Sample CVE Investigation

Use this sample when a user asks whether a known CVE needs action. The example keeps the workflow bounded: resolve the CVE, retrieve focused evidence, pivot relationships, run the assessment, then produce a recommendation with caveats.

Scenario

A security engineer asks:

Should we prioritize CVE-2024-3094 for a Linux fleet that includes developer workstations and build infrastructure?

REST Flow

Set request-scoped IDs once so each API call can be tied back to the same investigation.

export KYBERIS_BASE_URL="https://api.kyberis.ai"
export RUN_ID="run-cve-3094-sample"

1. Resolve the CVE

curl -sS -X POST "$KYBERIS_BASE_URL/v2/entity-resolution" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Resolve CVE-2024-3094 before risk assessment.",
      "requested_outcome": "Canonical CVE entity for downstream evidence and assessment calls.",
      "workflow_stage": "resolve",
      "run_id": "run-cve-3094-sample",
      "step_id": "resolve-cve"
    },
    "query": "CVE-2024-3094",
    "expected_types": ["cve"],
    "resolution": {
      "max_results": 5,
      "include_aliases": true,
      "include_metadata": true
    }
  }' | jq .

Representative response excerpt:

{
  "request_id": "req_sample_cve_resolve",
  "resolution": {
    "status": "resolved",
    "confidence": "high"
  },
  "entity_type": "cve",
  "canonical_id": "cve--CVE-2024-3094",
  "canonical_name": "CVE-2024-3094"
}

2. Retrieve Active Exploitation Evidence

curl -sS -X POST "$KYBERIS_BASE_URL/v2/evidence" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Check whether CVE-2024-3094 has exploitation evidence.",
      "requested_outcome": "Bounded evidence for active exploitation or observed abuse.",
      "workflow_stage": "evidence",
      "run_id": "run-cve-3094-sample",
      "step_id": "evidence-active-exploitation"
    },
    "subject": {
      "entity_type": "cve",
      "canonical_id": "cve--CVE-2024-3094",
      "canonical_name": "CVE-2024-3094"
    },
    "claim_type": "active_exploitation",
    "max_results": 5
  }' | jq .

Representative response excerpt:

{
  "request_id": "req_sample_cve_evidence",
  "claim_type": "active_exploitation",
  "items": [
    {
      "evidence_id": "report--sample-xz-backdoor",
      "evidence_type": "report",
      "confidence": "high",
      "summary": "Reporting describes a supply-chain backdoor in affected XZ Utils versions."
    }
  ]
}

3. Pivot Relationships

curl -sS -X POST "$KYBERIS_BASE_URL/v2/relationships" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Find related entities for CVE-2024-3094.",
      "requested_outcome": "Actors, malware, campaigns, indicators, and techniques relevant to the CVE.",
      "workflow_stage": "relationships",
      "run_id": "run-cve-3094-sample",
      "step_id": "relationships-cve"
    },
    "subject": {
      "entity_type": "cve",
      "canonical_id": "cve--CVE-2024-3094",
      "canonical_name": "CVE-2024-3094"
    },
    "relationship_types": ["campaign", "malware", "sector", "ioc", "technique"],
    "max_results": 10
  }' | jq .

Representative response excerpt:

{
  "request_id": "req_sample_cve_relationships",
  "relationships": [
    {
      "relationship_type": "technique",
      "target_name": "Supply Chain Compromise",
      "confidence": "medium",
      "supporting_evidence": ["report--sample-xz-backdoor"]
    }
  ]
}

4. Run the CVE Assessment

curl -sS -X POST "$KYBERIS_BASE_URL/v2/cve-assessments" \
  -H "Authorization: ApiKey $KYBERIS_API_KEY_ID:$KYBERIS_API_KEY_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_context": {
      "objective": "Decide whether CVE-2024-3094 requires immediate action.",
      "requested_outcome": "Deterministic risk guidance with evidence references.",
      "workflow_stage": "assessment",
      "run_id": "run-cve-3094-sample",
      "step_id": "assessment-cve"
    },
    "query": "CVE-2024-3094",
    "context": {
      "known_targets": ["XZ Utils 5.6.0", "XZ Utils 5.6.1"],
      "targeted_industries": ["technology"],
      "intel_confidence": "medium"
    }
  }' | jq .

Representative response excerpt:

{
  "request_id": "req_sample_cve_assessment",
  "recommendation": "validate_exposure",
  "priority": "high",
  "confidence_score": 0.86,
  "evidence_refs": ["report--sample-xz-backdoor"],
  "caveats": ["Confirm whether affected package versions exist in the environment."]
}

Final Answer Example

Recommendation: Validate exposure immediately and patch or roll back affected XZ Utils versions if found. Why now: Kyberis resolved CVE-2024-3094 with high confidence and found high-confidence evidence describing supply-chain backdoor activity. The affected package family can matter to developer workstations and build infrastructure. Confidence: High for the CVE match and public risk signal. Environment-specific confidence depends on whether XZ Utils 5.6.0 or 5.6.1 is present. Supporting evidence: report--sample-xz-backdoor. Request IDs: req_sample_cve_resolve, req_sample_cve_evidence, req_sample_cve_relationships, req_sample_cve_assessment. Next actions: Inventory package versions, isolate or rebuild affected hosts, and document whether the vulnerable versions were ever deployed.

Decision Gates

If resolution is ambiguous, retry with expected_types: ["cve"] or ask for the exact CVE.
If evidence is sparse, recommend exposure validation instead of emergency remediation.
If the assessment cites evidence IDs, hydrate critical evidence with GET /v2/evidence/{evidence_id} before a high-impact final report.

Getting started

Install Kyberis

Threat investigations

Sample investigations

Interpret responses

Scenario

REST Flow

1. Resolve the CVE

2. Retrieve Active Exploitation Evidence

3. Pivot Relationships

4. Run the CVE Assessment

Final Answer Example

Decision Gates

​Scenario

​REST Flow

​1. Resolve the CVE

​2. Retrieve Active Exploitation Evidence

​3. Pivot Relationships

​4. Run the CVE Assessment

​Final Answer Example

​Decision Gates

Scenario

REST Flow

1. Resolve the CVE

2. Retrieve Active Exploitation Evidence

3. Pivot Relationships

4. Run the CVE Assessment

Final Answer Example

Decision Gates