; network attack constrained to adjacent/internal segment."
  },
  {
    "finding_id": "F-001",
    "asset_id": "A-CORP-SRV",
    "cve": "CVE-2016-0036",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-002",
    "asset_id": "POS-01",
    "cve": "CVE-2016-0469",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=POS-01 scope_before=in_scope role=payment_processing"
  },
  {
    "finding_id": "F-002",
    "asset_id": "POS-01",
    "cve": "CVE-2016-0469",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-002",
    "asset_id": "POS-01",
    "cve": "CVE-2016-0469",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=POS-01 scope_after=in_scope role=payment_processing"
  },
  {
    "finding_id": "F-002",
    "asset_id": "POS-01",
    "cve": "CVE-2016-0469",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-003",
    "asset_id": "ADMIN-01",
    "cve": "CVE-2016-3234",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=ADMIN-01 scope_before=in_scope role=administration"
  },
  {
    "finding_id": "F-003",
    "asset_id": "ADMIN-01",
    "cve": "CVE-2016-3234",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-003",
    "asset_id": "ADMIN-01",
    "cve": "CVE-2016-3234",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=ADMIN-01 scope_after=out_of_scope role=administration"
  },
  {
    "finding_id": "F-003",
    "asset_id": "ADMIN-01",
    "cve": "CVE-2016-3234",
    "state": "after",
    "metric": "MAV",
    "source": "assets.csv + firewall_rules.yaml",
    "reason": "base AV=N but external_exposure_after=internal_only; network attack constrained to adjacent/internal segment."
  },
  {
    "finding_id": "F-003",
    "asset_id": "ADMIN-01",
    "cve": "CVE-2016-3234",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-004",
    "asset_id": "WIRELESS-LEGACY-01",
    "cve": "CVE-2016-1619",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=WIRELESS-LEGACY-01 scope_before=in_scope role=legacy_wireless"
  },
  {
    "finding_id": "F-004",
    "asset_id": "WIRELESS-LEGACY-01",
    "cve": "CVE-2016-1619",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-004",
    "asset_id": "WIRELESS-LEGACY-01",
    "cve": "CVE-2016-1619",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=WIRELESS-LEGACY-01 scope_after=out_of_scope role=legacy_wireless"
  },
  {
    "finding_id": "F-004",
    "asset_id": "WIRELESS-LEGACY-01",
    "cve": "CVE-2016-1619",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-005",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6441",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=CORE-SW-01 scope_before=in_scope role=segmentation_enforcement"
  },
  {
    "finding_id": "F-005",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6441",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-005",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6441",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=CORE-SW-01 scope_after=in_scope role=segmentation_enforcement"
  },
  {
    "finding_id": "F-005",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6441",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-006",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6428",
    "state": "before",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=CORE-SW-01 scope_before=in_scope role=segmentation_enforcement"
  },
  {
    "finding_id": "F-006",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6428",
    "state": "before",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  },
  {
    "finding_id": "F-006",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6428",
    "state": "after",
    "metric": "CR/IR/AR",
    "source": "business_impact.yaml + pci_scope.yaml + assets.csv",
    "reason": "asset=CORE-SW-01 scope_after=in_scope role=segmentation_enforcement"
  },
  {
    "finding_id": "F-006",
    "asset_id": "CORE-SW-01",
    "cve": "CVE-2016-6428",
    "state": "after",
    "metric": "ModifiedBaseDefaults",
    "source": "vulnerabilities.csv",
    "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them."
  }
]

Finding

Ativo

CVE

Tipo

Antes

Depois

Delta

MAV

Efeito

F-001

A-CORP-SRV

CVE-2016-0036

SYS

8,8

8,0

-0,8

N → A

Rebaixado

F-002

POS-01

CVE-2016-0469

SYS

7,8

0,0

L → L

Inalterado

F-003

ADMIN-01

CVE-2016-3234

APP

8,8

8,0

-0,8

N → A

Rebaixado

F-004

WIRELESS-LEGACY-01

CVE-2016-1619

APP

7,8

0,0

N → N

Inalterado

F-005

CORE-SW-01

CVE-2016-6441

SYS

9,7

0,0

A → A

Inalterado

F-006

CORE-SW-01

CVE-2016-6428

SYS

8,8

0,0

A → A

Inalterado

Finding

Estado

Ativo

CVE

Ambiental

MAV

Evidência

F-001

before

A-CORP-SRV

CVE-2016-0036

8,8

Compatível

F-001

after

A-CORP-SRV

CVE-2016-0036

8,0

Compatível

F-002

before

POS-01

CVE-2016-0469

7,8

Compatível

F-002

after

POS-01

CVE-2016-0469

7,8

Compatível

F-003

before

ADMIN-01

CVE-2016-3234

8,8

Compatível

F-003

after

ADMIN-01

CVE-2016-3234

8,0

Compatível

F-004

before

WIRELESS-LEGACY-01

CVE-2016-1619

7,8

Compatível

F-004

after

WIRELESS-LEGACY-01

CVE-2016-1619

7,8

Compatível

F-005

before

CORE-SW-01

CVE-2016-6441

9,7

Compatível

F-005

after

CORE-SW-01

CVE-2016-6441

9,7

Compatível

F-006

before

CORE-SW-01

CVE-2016-6428

8,8

Compatível

F-006

after

CORE-SW-01

CVE-2016-6428

8,8

Compatível

Run

Achados

Avaliações

Rebaixados

Inalterados

Elevados

Delta médio

pci_segmented_lab_20260517_143146before_after_comparison.csv

-0,267

{ "run_id": "pci_segmented_lab_20260517_143146", "case": "pci_segmented_lab", "case_dir": "cases/pci_segmented_lab", "generated_at_utc": "2026-05-17T19:30:29.074650+00:00", "assessments": 12, "findings": 6, "summary": { "findings": 6, "downgraded": 2, "unchanged": 4, "upgraded": 0, "mean_delta": -0.267, "max_abs_delta": 0.8 }, "case_files": [ { "path": "cases/pci_segmented_lab/assets.csv", "sha256": "f348bc0c10b9894892cd4cfed79190f3b8dfc2233526afe70cc4d8f6a0377fa5", "bytes": 751 }, { "path": "cases/pci_segmented_lab/business_impact.yaml", "sha256": "eaa6d46dd3a91c9d3cbcf090be5ee9044cd757ed5db10cb4ae494349bba5095b", "bytes": 906 }, { "path": "cases/pci_segmented_lab/case_description.md", "sha256": "18c1168db19845fcddf3b03262f0f0d244635d6ab7df3adbc690116751f31856", "bytes": 495 }, { "path": "cases/pci_segmented_lab/expected_expert_labels.yaml", "sha256": "a2e89a91c21c6ee9e3d8dea2580b6740ec26fb887e344f1fd90d959999578057", "bytes": 473 }, { "path": "cases/pci_segmented_lab/firewall_rules.yaml", "sha256": "0c8d0ba4049050db629617ffdc0a4b2c8b5fe0c5c9c1c4904b21d1687a890ced", "bytes": 732 }, { "path": "cases/pci_segmented_lab/pci_scope.yaml", "sha256": "80bf6f7ecc5d26ec8a1ad4510211cb2ba7e2aaf5eb57b766675ec44ba04d7250", "bytes": 554 }, { "path": "cases/pci_segmented_lab/topology.yaml", "sha256": "70537fc983385d18aef91982287b9e2ba23db47e9f37c4e59237cc48b3f8aeef", "bytes": 932 }, { "path": "cases/pci_segmented_lab/vulnerabilities.csv", "sha256": "ac225fd148bc8ccc65e69ab886bf01224c16b2a55753d0c2cd473a4e2363b00c", "bytes": 968 } ], "output_files": [ { "path": "outputs/runs/pci_segmented_lab_20260517_143146/article_table_env_effects.md", "sha256": "04132c81295a6e80433d3e46505372fe29da7c18e8d3d8ad824aafe10d4e3b19", "bytes": 701 }, { "path": "outputs/runs/pci_segmented_lab_20260517_143146/assessments.json", "sha256": "5020a785ff93a22a2989630fa1571ddae6f09595bc3b28dddfb98a9524ac7e58", "bytes": 15025 }, { "path": "outputs/runs/pci_segmented_lab_20260517_143146/audit_trace.jsonl", "sha256": "253ceedd05e2c995de8f8d099e46eb55f8120cd4e00af98793b6fea2a21680c2", "bytes": 6750 }, { "path": "outputs/runs/pci_segmented_lab_20260517_143146/before_after_comparison.csv", "sha256": "016de34d3f3adebf879c6af3f9e8e4a914c314c9fe28b0e6739221736baab163", "bytes": 816 }, { "path": "outputs/runs/pci_segmented_lab_20260517_143146/report.md", "sha256": "d5da012f7da30d3fc40fb05299eb3238b60b7eefbc3b4fcf4481efc088e4755e", "bytes": 7249 }, { "path": "outputs/runs/pci_segmented_lab_20260517_143146/summary.csv", "sha256": "ccea8222a58b4ab88219d8201c4ee6ebb70f35025dcec7035175d15d511a9234", "bytes": 890 } ] }

[ { "finding_id": "F-001", "asset_id": "A-CORP-SRV", "cve": "CVE-2016-0036", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=A-CORP-SRV scope_before=in_scope role=corporate_service" }, { "finding_id": "F-001", "asset_id": "A-CORP-SRV", "cve": "CVE-2016-0036", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-001", "asset_id": "A-CORP-SRV", "cve": "CVE-2016-0036", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=A-CORP-SRV scope_after=out_of_scope role=corporate_service" }, { "finding_id": "F-001", "asset_id": "A-CORP-SRV", "cve": "CVE-2016-0036", "state": "after", "metric": "MAV", "source": "assets.csv + firewall_rules.yaml", "reason": "base AV=N but external_exposure_after=internal_only; network attack constrained to adjacent/internal segment." }, { "finding_id": "F-001", "asset_id": "A-CORP-SRV", "cve": "CVE-2016-0036", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-002", "asset_id": "POS-01", "cve": "CVE-2016-0469", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=POS-01 scope_before=in_scope role=payment_processing" }, { "finding_id": "F-002", "asset_id": "POS-01", "cve": "CVE-2016-0469", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-002", "asset_id": "POS-01", "cve": "CVE-2016-0469", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=POS-01 scope_after=in_scope role=payment_processing" }, { "finding_id": "F-002", "asset_id": "POS-01", "cve": "CVE-2016-0469", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-003", "asset_id": "ADMIN-01", "cve": "CVE-2016-3234", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=ADMIN-01 scope_before=in_scope role=administration" }, { "finding_id": "F-003", "asset_id": "ADMIN-01", "cve": "CVE-2016-3234", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-003", "asset_id": "ADMIN-01", "cve": "CVE-2016-3234", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=ADMIN-01 scope_after=out_of_scope role=administration" }, { "finding_id": "F-003", "asset_id": "ADMIN-01", "cve": "CVE-2016-3234", "state": "after", "metric": "MAV", "source": "assets.csv + firewall_rules.yaml", "reason": "base AV=N but external_exposure_after=internal_only; network attack constrained to adjacent/internal segment." }, { "finding_id": "F-003", "asset_id": "ADMIN-01", "cve": "CVE-2016-3234", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-004", "asset_id": "WIRELESS-LEGACY-01", "cve": "CVE-2016-1619", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=WIRELESS-LEGACY-01 scope_before=in_scope role=legacy_wireless" }, { "finding_id": "F-004", "asset_id": "WIRELESS-LEGACY-01", "cve": "CVE-2016-1619", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-004", "asset_id": "WIRELESS-LEGACY-01", "cve": "CVE-2016-1619", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=WIRELESS-LEGACY-01 scope_after=out_of_scope role=legacy_wireless" }, { "finding_id": "F-004", "asset_id": "WIRELESS-LEGACY-01", "cve": "CVE-2016-1619", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-005", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6441", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=CORE-SW-01 scope_before=in_scope role=segmentation_enforcement" }, { "finding_id": "F-005", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6441", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-005", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6441", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=CORE-SW-01 scope_after=in_scope role=segmentation_enforcement" }, { "finding_id": "F-005", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6441", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-006", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6428", "state": "before", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=CORE-SW-01 scope_before=in_scope role=segmentation_enforcement" }, { "finding_id": "F-006", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6428", "state": "before", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." }, { "finding_id": "F-006", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6428", "state": "after", "metric": "CR/IR/AR", "source": "business_impact.yaml + pci_scope.yaml + assets.csv", "reason": "asset=CORE-SW-01 scope_after=in_scope role=segmentation_enforcement" }, { "finding_id": "F-006", "asset_id": "CORE-SW-01", "cve": "CVE-2016-6428", "state": "after", "metric": "ModifiedBaseDefaults", "source": "vulnerabilities.csv", "reason": "Unchanged modified metrics inherit base values unless local evidence overrides them." } ]

Contexto operacional sem distorcer o CVSS oficial.

Estado atual da análise

Impacto das evidências locais

Entenda o impacto de uma evidência

CVE-2016-0036

Achados e comparações

Filtros

Antes e depois

Varredura automatizada Trivy

Validação automatizada

Execuções validadas

Uma decisão em três camadas rastreáveis

CVSS oficial

Evidências ambientais

Prioridade contextual

Manifesto e trilha de auditoria

Contexto operacional sem distorcer o CVSS oficial.

Estado atual da análise

Impacto das evidências locais

Entenda o impacto de uma evidência

CVE-2016-0036

Achados e comparações

Filtros

Antes e depois

Varredura automatizada Trivy

Validação automatizada

Execuções validadas

Uma decisão em três camadas rastreáveis

CVSS oficial

Evidências ambientais

Prioridade contextual

Manifesto e trilha de auditoria