implementing-vulnerability-sla-breach-alerting

# 实施漏洞 SLA 违规告警

## 概述

漏洞修复 SLA 根据严重程度定义了处理安全发现结果的最大时限。本技能涵盖构建自动化告警系统，用于跟踪修复时间线、检测 SLA 违规、发送升级通知并生成合规报告。行业标准 SLA 目标为：关键（24-48 小时）、高（15-30 天）、中（60 天）、低（90 天）。

## 前置条件

- Python 3.9+，安装 `requests`、`pandas`、`jinja2`、`smtplib` 库
- 带 API 访问的漏洞管理平台（DefectDojo、Qualys、Tenable）
- SMTP 服务器或 Webhook 端点（Slack、Microsoft Teams、PagerDuty）
- 用于 SLA 跟踪的数据库（PostgreSQL 或 SQLite）

## SLA 策略定义

### 标准 SLA 分层

| 严重程度 | 修复 SLA | 宽限期 | 升级级别 |
|----------|----------------|--------------|-----------------|
| 关键（CVSS 9.0-10.0） | 48 小时 | 12 小时 | VP 工程 + CISO |
| 高（CVSS 7.0-8.9） | 15 天 | 5 天 | 工程总监 |
| 中（CVSS 4.0-6.9） | 60 天 | 14 天 | 团队负责人 |
| 低（CVSS 0.1-3.9） | 90 天 | 30 天 | 资产负责人 |

### SLA 配置文件

```yaml
# sla_policy.yaml
sla_tiers:
  critical:
    cvss_min: 9.0
    cvss_max: 10.0
    remediation_days: 2
    grace_period_days: 0.5
    escalation_contacts:
      - ciso@company.com
      - vp-engineering@company.com
    pagerduty_severity: critical
  high:
    cvss_min: 7.0
    cvss_max: 8.9
    remediation_days: 15
    grace_period_days: 5
    escalation_contacts:
      - security-director@company.com
    pagerduty_severity: high
  medium:
    cvss_min: 4.0
    cvss_max: 6.9
    remediation_days: 60
    grace_period_days: 14
    escalation_contacts:
      - team-lead@company.com
    pagerduty_severity: warning
  low:
    cvss_min: 0.1
    cvss_max: 3.9
    remediation_days: 90
    grace_period_days: 30
    escalation_contacts:
      - asset-owner@company.com
    pagerduty_severity: info

notification_channels:
  slack:
    webhook_url: "${SLACK_WEBHOOK_URL}"
    channel: "#vulnerability-alerts"
  email:
    smtp_host: smtp.company.com
    smtp_port: 587
    from_address: vuln-alerts@company.com
  pagerduty:
    api_key: "${PAGERDUTY_API_KEY}"
    service_id: "${PAGERDUTY_SERVICE_ID}"

alert_schedules:
  approaching_breach:
    percentage_elapsed: 80
    frequency_hours: 24
  at_breach:
    notification: immediate
    escalation: true
  post_breach:
    frequency_hours: 12
    escalation_increase: true
```

## 实施步骤

### 步骤 1：SLA 跟踪数据库模式

```sql
CREATE TABLE vulnerability_sla (
    id SERIAL PRIMARY KEY,
    cve_id VARCHAR(20) NOT NULL,
    finding_id VARCHAR(100) NOT NULL,
    asset_hostname VARCHAR(255),
    severity VARCHAR(20) NOT NULL,
    cvss_score DECIMAL(3,1),
    discovered_at TIMESTAMP NOT NULL,
    sla_deadline TIMESTAMP NOT NULL,
    remediated_at TIMESTAMP,
    status VARCHAR(20) DEFAULT 'open',
    owner_email VARCHAR(255),
    escalation_level INTEGER DEFAULT 0,
    last_alert_sent TIMESTAMP,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX idx_sla_status ON vulnerability_sla(status);
CREATE INDEX idx_sla_deadline ON vulnerability_sla(sla_deadline);
CREATE INDEX idx_sla_severity ON vulnerability_sla(severity);
```

### 步骤 2：SLA 违规检测逻辑

```python
from datetime import datetime, timedelta, timezone
import yaml

def load_sla_policy(policy_path="sla_policy.yaml"):
    with open(policy_path, "r") as f:
        return yaml.safe_load(f)

def get_sla_tier(cvss_score, policy):
    for tier_name, tier in policy["sla_tiers"].items():
        if tier["cvss_min"] <= cvss_score <= tier["cvss_max"]:
            return tier_name, tier
    return "low", policy["sla_tiers"]["low"]

def calculate_sla_deadline(discovered_at, cvss_score, policy):
    tier_name, tier = get_sla_tier(cvss_score, policy)
    deadline = discovered_at + timedelta(days=tier["remediation_days"])
    return deadline, tier_name

def check_sla_status(discovered_at, sla_deadline, remediated_at=None):
    now = datetime.now(timezone.utc)
    if remediated_at:
        if remediated_at <= sla_deadline:
            return "remediated_within_sla"
        return "remediated_breach"
    if now > sla_deadline:
        overdue_days = (now - sla_deadline).days
        return f"breached_{overdue_days}d_overdue"
    remaining = sla_deadline - now
    total_sla = sla_deadline - discovered_at
    pct_elapsed = ((total_sla - remaining) / total_sla) * 100
    if pct_elapsed >= 80:
        return "approaching_breach"
    return "within_sla"
```

### 步骤 3：通知分发

```python
import requests
import json
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart

def send_slack_alert(webhook_url, vuln_data, sla_status):
    color = {"breached": "#FF0000", "approaching_breach": "#FFA500", "within_sla": "#36A64F"}
    status_color = color.get("breached" if "breached" in sla_status else sla_status, "#808080")
    payload = {
        "attachments": [{
            "color": status_color,
            "title": f"漏洞 SLA 告警：{vuln_data['cve_id']}",
            "fields": [
                {"title": "严重程度", "value": vuln_data["severity"], "short": True},
                {"title": "CVSS", "value": str(vuln_data["cvss_score"]), "short": True},
                {"title": "资产", "value": vuln_data["asset_hostname"], "short": True},
                {"title": "SLA 状态", "value": sla_status, "short": True},
                {"title": "截止时间", "value": vuln_data["sla_deadline"].strftime("%Y-%m-%d %H:%M UTC"), "short": True},
                {"title": "负责人", "value": vuln_data.get("owner_email", "未分配"), "short": True},
            ],
        }]
    }
    requests.post(webhook_url, json=payload, timeout=10)
```

### 步骤 4：计划 SLA 检查运行程序

```bash
# 通过 cron 每小时运行 SLA 违规检查
echo "0 * * * * cd /opt/vuln-sla && python3 scripts/process.py --check-sla" | crontab -

# 手动检查
python3 scripts/process.py --check-sla --policy sla_policy.yaml

# 生成 SLA 合规报告
python3 scripts/process.py --report --period monthly --output sla_report.html
```

## 参考资料

- 漏洞管理 SLA 指南：https://hostedscan.com/blog/vulnerability-management-slas-guide
- NIST SP 800-40 Rev 4 - 补丁管理：https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final
- PagerDuty Events API v2：https://developer.pagerduty.com/api-reference/a7d81b0e9200f-send-an-event-to-pager-duty
- Slack Incoming Webhooks：https://api.slack.com/messaging/webhooks