{
  "type": "playbook",
  "slug": "exception-guardian",
  "name": "Exception Guardian",
  "author": "Alien0ne",
  "description": "Re-grades every Tenable risk exception against today's CISA KEV, EPSS and asset exposure, then writes Sigma detections, SIEM queries, a hunt brief and a human-gated approval plan for the ones that should be revoked.",
  "github_url": "https://github.com/Alien0ne/exception-guardian",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "risk-exceptions",
    "accept-risk",
    "recast-rules",
    "cisa-kev",
    "epss",
    "sigma",
    "threat-hunting",
    "human-in-the-loop",
    "claude-code"
  ],
  "integrations": [
    "Tenable",
    "Splunk",
    "Microsoft Sentinel"
  ],
  "domains": [
    "vulnerability-management",
    "security-operations"
  ],
  "date_added": "2026-11-04",
  "last_reviewed": "2026-11-04",
  "works_with_tenable_hexa_mcp": false,
  "playbook_type": "standard",
  "agents_used": [
    {
      "name": "Exception Guardian CLI",
      "role": "Reads exceptions, grades each REVOKE, REVIEW or OK from KEV, EPSS and exposure, converts and tests Sigma rules, writes the approval plan. All grades come from tested code.",
      "type": "github",
      "ref": "https://github.com/Alien0ne/exception-guardian"
    },
    {
      "name": "Claude Code",
      "role": "Runs the CLI, explains each trigger's then-vs-now evidence, and drafts Sigma rules where SigmaHQ leaves a gap (no rule, no query for a SIEM, or no rule that catches the attack).",
      "type": "info"
    },
    {
      "name": "SOC-Hunter",
      "role": "Runs the generated hunt briefs over the window each revoked exception was hiding the exposure.",
      "type": "exchange",
      "ref": "skills/soc-hunter"
    },
    {
      "name": "Human approver",
      "role": "Confirms each Tenable VM rule disable, one at a time, in their own terminal.",
      "type": "info"
    }
  ],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-11-04T18:25:42Z",
    "stars": 0,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/playbooks/exception-guardian",
  "json_url": "https://exchange.tenable.com/api/playbooks/exception-guardian.json",
  "markdown_url": "https://exchange.tenable.com/playbooks/exception-guardian.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/playbooks/exception-guardian.md"
}