NOULI

Examples

Firewall vulnerability response

The recorded response first recommends tested failover and remediation while assessing compromise. After the investigation finding, it recommends evidence preservation, containment, and coordinated incident recovery.

The problem

A firewall providing essential remote access is affected by CVE-2024-3400. A tested standby is available, so remediation must account for service continuity as well as exposure. A later investigation confirms unauthorized execution on the affected device, changing the response from vulnerability remediation to incident handling.

This is a retrospective example using the May 3, 2024 revision of the Palo Alto Networks CVE-2024-3400 advisory. The asset, readiness checks, and investigation finding are illustrative. The historical software versions are not current deployment recommendations.

What we will do

We will create independent histories for vendor guidance, asset impact, and operational readiness. Two blends will assess exposure and how to preserve service. We will combine those decisions into a response, then blend in a separate investigation finding to revise it.

Before you start

Configure a provider and model, then run the commands in order in the same shell. Nouli reads credentials from your shell or the .env in your current directory. Each decision calls your configured provider and may incur charges.

The outputs below were captured with typesafe/jev-1.14.0. They are a recorded run, not guaranteed results. Probabilities, session IDs, and model answers may differ when you run the commands.

Set a session prefix for this walkthrough. Change it before repeating the example so the new sessions have unique names:

example=cyber
show the steps as

Open the first session with nouli open advisory, then type each step's lines at the prompt. A question sends the turn.

01Record vendor guidance

Record vendor guidance independently of a particular asset. This source establishes applicability and the recommended remediation direction for the historical advisory revision.

$ nouli open advisory
new session "advisory" · /help for commands

advisory › Vendor advisory CVE-2024-3400, May 3, 2024 revision: affected PAN-OS 10.2, 11.0, or 11.1 firewalls with a GlobalProtect gateway or portal can be exposed. Telemetry does not need to be enabled. Exploitation has been reported. For the 11.1.2 branch, 11.1.2-h3 fixes the initial vulnerability; 11.1.2-h2 precedes the fix. The vendor advises upgrading affected systems even when mitigations have been applied.
advisory › ?advisory: What does the advisory recommend for an affected system? [Promptly upgrade even if mitigations are in place, Rely on existing mitigations, Obtain vendor clarification before selecting a response]
  turn 1 · 1 fact · 1 question
  advisory    ▶ Promptly upgrade even if mitiga… ████████████████████ 1.00
                Rely on existing mitigations                          0.00
                Obtain vendor clarification bef…                      0.00
nouli --format text new "$example-advisory" \
  'Vendor advisory CVE-2024-3400, May 3, 2024 revision: affected PAN-OS 10.2,
11.0, or 11.1 firewalls with a GlobalProtect gateway or portal can be exposed.
Telemetry does not need to be enabled. Exploitation has been reported. For the
11.1.2 branch, 11.1.2-h3 fixes the initial vulnerability; 11.1.2-h2 precedes
the fix. The vendor advises upgrading affected systems even when mitigations
have been applied.' \
  -q 'advisory: What does the advisory recommend for an affected system? [Promptly upgrade even if mitigations are in place,
    Rely on existing mitigations,
    Obtain vendor clarification before selecting a response]'

Output

  turn 1 · 1 fact · 1 question
  advisory    ▶ Promptly upgrade even if mitiga… ████████████████████ 1.00
                Rely on existing mitigations                          0.00
                Obtain vendor clarification bef…                      0.00
  typesafe/jev-1.14.0 · session 01a1878e-1ddf-743c-ae12-e70fbea28000 · turn 01a1878e-1de1-739c-9f6c-6ad8f9e68fa2

The model selects prompt upgrading even when mitigations are in place. This is a recommendation based on the recorded advisory; no system change is performed.

02Assess the service impact

Record the asset version, portal configuration, and operational importance in a separate history. Use a score to assess service impact, not exposure.

advisory › /new asset
  new session "asset"
asset › Illustrative asset Edge-01 runs PAN-OS 11.1.2-h2 and has an internet-facing GlobalProtect portal enabled. Telemetry is disabled. It provides essential remote access for the operations team. Losing it would stop the remote shift from working. Assess the service impact only.
asset › ?asset: How important is preserving this service during remediation? <Minor inconvenience, Important service, Essential service>
  turn 1 · 1 fact · 1 question
  asset         expected 1.99 of 2   ▁▁█
                Minor inconvenience 0.00 · Important service 0.01 · Essential service 0.99
nouli --format text new "$example-asset" \
  'Illustrative asset Edge-01 runs PAN-OS 11.1.2-h2 and has an internet-facing
GlobalProtect portal enabled. Telemetry is disabled. It provides essential
remote access for the operations team. Losing it would stop the remote shift
from working. Assess the service impact only.' \
  -q 'asset: How important is preserving this service during remediation? <Minor inconvenience,
    Important service,
    Essential service>'

Output

  turn 1 · 1 fact · 1 question
  asset         expected 1.99 of 2   ▁▁█
                Minor inconvenience 0.00 · Important service 0.01 · Essential service 0.99
  typesafe/jev-1.14.0 · session 01a1878e-1de9-749c-ad3d-3b93968762dd · turn 01a1878e-1deb-75be-80d1-9fdca771b36d

The returned score is 1.99 on the 0-2 rubric, almost entirely the highest service-impact level. Exposure is assessed in a separate branch.

03Review the available change window

Record operational readiness independently. The standby and failover checks are supplied evidence, not actions the command performs.

asset › /new operations
  new session "operations"
operations › Illustrative operations record: a separate standby running PAN-OS 11.1.2-h3 has passed application and failover checks. Approved failover takes five minutes and keeps remote access available. The upgrade path has been validated with vendor support. No failover or upgrade has been performed.
operations › ?operations: Which change approach is ready to use? [Move service to the tested standby before working on Edge-01, Upgrade Edge-01 in place with a service outage, Schedule more preparation before making a change]
  turn 1 · 1 fact · 1 question
  operations  ▶ Move service to the tested stan… ███████████████████▍ 0.97
                Upgrade Edge-01 in place with a…                      0.00
                Schedule more preparation befor… ▋                    0.03
nouli --format text new "$example-operations" \
  'Illustrative operations record: a separate standby running PAN-OS 11.1.2-h3
has passed application and failover checks. Approved failover takes five
minutes and keeps remote access available. The upgrade path has been validated
with vendor support. No failover or upgrade has been performed.' \
  -q 'operations: Which change approach is ready to use? [Move service to the tested standby before working on Edge-01,
    Upgrade Edge-01 in place with a service outage,
    Schedule more preparation before making a change]'

Output

  turn 1 · 1 fact · 1 question
  operations  ▶ Move service to the tested stan… ███████████████████▍ 0.97
                Upgrade Edge-01 in place with a…                      0.00
                Schedule more preparation befor… ▋                    0.03
  typesafe/jev-1.14.0 · session 01a1878e-1df2-732f-b9c4-cc84d02a20ec · turn 01a1878e-1df4-75dc-93f9-fad6af13726c

The model selects moving service to the tested standby before work on Edge-01. It is recommending a ready option, not initiating failover.

04Determine asset exposure

Blend advisory and asset histories to assess applicability. Telemetry being disabled is not enough to rule out this historical vulnerability.

operations › /blend advisory asset as exposure
  new session "exposure" from advisory + asset · no standing questions
exposure › Apply the published applicability criteria to the recorded version and GlobalProtect configuration. Assess exposure separately from whether compromise has occurred.
exposure › ?exposure: Is Edge-01 affected by CVE-2024-3400?
  turn 1 · 1 fact · 1 question
  exposure      yes                              ███████████████████  0.95
nouli --format text new "$example-exposure" --from "$example-advisory" --from "$example-asset" \
  'Apply the published applicability criteria to the recorded version and
GlobalProtect configuration. Assess exposure separately from whether
compromise has occurred.' \
  -q 'exposure: Is Edge-01 affected by CVE-2024-3400?'

Output

  turn 1 · 1 fact · 1 question
  exposure      yes                              ███████████████████  0.95
  typesafe/jev-1.14.0 · session 01a1878e-1dfc-776f-a61b-85af0c8acdbf · turn 01a1878e-1dfe-722a-bf91-49f3c9444d7d

P(yes)=0.95 is the probability that Edge-01 is affected according to the model. It is not the probability that exploitation has already occurred.

05Choose how to preserve service

Blend asset impact and operational readiness to choose a service-preserving approach. Asset history is shared with the exposure branch.

exposure › /blend asset operations as service-plan
  new session "service-plan" from asset + operations · no standing questions
service-plan › Choose an approach that preserves essential remote access while allowing remediation. Use only readiness evidence present in these histories.
service-plan › ?service_plan: How should service be maintained during remediation? [Use the tested standby and the approved failover, Accept an outage while working on the active device, Defer the change until another window]
  turn 1 · 1 fact · 1 question
  service_pl… ▶ Use the tested standby and the … ████████████████████ 1.00
                Accept an outage while working …                      0.00
                Defer the change until another …                      0.00
nouli --format text new "$example-service-plan" --from "$example-asset" --from "$example-operations" \
  'Choose an approach that preserves essential remote access while allowing
remediation. Use only readiness evidence present in these histories.' \
  -q 'service_plan: How should service be maintained during remediation? [Use the tested standby and the approved failover,
    Accept an outage while working on the active device,
    Defer the change until another window]'

Output

  turn 1 · 1 fact · 1 question
  service_pl… ▶ Use the tested standby and the … ████████████████████ 1.00
                Accept an outage while working …                      0.00
                Defer the change until another …                      0.00
  typesafe/jev-1.14.0 · session 01a1878e-1e06-718d-b041-aac2c2d92434 · turn 01a1878e-1e08-737e-a2e5-9337caefa1d0

The model selects the tested standby and approved failover. This branch addresses continuity while the other branch addresses exposure.

06Choose a response using both blended decisions

Combine the exposure and service-plan blends into an operator recommendation. The policy keeps exposure assessment separate from confirmed compromise.

service-plan › /blend exposure service-plan as response
  new session "response" from exposure + service-plan · no standing questions
response › Our example response policy is to act promptly on confirmed exposure, preserve essential service through a tested alternative, and continue assessing compromise. A confirmed compromise requires incident handling and vendor-guided recovery; applying a patch alone does not establish eradication. Make a recommendation from the available evidence.
response › ?response: What response should the operator coordinate? [Gather missing evidence before choosing a change, Use tested failover and promptly remediate while assessing compromise, "Preserve evidence, contain the affected device, and coordinate incident recovery"]
  turn 1 · 1 fact · 1 question
  response      Gather missing evidence before …                      0.00
              ▶ Use tested failover and promptl… ████████████████████ 1.00
                Preserve evidence, contain the …                      0.00
nouli --format text new "$example-response" --from "$example-exposure" --from "$example-service-plan" \
  'Our example response policy is to act promptly on confirmed exposure, preserve
essential service through a tested alternative, and continue assessing
compromise. A confirmed compromise requires incident handling and
vendor-guided recovery; applying a patch alone does not establish eradication.
Make a recommendation from the available evidence.' \
  -q 'response: What response should the operator coordinate? [Gather missing evidence before choosing a change,
    Use tested failover and promptly remediate while assessing compromise,
    "Preserve evidence, contain the affected device, and coordinate incident recovery"]'

Output

  turn 1 · 1 fact · 1 question
  response      Gather missing evidence before …                      0.00
              ▶ Use tested failover and promptl… ████████████████████ 1.00
                Preserve evidence, contain the …                      0.00
  typesafe/jev-1.14.0 · session 01a1878e-1e0f-73cc-928e-5ef0542730f4 · turn 01a1878e-1e12-7644-934c-4fe7d7d6e30b

The model recommends tested failover and prompt remediation while assessing compromise. It does not claim the device has been shown to be uncompromised.

07Record an investigation finding

Start a separate investigation history with a confirmed finding from the incident lead and vendor support. This supplied conclusion replaces the earlier absence of an assessment.

response › /new investigation
  new session "investigation"
investigation › Illustrative later finding: the incident lead and vendor support confirm unauthorized execution on Edge-01 after reviewing retained evidence. No reset, upgrade, or failover has yet occurred. The earlier absence of an assessment must no longer be treated as the current investigation status.
investigation › ?investigation: What does this finding require? [Continue routine vulnerability tracking, Escalate to incident response and vendor-guided recovery, Request clarification of the assessment]
  turn 1 · 1 fact · 1 question
  investigat…   Continue routine vulnerability …                      0.00
              ▶ Escalate to incident response a… ███████████████████▍ 0.97
                Request clarification of the as… ▋                    0.03
nouli --format text new "$example-investigation" \
  'Illustrative later finding: the incident lead and vendor support confirm
unauthorized execution on Edge-01 after reviewing retained evidence. No reset,
upgrade, or failover has yet occurred. The earlier absence of an assessment
must no longer be treated as the current investigation status.' \
  -q 'investigation: What does this finding require? [Continue routine vulnerability tracking,
    Escalate to incident response and vendor-guided recovery,
    Request clarification of the assessment]'

Output

  turn 1 · 1 fact · 1 question
  investigat…   Continue routine vulnerability …                      0.00
              ▶ Escalate to incident response a… ███████████████████▍ 0.97
                Request clarification of the as… ▋                    0.03
  typesafe/jev-1.14.0 · session 01a1878e-1e1a-7203-b3af-ceb54753272f · turn 01a1878e-1e1c-76d1-b6a3-491516e2c4f6

The model selects escalation to incident response and vendor-guided recovery. The finding is an illustrative confirmed assessment, not an inference from one log entry.

08Blend the finding into the response

Blend the earlier response with the new investigation finding to create a revised response. This preserves the initial recommendation for comparison.

investigation › /blend response investigation as incident-response
  new session "incident-response" from response + investigation · no standing questions
incident-response › Our example response policy is to act promptly on confirmed exposure, preserve essential service through a tested alternative, and continue assessing compromise. A confirmed compromise requires incident handling and vendor-guided recovery; applying a patch alone does not establish eradication. Make a recommendation from the available evidence.
incident-response › ?incident_response: What response should the operator coordinate now? [Gather missing evidence before choosing a change, Use tested failover and promptly remediate while assessing compromise, "Preserve evidence, contain the affected device, and coordinate incident recovery"]
  turn 1 · 1 fact · 1 question
  incident_r…   Gather missing evidence before …                      0.00
                Use tested failover and promptl… ██▋                  0.13
              ▶ Preserve evidence, contain the … █████████████████▍   0.87
nouli --format text new "$example-incident-response" --from "$example-response" --from "$example-investigation" \
  'Our example response policy is to act promptly on confirmed exposure, preserve
essential service through a tested alternative, and continue assessing
compromise. A confirmed compromise requires incident handling and
vendor-guided recovery; applying a patch alone does not establish eradication.
Make a recommendation from the available evidence.' \
  -q 'incident_response: What response should the operator coordinate now? [Gather missing evidence before choosing a change,
    Use tested failover and promptly remediate while assessing compromise,
    "Preserve evidence, contain the affected device, and coordinate incident recovery"]'

Output

  turn 1 · 1 fact · 1 question
  incident_r…   Gather missing evidence before …                      0.00
                Use tested failover and promptl… ██▋                  0.13
              ▶ Preserve evidence, contain the … █████████████████▍   0.87
  typesafe/jev-1.14.0 · session 01a1878e-1e23-707e-9539-78adfdeee5aa · turn 01a1878e-1e27-75fb-885f-3accf0072941

The model now recommends preserving evidence, containing the affected device, and coordinating incident recovery. The finding changes the response even though the service needs remain the same.