Getting Started with GENE-CVE

This guide will walk you through your first use of GENE-CVE. It covers the basic workflow, the different types of output you can expect, and how to interpret the results for your specific role.

1. Prerequisites

Before you begin, ensure you have the following:

• Access to the Feluda Environment: GENE-CVE is available as a Feluda Gene. You need access to an instance where the gene is deployed.
• A Valid CVE ID: Have a CVE ID ready to look up. For example, CVE-2021-44228 (Log4Shell) or CVE-2017-0144 (EternalBlue). You can find these on the official CVE list.

2. Performing Your First Lookup

The core workflow for using GENE-CVE is simple and can be adapted to your specific interface (e.g., a chat interface, an API call, or a Feluda Flow).

1. Input the CVE ID: Provide the CVE ID you wish to investigate as the input to the cve_lookup tool.
2. Receive Core Data: The tool immediately returns the core vulnerability data. This includes the official description, the affected product(s), the date the CVE was published, and a link to the official source.
3. Select Your Report Format: Based on your role and what you need to do with the information, choose one of the three prompt workflows:

• Analyst Prompt: Use this for a deep technical dive. It will guide the assistant to produce a detailed explanation, focusing on the technical nature of the vulnerability, affected components, and potential exploitability.
• SOC Prompt: Use this for operational context. The output is structured like an incident brief, suitable for triage. It focuses on immediate detection, response steps, and containment strategies.
• Executive Prompt: Use this to translate the technical details into a business risk summary. It provides a clear, concise overview suitable for leadership, focusing on potential business impact and recommended strategic actions.

3. Understanding the Outputs

The value of GENE-CVE is in how it structures the raw data. Here is a breakdown of what you will see in each format:

• Core Data (The Foundation): Every lookup returns the raw JSON data from the CVE list. This is the source truth that all other outputs are based on.
• Analyst Output: You will receive a detailed breakdown. It will include a full technical description, the Common Vulnerability Scoring System (CVSS) score and vector if available, a list of affected software, and a discussion of known exploits. This output is designed to inform deep investigation and remediation planning.
• SOC Output: This output is framed for action. It will include a severity classification, a clear statement of immediate threat, and a list of actionable steps for detection, containment, and eradication. The language is direct and operational.
• Executive Output: This output uses plain, business-centric language. It will summarize the vulnerability's impact on business operations, outline potential risks to the organization, and provide clear, high-level recommendations for prioritization.

4. Next Steps After Your First Lookup

Once you are comfortable with the basic workflow, you can begin to integrate GENE-CVE into more advanced processes.

• Integrate into a Flow: Use GENE-CVE as a step in a larger Feluda Flow. For example, you could trigger the lookup automatically when a new CVE is published or when a specific event is detected.
• Customize Your Prompts: While the default prompts are robust, you can tailor them to better fit your organization's specific reporting style or vocabulary.
• Automate Routing: Combine GENE-CVE with other Feluda actions to automatically send the generated Analyst, SOC, or Executive reports to the appropriate teams or communication channels.

By following this guide, you have successfully used GENE-CVE to turn a single CVE ID into actionable intelligence, ready to be used for investigation, response, or strategic planning.