Vigil False Positives and Suppression Management

StateWarden’s Vigil Immune System ingests gigabytes of global threat intelligence daily. While this provides unparalleled visibility into your security posture, the reality of the cybersecurity landscape is that security feeds are occasionally noisy.

A vulnerability scanner is only useful if its output is actionable. Alert fatigue caused by hundreds of "False Positives" will cause your SecOps team to ignore the Dashboard entirely.

StateWarden solves this through a granular, auditable Suppression Engine.

1. What Constitutes a False Positive?

A finding reported by Vigil is technically accurate—the hash matches MalwareBazaar, or the package version matches a known CVE in the NVD database. A "False Positive" in this context means the threat is not exploitable or relevant within your specific operational environment.

Common Scenarios:

• Isolated Environments: An outdated version of curl is flagged with a High CVSS score, but the server is completely air-gapped and does not have outbound internet access, rendering the vulnerability unexploitable.
• Upstream Backports (Linux): Enterprise Linux distributions (like Ubuntu LTS or Red Hat) frequently patch critical vulnerabilities by "backporting" the fix into an older version of the software without updating the main version number. Standard CVE feeds look at the version number and incorrectly flag it as vulnerable. (Note: StateWarden's Agent actively tries to detect LTS backports to minimize this natively).
• Internal Security Tools: Custom penetration testing tools or aggressive administrative scripts (e.g., PSExec) might mathematically match behavioral heuristics or specific hashes flagged by MalwareBazaar.

2. Suppressing a Finding

When your security team investigates a finding and determines it poses no risk, they must suppress it to maintain a clean Risk Matrix.

1. Navigate to the Vigil Triage view in the StateWarden Dashboard.
2. Locate the specific finding (e.g., a CVE ID or a specific Malware Hash).
3. Click the Suppress (Ignore) action button.
4. Crucial: You will be prompted to provide a Justification Note. StateWarden mandates this for compliance tracking. Enter a concise technical reason (e.g., "Verified patched via Ubuntu backports. Unexploitable.").
5. Confirm the suppression.

The finding immediately vanishes from the active Triage list and your Realm's total Risk Score drops accordingly.

3. The Auditability of Suppression

In a HighSec environment, hiding a vulnerability is a highly sensitive action.

• RBAC Enforcement: Only users possessing the SUPPORT_L1 or ADMIN roles can execute a suppression command. Standard Operators cannot hide findings.
• The Audit Trail: The suppression action, including the user who executed it and their provided Justification Note, is immutably written to the Realm Audit Log as a VIGIL_SUPPRESSION event.
• The Ignored Tab: Suppressed findings are never deleted from the database. They are moved to the "Ignored" tab within the Vigil UI, allowing compliance officers or external auditors to review the team's security decisions at any time.

4. Un-Suppressing a Finding

If the environmental context changes (e.g., that air-gapped server is suddenly connected to the public internet), the previously suppressed vulnerability becomes a critical threat again.

1. Navigate to the Vigil Triage view.
2. Switch to the Ignored tab.
3. Locate the finding and click Un-Suppress.

The finding will instantly return to the active Triage list, escalating the Risk Score and alerting the team.

StateWarden: Resilience Engineered.