CISO Assistant Threats, Advisories and CWEs

CISO Assistant manages structural threat modeling and technical vulnerabilities through separate, decoupled modules that integrate with automated ingestion workflows. This approach allows you to align broad strategic threats with granular software or infrastructure vulnerabilities (such as CVEs or CWEs) and security advisories.

1. Ingesting and Customizing Threats

Threats represent the strategic component of your risk library (e.g., Ransomware, Phishing, Insider Threats). You can load them using either pre-built libraries or custom templates.1

• Pre-built Common Catalog: You can import the INTUITEM Common Catalog using its global URN: urn:intuitem:risk:library:intuitem-common-catalog. This populates your environment with standard threat vectors ranging from ICT-001 (Ransomware) to ICT-023 (Regulatory Non-Compliance).1

• Custom Bulk Threat Import: If you maintain an internal corporate threat register, you can import it via the Data Wizard web interface or using the CLICA tool:1

• uv run clica.py import-threats --file custom-threats.xlsx --folder "Global"

• 
  

• Spreadsheet Ingestion Fields: The threat importer requires specific lowercase headers:1

  • name (Required): The unique title of the threat.1

  • description: Context or impact summary.1

  • domain: Optional folder or domain lookup name to scope the threat's usage.1

  • ref_id: Your internal tracking code.1

2. Managing Vulnerabilities, CWEs, and Advisories

Technical vulnerabilities—such as software bugs, misconfigurations, or Common Weakness Enumerations (CWEs)—are handled within the platform's vulnerability records or attached to a Findings Assessment.1

• Vulnerability Metadata Schema: When importing or creating vulnerability entries, the platform tracks the following parameters:1

  • name (Required): The identifier (e.g., CVE-2026-1234 or CWE-79: Cross-Site Scripting).1

  • ref_id: Reference or advisory key.1

  • status: Mapped to a specific runtime state (undefined, potential, exploitable, mitigated, fixed, not exploitable, unaffected).1

  • severity: Standardized impact tier (undefined, info, low, medium, high, critical) matching your CVSS bounds.1

  • assets: Newline-separated list of affected assets.1

  • applied_controls: Active remediation or shielding measures currently addressing the flaw.1

  • security_exceptions: Any logged deviations or patch timeline extensions.1

• Ingestion via Findings Assessments: For security advisories or pentest reports that bundle multiple CWEs and CVEs together, use the import-findings-assessments command. The data processor will automatically create any listed vulnerabilities in the perimeter's folder if they are missing from the database.1

3. Practical Usage: Linking Vulnerabilities to Risks

To transition from a simple list of technical flaws to an actionable security posture, vulnerabilities must be connected back to business context:1

1. Map Flaws to Assets: When vulnerabilities are ingested via your automation loops or spreadsheets, ensure they are linked to their target Supporting Assets.1

2. Formulate the Risk Scenario: In the Risk Assessment domain, construct scenarios using the standard format: [Threat] on [Asset]. For instance, combine the threat Zero-Day Exploits with your Web Application asset.1

3. Calculate Residual Risk: Link your relevant Applied Controls (e.g., WAF, patch schedule) to the scenario. The system will calculate whether your active security measures successfully mitigate the technical weaknesses identified by your advisories and CWE maps.1

4. Audit via X-Rays: Run an environment quality check. The X-Rays Engine will flag logical errors, such as any active risk scenarios where the remaining residual threat score is invalidly higher than the unmitigated current threat level.1

To import a comprehensive matrix of security advisories, software bug entries, and Common Weakness Enumerations (CWEs) into your active perimeter using the backend data ingestion layout, structure your spreadsheet using the template mapping layout below.1

1. Spreadsheet Formatting Layout

Save your data file as an Excel Workbook (.xlsx) or a standard comma-separated text file (.csv). The first row must feature these exact lowercase headers with no capitalization or spacing mismatches:1

name,ref_id,status,severity,filtering_labels,assets,applied_controls,security_exceptions

2. Markdown Reference Matrix (The Import Schema)

Column Header

Accepted Data Format

Purpose & Ingestion Constraints

name

Plain Text String

Required. The unique identifier string for the technical flaw (e.g., CVE-2026-3821, CWE-79: Cross-Site Scripting, or an internal advisory title).1

ref_id

Alphanumeric Code

Your internal security tracking code or vendor reference key (e.g., ADV-2026-004).1

status

Enumerated String

Maps the current lifecycle state of the vulnerability. Must exactly match one of these runtime keywords: undefined, potential, exploitable, mitigated, fixed, not exploitable, or unaffected.1

severity

Enumerated String

The standardized impact tier matching your CVSS bounds. Must exactly match one of these lowercase terms: undefined, info, low, medium, high, or critical.1

filtering_labels

Comma or Pipe list

Operational classification tags used for tracking and triage sorting (e.g., OWASP-Top-10, Web, Squad-Alpha).1

assets

Newline-separated list

The names of the affected Supporting Assets in your inventory. Any asset name listed here that is missing from the database will be automatically created as a technical asset within the perimeter's folder.1

applied_controls

Newline-separated list

Active remediation or shielding measures currently mitigating the flaw (e.g., Web Application Firewall, Patch Management Schedule).1

security_exceptions

Newline-separated list

Custom references to any logged deviations, operational constraints, or patch timeline extensions approved for this vulnerability.1

3. Sample Row Execution Mapping (Example Data)

name,ref_id,status,severity,filtering_labels,assets,applied_controls,security_exceptions

"CWE-89: SQL Injection","ADV-2026-01","exploitable","critical","OWASP-Top-10, Backend","Production Database

Patient Portal Gateway","WAF SQLi Filters","EXC-SQL-2026"

"CVE-2026-4401","ADV-2026-02","mitigated","high","Infrastructure, OS","AWS Core API Node","Patch Management Schedule",""

4. Command-Line Ingestion Instructions (CLICA)

If your advisory vectors or pentest findings are bundled into a comprehensive assessment report, use the Data Wizard interface or run the programmatic streaming importer from your workspace terminal:1

# Ingest bulk vulnerabilities linked to a specific perimeter scope

uv run clica.py import-findings-assessments --file technical-advisories.xlsx --perimeter "AWS Production Scope"

Once ingestion completes, execute a quick system check (python manage.py status) and verify your X-Rays Dashboard. The automated QA layer will instantly flag logical inconsistencies—such as vulnerabilities marked as "Fixed" that are still missing valid validation signatures—ensuring your registers remain audit-ready.1 

Here is the structural logic and node architecture required to build your automated n8n vulnerability ingestion pipeline, allowing you to feed incoming JSON scanner payloads directly into the template format we established.

n8n Vulnerability Ingestion Node Architecture

[Webhook Trigger] ──► [Filter: Source Validation] ──► [Function: Schema Map] ──► [HTTP / Nodes: Target Load]

1. The Webhook Input Layer

Configure an open or authenticated HTTP Webhook node as your network endpoint to intercept incoming payload streams from tools like Microsoft Defender, SonarQube, or Nexpose.

• HTTP Method: POST

• Path: v1/ingest/vulnerabilities

• Response Mode: On Received (with a 202 Accepted status to prevent blocking the scanner queue loop).

2. The Data Transformation Layer (Schema Mapping)

Add a Code / Function Node directly after your trigger. Paste this template parsing logic to map dynamic JSON attributes down to CISO Assistant's strict database keywords and layout rules:

JavaScript

// n8n Javascript Node: Parse and Normalize Scanner Payload Attributes

const items = $.input.all();

const normalizedPayloads = [];

for (const item of items) {

    const rawData = item.json;

    // Formulate a standardized row entry matching the required model constraints

    normalizedPayloads.push({

        json: {

            name: rawData.cve_id || rawData.vulnerability_identifier, // Maps CVE/CWE

            ref_id: rawData.advisory_id || `ADV-${Date.now()}`,       // Internal tracking key

            status: mapStatusToPlatformEnum(rawData.scan_status),    // Idempotent lifecyle lookup

            severity: String(rawData.cvss_severity).toLowerCase(),    // Normalized severity tier

            filtering_labels: rawData.team_tags ? rawData.team_tags.join(", ") : "SecOps-Ingest",

            assets: rawData.target_host_names ? rawData.target_host_names.join("\n") : "Unmapped Host",

            applied_controls: rawData.suggested_mitigations ? rawData.suggested_mitigations.join("\n") : "",

            security_exceptions: rawData.approved_exception_id || ""

        }

    });

}

return normalizedPayloads;

// Helper to enforce valid runtime status terms and block database serialization schema faults

function mapStatusToPlatformEnum(scannerStatus) {

    const enumMap = {

        'active': 'exploitable',

        'open': 'exploitable',

        'reopened': 'exploitable',

        'patched': 'fixed',

        'resolved': 'fixed',

        'mitigated': 'mitigated',

        'false_positive': 'not exploitable',

        'ignored': 'unaffected'

    };

    return enumMap[String(scannerStatus).toLowerCase()] || 'undefined';

}

3. The Execution / Load Layer

Feed the mapped output block directly into the CISO Assistant Node or a generic HTTP Request Node configured as follows:

• Method: POST

• URL: {{ $env.API_URL }}/api/findings-assessments/import_findings/

• Authentication: Header (Authorization: Token {{ $env.TOKEN }})

• Body Content: Pass the normalized JSON output array seamlessly.

4. Quality Assurance via X-Rays Validation

Once the pipeline records a successful transaction loop, the backend automatically triggers validation hooks:1

• Vulnerability Matching: The internal RiskAssessment.quality_check() routine ensures that any incoming technical vulnerabilities are correctly correlated to active risk scenarios.1

• Control Verification: The X-Rays Dashboard will instantly generate a warning flag if an ingested vulnerability marks a control as "Fixed" but lacks a valid reference verification or physical evidence signature.1