Three lanes, one rule

Useful to a defender who has a product to patch.

The desk studies vulnerabilities, malware, and detection. A public note has to survive being read by someone who does not run our lab. That means class, impact, and the check. It does not mean a recipe.

How a catalog row becomes a note

Each card links to the note that explains the step

01 Entry CISA adds a row Alert, catalog version, date added, due date, triage flag. Source: CISA alert

02 Match Do we run it? Vendor and product against the inventory, including the lab and the recovery site. Tool: match your list

03 Reach Who can get to it? Internet, partner network, users, admins only. What the attacker needs first. Sets the order 02b Close Not ours Write down why, so the next person does not reopen it.

04 Fix Install the advisory build Collect logs and config first. Confirm the build on the device afterwards. Vendor advisory

05 Look back Was it used here? Accounts, config, files, persistence, outbound traffic, for the whole window. Triage flag 06 Note Print the class and the check Not the steps. Five lines of record for the internal ticket.

Vulnerabilities

KEV first, because someone is already using it. Vendor advisory second, because that is where the build number is.

MethodRead the due date before you read CVSS MethodCVSS, EPSS and KEV answer three different questions OrderThirteen of thirty-eight rows are boxes at the edge ResponsePatched is not the same as clean 119977The WordPress fix is unpacked by the old code 19868SAML is not the only door on SonicOS SSLVPN 27834Pointer authentication, added two years late

Malware

Behavior of code that already exists. No samples, no build notes, no family write-up that doubles as a manual.

BehaviorA new hash is not a new behavior BehaviorSigned binary, unsigned intent

Detection

A question a log can answer after the filename changes. Not a rule pasted from someone else's exploit.

SessionsA session that did not come from the identity provider ProcessA web server should not start a shell

Contact

Write the impact, not the steps.

Tell us the product, the version you actually run, and what you need: a second read, a detection question, or a coordinated note. Do not put reproduction steps, exploits, or samples in this form. If a private channel is warranted, we answer first and set it up after.

Letters go to disclosure@heldnote.live.

Heldnote · the form opens your mail client. It does not store the message.