{ "dataset_id": "HERMES-DECISION-2026", "title": "Hermes Prescriptive Decision Engine & Remediation Arbitration Dataset", "updated_at": "2026-09-18T18:00:00Z", "version": "3.0.0", "methodology_version": "HDEM-v1.0", "directive_taxonomy": [ { "directive_id": "PATCH", "name": "Immediate Vendor Patching", "description": "Deploy official vendor security updates, backports, or hotfixes to eliminate underlying vulnerability permanently.", "default_sla": "< 24 Hours (Critical) / < 7 Days (High)", "primary_trigger_condition": "Vendor patch verified stable AND (Exploit in KEV OR Public PoC with reachable attack surface).", "operational_tradeoff": "Requires service restart or maintenance window; potential regression risk.", "rollback_risk": "Low to Moderate." }, { "directive_id": "MITIGATE", "name": "Compensatory Defensive Mitigation", "description": "Deploy external perimeter controls (WAF virtual patch, eBPF socket drop, ingress firewall rules, or feature toggle) to block exploitation without touching underlying codebase.", "default_sla": "< 4 Hours", "primary_trigger_condition": "Active zero-day without vendor patch OR high patch disruption during strict operational freeze.", "operational_tradeoff": "Risk of false positives on non-standard client traffic; maintenance overhead of rule lifecycle.", "rollback_risk": "Very Low (Instantaneous rule disablement)." }, { "directive_id": "ISOLATE", "name": "Perimeter & Network Quarantine", "description": "Sever untrusted network access, move asset to isolated quarantine VLAN, drop default routing, or confine execution inside an ephemeral microVM sandbox.", "default_sla": "< 1 Hour (Urgent)", "primary_trigger_condition": "Unauthenticated RCE under active wild exploitation on critical asset where no patch or WAF mitigation exists.", "operational_tradeoff": "Temporary functional impairment of external integrations or service reachability.", "rollback_risk": "Instantaneous (Route restoration)." }, { "directive_id": "REPLACE", "name": "Architectural Deprecation & Replacement", "description": "Decommission and replace unmaintained, abandonware, or structurally defective components with hardened modern alternatives.", "default_sla": "< 30 Days", "primary_trigger_condition": "Component is End-of-Life (EOL), unpatched for > 90 days, or architecturally unsecurable.", "operational_tradeoff": "Substantial migration engineering effort and regression testing cycles.", "rollback_risk": "High (Multi-system architectural migration)." }, { "directive_id": "ACCEPT", "name": "Formalized Risk Acceptance", "description": "Document and formalize conscious business risk acceptance when vulnerability is unreachable, purely theoretical, or remediation cost exceeds maximum potential loss.", "default_sla": "Quarterly Review Cycle", "primary_trigger_condition": "HTS < 40 AND Exploitability is Theoretical AND Network Reachability is zero (air-gapped / unexposed).", "operational_tradeoff": "Zero immediate operational expenditure; residual compliance audit tracking.", "rollback_risk": "Zero." }, { "directive_id": "MONITOR", "name": "Enhanced Telemetry & Threat Hunting", "description": "Deploy targeted SIEM detection rules, Canary tokens, and auditd/Sysmon probes to detect early exploitation attempts without altering production code.", "default_sla": "< 48 Hours", "primary_trigger_condition": "Newly disclosed CVE with high theoretical severity but zero in-the-wild weaponization or weaponized exploit circulating on specialized darknet channels.", "operational_tradeoff": "SIEM ingestion bandwidth and SOC analyst triage load.", "rollback_risk": "Negligible." } ], "evaluation_dimensions": [ { "dimension_id": "asset_criticality", "name": "Asset Criticality & Business Impact", "weight": 0.25, "description": "Operational dependency and regulatory sensitivity of the host system running the vulnerable software.", "scale": [ { "level": "TIER_0", "label": "Crown Jewels (Core DB, Identity Provider, KMS, Production Hypervisor)", "factor": 1 }, { "level": "TIER_1", "label": "Mission Critical (Public API, Customer Portal, ERP, E-Commerce)", "factor": 0.8 }, { "level": "TIER_2", "label": "Business Operational (Internal CRM, Analytics, File Shares)", "factor": 0.5 }, { "level": "TIER_3", "label": "Internal Dev / Non-Production (Test cluster, Dev sandbox, CI runner)", "factor": 0.2 } ] }, { "dimension_id": "network_reachability", "name": "Network Reachability & Attack Surface", "weight": 0.25, "description": "Accessibility of the vulnerable port or interface to potential threat actors.", "scale": [ { "level": "PUBLIC_INTERNET", "label": "Direct Public Internet Exposure (Zero Auth / Public IP)", "factor": 1 }, { "level": "DMZ_PROXY", "label": "DMZ with Reverse Proxy / Gateway Auth", "factor": 0.75 }, { "level": "INTERNAL_VPC", "label": "Internal Corporate VPC (Requires VPN or 802.1X)", "factor": 0.45 }, { "level": "AIR_GAPPED", "label": "Air-gapped / Localhost Bound (No external socket)", "factor": 0.1 } ] }, { "dimension_id": "exploit_weaponization", "name": "Exploit Weaponization & Threat Telemetry", "weight": 0.25, "description": "Real-world weaponization state of the vulnerability across KEV catalogs and underground forums.", "scale": [ { "level": "CISA_KEV_WILD", "label": "CISA KEV Confirmed Active In-the-Wild Exploitation", "factor": 1 }, { "level": "WEAPONIZED_POC", "label": "Reliable Weaponized Exploit / Metasploit Module Public", "factor": 0.8 }, { "level": "ACADEMIC_POC", "label": "Proof-of-Concept / Technical Writeup Published", "factor": 0.5 }, { "level": "THEORETICAL", "label": "Vendor Advisory Only / Theoretical Vulnerability", "factor": 0.2 } ] }, { "dimension_id": "disruption_cost", "name": "Patch Disruption & Operational Penalty", "weight": 0.15, "description": "Business and availability cost of applying an immediate vendor patch.", "scale": [ { "level": "ZERO_DOWNTIME", "label": "Hot-patch / Rolling Restart (Zero Downtime)", "factor": 0.1 }, { "level": "SCHEDULED_RESTART", "label": "Short Restart within Scheduled Maintenance Window", "factor": 0.4 }, { "level": "MODERATE_DOWNTIME", "label": "Moderate Outage / Database Migration Required", "factor": 0.7 }, { "level": "SEVERE_OUTAGE", "label": "Major Business Interruption / Breaking API Changes", "factor": 1 } ] }, { "dimension_id": "mitigation_feasibility", "name": "Compensatory Control Feasibility", "weight": 0.1, "description": "Availability of alternative defensive controls (WAF rules, eBPF filters, config workarounds).", "scale": [ { "level": "IMMEDIATE_WAF", "label": "Drop-in WAF virtual patch or single config flag disablement", "factor": 1 }, { "level": "PARTIAL_FILTER", "label": "Network ACL or port restriction feasible with minor feature impact", "factor": 0.7 }, { "level": "COMPLEX_CUSTOM", "label": "Complex custom eBPF probe or proxy script required", "factor": 0.4 }, { "level": "NO_FALLBACK", "label": "No compensatory control exists (Must patch or isolate)", "factor": 0 } ] } ], "prescriptive_playbooks": [ { "playbook_id": "PLAY-01-EBPF-DROP", "title": "eBPF Sub-Millisecond Kernel Socket Drop", "directive": "MITIGATE", "execution_layer": "Linux Kernel XDP / TC", "implementation_snippet": "SEC(\"xdp\") int xdp_drop_cve(struct xdp_md *ctx) { void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; struct ethhdr *eth = data; if ((void *)(eth + 1) > data_end) return XDP_PASS; if (eth->h_proto == bpf_htons(ETH_P_IP)) { struct iphdr *ip = (void *)(eth + 1); if ((void *)(ip + 1) > data_end) return XDP_PASS; if (ip->protocol == IPPROTO_TCP) { struct tcphdr *tcp = (void *)(ip + 1); if ((void *)(tcp + 1) > data_end) return XDP_PASS; if (tcp->dest == bpf_htons(7001)) return XDP_DROP; } } return XDP_PASS; }", "verification_command": "bpftool prog show name xdp_drop_cve && bpftool net list" }, { "playbook_id": "PLAY-02-WAF-VIRTUAL-PATCH", "title": "ModSecurity / Coraza Virtual Regex Patch", "directive": "MITIGATE", "execution_layer": "Reverse Proxy / WAF", "implementation_snippet": "SecRule REQUEST_URI \"@rx (?:/api/v1/reset_password|/guest/provision)\" \"id:100901,phase:2,deny,status:403,log,msg:'Hermes Virtual Patch: Malformed Account Provisioning Replay'\"", "verification_command": "curl -ik -X POST https://target/api/v1/reset_password -d 'malformed' | grep 403" }, { "playbook_id": "PLAY-03-VLAN-QUARANTINE", "title": "Automated Micro-Segmentation Quarantine", "directive": "ISOLATE", "execution_layer": "Software-Defined Network (SDN) / Calico / Cilium", "implementation_snippet": "apiVersion: cilium.io/v2\nkind: CiliumNetworkPolicy\nmetadata:\n name: emergency-isolate-asset\nspec:\n endpointSelector:\n matchLabels:\n app.kubernetes.io/name: vulnerable-workload\n ingress: []\n egress: []", "verification_command": "cilium endpoint list | grep vulnerable-workload" }, { "playbook_id": "PLAY-04-MODULE-UNLOAD", "title": "Vulnerable Kernel Module Dynamic Blacklist", "directive": "MITIGATE", "execution_layer": "Host OS Modprobe", "implementation_snippet": "rmmod ebt_snat || modprobe -r ebt_snat && echo 'install ebt_snat /bin/true' > /etc/modprobe.d/cve-2026-53266-mitigation.conf", "verification_command": "lsmod | grep ebt_snat || echo 'Module successfully unmapped'" }, { "playbook_id": "PLAY-05-DECOMMISSION-WORKFLOW", "title": "Graceful Sunset & Architecture Replacement", "directive": "REPLACE", "execution_layer": "Infrastructure as Code (Terraform / Helm)", "implementation_snippet": "resource \"kubernetes_deployment\" \"legacy_workload\" {\n metadata {\n annotations = {\n \"hermes.codex/deprecated\" = \"true\"\n \"hermes.codex/sunset-date\" = \"2026-10-15\"\n }\n }\n spec {\n replicas = 0\n }\n}", "verification_command": "kubectl get deployments -A -l hermes.codex/deprecated=true" }, { "playbook_id": "PLAY-06-AUDITD-PROBE", "title": "High-Fidelity Kernel Syscall Audit Probe", "directive": "MONITOR", "execution_layer": "Linux auditd", "implementation_snippet": "auditctl -a always,exit -F arch=b64 -S setsockopt -F a2=0x2710 -k cve_2026_ebtables_exploit\nauditctl -a always,exit -F arch=b64 -S sendmsg -F a0=3 -k cve_2025_afalg_race", "verification_command": "ausearch -k cve_2026_ebtables_exploit --raw" } ], "benchmark_cases": [ { "case_id": "DEC-CASE-2026-001", "threat_id": "CVE-2026-76460", "target_technology": "Cisco Identity Services Engine (ISE)", "hts_score": 98, "recommended_directive": "ISOLATE", "target_sla": "< 1 Hour", "context_scenario": "Tier 0 Identity & Zero Trust policy plane exposed to guest network with in-the-wild zero-day exploitation circulating.", "decision_rationale": "Given that Cisco ISE acts as the enterprise policy engine (Tier 0) and the exploit is zero-day without an immediately verifiable vendor patch, network isolation of the guest portal is paramount to prevent immediate cloud tenant takeover." }, { "case_id": "DEC-CASE-2026-002", "threat_id": "CVE-2026-83021", "target_technology": "Oracle WebLogic Server", "hts_score": 98, "recommended_directive": "MITIGATE", "target_sla": "< 4 Hours", "context_scenario": "Tier 1 production WebLogic application cluster during active end-of-quarter financial freeze. Direct patching requires 6-hour system reboot.", "decision_rationale": "While HTS is 98 and CVSS is 10.0, the enterprise change freeze renders immediate patching high-risk. Deploying an eBPF/firewall filter blocking T3/IIOP ports (7001/7002) mitigates 100% of the deserialization attack surface in under 4 hours, deferring the binary patch to the weekend window." }, { "case_id": "DEC-CASE-2026-003", "threat_id": "CVE-2026-53266", "target_technology": "Linux Kernel ebtables", "hts_score": 94, "recommended_directive": "MITIGATE", "target_sla": "< 4 Hours", "context_scenario": "Multi-tenant Kubernetes worker nodes running Linux kernel with unprivileged user namespaces enabled.", "decision_rationale": "Unloading the vulnerable kernel module (rmmod ebt_snat) instantly closes the out-of-bounds slab write primitive without requiring an immediate node reboot or workload eviction." }, { "case_id": "DEC-CASE-2026-004", "threat_id": "CVE-2026-87886", "target_technology": "Acronis Cyber Protect (cPanel)", "hts_score": 96, "recommended_directive": "PATCH", "target_sla": "< 12 Hours", "context_scenario": "Multi-tenant web hosting server where shared hosting users can leverage symlinks to escalate to root.", "decision_rationale": "Because shared tenants have legitimate shell and PHP execution access, compensatory filtering cannot reliably prevent symlink race conditions. Official vendor patch must be rolled out across the fleet within 12 hours." }, { "case_id": "DEC-CASE-2026-005", "threat_id": "CVE-2026-27966", "target_technology": "Langflow CSV AI Agent", "hts_score": 96, "recommended_directive": "ISOLATE", "target_sla": "< 2 Hours", "context_scenario": "Internal AI research platform running Langflow with direct host execution permissions.", "decision_rationale": "The model's prompt injection vulnerability allows direct Python REPL RCE. The agent workload must be immediately isolated into ephemeral microVMs (Firecracker), followed by deprecating the unconstrained CSV tool." }, { "case_id": "DEC-CASE-2026-006", "threat_id": "CVE-2025-39964", "target_technology": "Linux Kernel AF_ALG Crypto API", "hts_score": 88, "recommended_directive": "PATCH", "target_sla": "< 24 Hours", "context_scenario": "Enterprise Linux servers added to CISA KEV on September 18, 2026.", "decision_rationale": "Weaponized concurrency race condition in crypto sockets. With stable kernel updates available (commit 1b34cbbf4f01), applying the kernel update during the daily rollout window is the decisive remediation." } ] }