Triage a scanner export down to findings you can defend

applied · 85 min · Objective 3.2

Task

Take a full scanner export from your lab and triage it into a short list of findings you have each reproduced and can defend, recording a reason for every one you drop. Fewer demonstrated findings beat more inferred ones — for the client and for your credibility. Objective 3.2 is result analysis.

Steps

  1. From the lab you own, take the raw scanner export of several hosts into /tmp/raw.txt — it will be long and mostly leads, not findings.
  2. Group by rule, not by occurrence: two hundred findings are often a handful of rules, judged once.
  3. For each rule that might become a finding, reproduce it independently on the lab host, and record the evidence.
  4. Write /tmp/validated.md with one entry per confirmed finding: finding:, evidence:, severity: (base, adjustment, reason), and impact: for this environment.
  5. Write /tmp/dropped.md with every dropped item and a one-line reason: false positive, not reachable, not exploitable, or asset does not matter — a durable decision, so it is not re-triaged next run.
  6. Confirm the validated list is far shorter than the raw export.

Verify

grep -cE "^finding:" /tmp/validated.md
grep -cE "^severity:.*because|^severity:.*reason" /tmp/validated.md
grep -cE "^drop:" /tmp/dropped.md

The first count is your defensible findings — it must be non-zero and, read against the raw export's length, far smaller. The second must equal the first: every finding carries a severity with a stated reason, which is what survives a challenge. The third must be non-zero: you recorded why each dropped item was dropped, so the decision is durable rather than repeated every run.

Notes

A report of twelve findings you can each prove is worth far more than one of ninety copied from a scanner, and it takes less of everyone's time. Record dismissals with reasons — "not exploitable because input is constrained at the controller" is a decision; silently ignoring it means re-triaging the same finding forever. The inverse matters too: a generically low finding can be critical here, usually because of a chain. Everything ran on hosts you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.