SpecterOps-Nemesis/projects/triage

Triage Service

A microservice for the Nemesis platform that provides automated analysis and classification of security findings using large language models.

Purpose

This service automatically triages security findings generated by the platform, classifying them as true positives, false positives, or requiring manual review. It helps security analysts prioritize their investigation efforts by reducing false positives and highlighting genuine threats.

Features

• Automated triage: Uses LLMs to analyze finding summaries and classify security relevance
• Real-time processing: Subscribes to new findings and processes them immediately
• Multi-category classification: Categorizes findings as true positive, false positive, needs review, or error
• Rule-based preprocessing: Applies deterministic rules for common finding types before LLM analysis
• Context-aware analysis: Considers file paths and metadata when making triage decisions
• Audit trail: Records all triage decisions with timestamps and attribution

Triage Categories

The service classifies findings into four categories:

True Positive

Genuine security issues that require immediate attention, such as:

• Valid credentials in production files
• Active JWT tokens with valid expiration
• Confirmed malware signatures

False Positive

Findings that are incorrectly flagged as security issues, including:

• Test or mock data
• Sample configurations
• Expired or invalid tokens
• Development credentials in test environments

Needs Review

Findings requiring human analysis due to:

• Insufficient context for automated classification
• Ambiguous or complex scenarios
• Novel finding types not covered by existing rules

Error

Processing failures that prevent classification

Processing Logic

Rule-Based Triage

For common finding types, the service applies deterministic rules:

• JWT tokens: Automatically classifies based on expiration status
• Known patterns: Predefined rules for frequent false positive scenarios

LLM-Powered Analysis

For complex findings, the service uses configured LLMs to:

• Analyze finding summaries and context
• Consider file paths and origins
• Make nuanced decisions based on security expertise
• Provide consistent classification across similar findings

Configuration

• RIGGING_GENERATOR_TRIAGE: LLM configuration for triage analysis (required for LLM-based triage)

Data Flow

1. Subscription: Monitors new NoseyParker findings without existing triage decisions
2. Detail fetch: Retrieves complete finding information including file context
3. Classification: Applies rule-based logic or LLM analysis
4. Recording: Stores triage decision in the database with automated attribution
5. Notification: Updates finding status for dashboard visibility

Integration

• Hasura GraphQL: Real-time finding subscriptions and triage record storage
• Rigging Framework: LLM integration for intelligent analysis
• Minio Storage: Access to original files for context analysis

Health Monitoring

• GET /healthz: Health check endpoint for service monitoring