Prismatic IR PVM

Overview

Prismatic IR PVM provides integrated Incident Response with Patch and Vulnerability Management capabilities. It tracks discovered vulnerabilities from initial detection through remediation, manages patching workflows with SLA enforcement, and coordinates incident response activities when vulnerabilities are actively exploited. The module bridges the critical gap between vulnerability discovery and remediation execution that organizations frequently struggle with.

The system implements the full incident response lifecycle -- detect, contain, eradicate, and recover -- with automated playbook execution for common incident types. Each incident maintains a complete evidence chain with custody tracking, enabling post-incident forensic analysis and regulatory compliance reporting. Vulnerability data is enriched with CVSS scoring, asset mapping, and patch availability monitoring to support risk-based prioritization decisions.

By integrating vulnerability management directly with incident response, IR PVM eliminates the organizational silos that typically delay remediation. When Prismatic Detection Engine identifies active exploitation of a known vulnerability, IR PVM automatically escalates the vulnerability to incident status and initiates the appropriate response playbook. The NABLA framework's provenance mandatory axiom ensures that every step of the incident lifecycle is documented with cryptographic evidence chains that satisfy regulatory audit requirements under NIS2 and GDPR.

Architecture

Vulnerability Sources --> Vulnerability Registry --> Risk Prioritization
        |                       |                        |
  CVE Feeds              Asset Mapping            CVSS Scoring
  Scanner Results        Patch Availability        SLA Tracking
  OSINT Intelligence     Remediation Plans         Compliance
        |                       |                        |
Detection Engine --> Incident Creation --> Playbook Execution --> Recovery
                         |                    |
                   Evidence Collection    Post-Incident Review
                         |                    |
                   Chain of Custody       Lessons Learned

The architecture uses OTP supervision trees to manage long-running incident workflows as stateful processes. Each active incident runs under its own supervised process, ensuring that a crash in one incident workflow cannot affect others. The state machine pattern ensures that incidents follow valid lifecycle transitions and that SLA timers are enforced.

Key Modules

Key Features

Vulnerability Management

• Vulnerability tracking from discovery through verified remediation with full state history
• CVSS v3.1 scoring with environmental and temporal adjustments for context-specific risk assessment
• Asset-vulnerability mapping with blast radius analysis showing cascading impact potential
• Patch availability monitoring with vendor advisory integration and automatic notification

Vulnerability Risk Prioritization

The risk prioritization engine combines CVSS base scores with contextual factors to produce organization-specific risk rankings. Asset criticality, network exposure, and active exploitation intelligence from OSINT sources adjust the priority beyond what CVSS alone can capture:

Incident Response Lifecycle

The incident lifecycle is modeled as a state machine with well-defined transitions and mandatory evidence requirements at each stage:

defmodule PrismaticIrPvm.IncidentManager do
  use GenStateMachine, callback_mode: :handle_event_function

  @type state :: :detected | :contained | :eradicated | :recovered | :reviewed | :closed

  def handle_event(:cast, {:transition, :contain}, :detected, data) do
    with :ok <- verify_containment_evidence(data),
         :ok <- start_sla_timer(data, :containment) do
      {:next_state, :contained, %{data | contained_at: DateTime.utc_now()}}
    end
  end

  def handle_event(:cast, {:transition, :eradicate}, :contained, data) do
    with :ok <- verify_eradication_evidence(data),
         :ok <- cancel_sla_timer(data, :containment),
         :ok <- start_sla_timer(data, :eradication) do
      {:next_state, :eradicated, %{data | eradicated_at: DateTime.utc_now()}}
    end
  end
end

Playbook Execution

• Full incident lifecycle management (detect, contain, eradicate, recover) with automated step execution
• Playbook execution engine with step-by-step tracking and rollback capability
• Evidence collection with cryptographic chain of custody verification
• Post-incident review with lessons-learned tracking and pattern extraction for future detection

Evidence Chain of Custody

The evidence chain module implements cryptographic integrity verification using SHA-256 hash chains. Each evidence item added to an incident extends the hash chain, creating a tamper-evident record that satisfies legal and regulatory evidence handling requirements:

defmodule PrismaticIrPvm.EvidenceChain do
  @spec add_evidence(String.t(), Evidence.t()) :: {:ok, Evidence.t()} | {:error, term()}
  def add_evidence(incident_id, evidence) do
    previous_hash = get_chain_head(incident_id)
    entry_hash = compute_hash(previous_hash, evidence)

    entry = %EvidenceEntry{
      incident_id: incident_id,
      evidence: evidence,
      previous_hash: previous_hash,
      entry_hash: entry_hash,
      collected_by: evidence.collector,
      collected_at: DateTime.utc_now()
    }

    {:ok, persist_and_extend_chain(entry)}
  end
end

Patch Management

• Patch deployment tracking with verification testing against staging environments
• SLA enforcement for remediation timelines by severity class with automatic escalation
• Exception management for deferred patches with risk acceptance documentation
• Compliance reporting on patch status across asset inventory for regulatory audits

Usage

# Track a new vulnerability with asset mapping
{:ok, vuln} = PrismaticIrPvm.track_vulnerability(%{
  cve: "CVE-2025-12345",
  assets: ["server-01", "server-02"],
  severity: :critical,
  cvss_score: 9.8
})

# Create incident from detected exploitation
{:ok, incident} = PrismaticIrPvm.create_incident(%{
  type: :exploitation,
  vulnerability: "CVE-2025-12345",
  affected_assets: ["server-01"],
  evidence: [network_capture, log_entries]
})

# Execute containment playbook
{:ok, _} = PrismaticIrPvm.execute_playbook(incident, :containment)

# Track patch deployment
{:ok, _} = PrismaticIrPvm.track_patch(%{
  vulnerability: "CVE-2025-12345",
  patch_id: "KB5025123",
  deployed_to: ["server-01", "server-02"],
  verified: true
})

# Generate compliance report
{:ok, report} = PrismaticIrPvm.compliance_report(window: :last_quarter)
# => %{vulnerabilities_tracked: 234, mean_time_to_remediate: "4.2 days", sla_compliance: 0.97}

NABLA Compliance

Testing

Vulnerability tracking tests verify CVSS scoring accuracy, asset mapping correctness, and state transition validity. Incident lifecycle tests verify state machine transitions, SLA enforcement, and evidence chain integrity using simulated incident scenarios. Playbook execution tests verify step-by-step execution, rollback behavior, and error handling.

Integration tests exercise the full pipeline from vulnerability detection through incident creation, playbook execution, and compliance reporting. Property-based tests generate random vulnerability and incident data to verify state machine invariants. Evidence chain tests verify cryptographic hash chain integrity using tamper injection to confirm detection of corrupted evidence.

Integration Points

Performance

Telemetry events: [:prismatic, :ir_pvm, :vulnerability_tracked], [:prismatic, :ir_pvm, :incident_created], [:prismatic, :ir_pvm, :playbook_step].

Related Resources

• Prismatic Safety -- Safety constraints on incident response actions
• GitLab Security Specialist Agent -- Coordinates vulnerability tracking across CI/CD
• Alert Management Specialist -- Manages incident alert severity and escalation
• Deployment Commander Agent -- Orchestrates patch deployment and rollback
• Real-Time Monitoring -- Enables immediate detection of active exploitation
• Autonomous Self-Healing -- Automated playbook execution during incident response
• Color Teams -- Adversarial-defensive synthesis for vulnerability assessment

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator