OT Triage 0.7.0: advisories, assets and a command line
OT Triage 0.7.0 is out. The thread running through it is the same one as the first release: a vulnerability list is only useful if it tells you what to do on a specific asset, in a short outage window, with what the vendor actually says.
What’s new
- CISA ICS advisories. Look up a CVE and the tool shows which of CISA’s ICS advisories name it, linked to the advisory on cisa.gov. It also reads what each advisory says about a fix, per CVE: a vendor fix, a fix for some products only, a mitigation only, no fix yet or no fix planned. Under each advisory it lists the vendor’s own steps, in the vendor’s words, with the vendor’s link when there is one. None of it changes a bucket: it is context to read before you act.
- By asset. OT gets patched in short windows, so there is now a view that groups the findings by asset: the worst bucket on each, and what could be handled on one visit. Give your inventory a vendor and a product and it also points at the advisories that may apply to each asset. That is a pointer, not proof, because it does not know which firmware you run.
- Compare with a previous export. Load last week’s ranked CSV and see what is new, what moved up or down and what was resolved.
- A command line. The same ranking from a script or a scheduled job, with an exit code you can gate on, for example failing a pipeline when anything is NOW.
- A portable download. One zip, a checksum, and a launcher you can double-click. No installer and no
.exe, on purpose: it is plain Python you can read before you run it. - The OkieOTSec look. The brand kit is in the app now: the shield, the colours and the risk palette.
What did not change
The rules. A NOW is still a NOW for the same reasons it was in 0.6.0, and every new feature sits beside the answer rather than moving it. That is a deliberate line: the advisory data, the roll-up and the comparison are there to help you act, not to quietly rerank your list.
Get it
The release, the checksum and the software bill of materials are on GitHub, and the projects page has the screenshots. Next on my list is making the advisory matching aware of the firmware version, so it can say whether the version on your asset is the one an advisory covers. If you work in OT and something here is wrong for your environment, open an issue or email me at hello@okieotsec.com.