huawei-cloud-ecs-vulnerability-auditor

Audit Huawei Cloud ECS instances for security vulnerabilities across host OS packages, running services, application dependencies (Java, Python, Node.js, PHP, Go), and container environments (Docker, containerd, Podman). Collects asset inventories remotely via Cloud Operations Center (COC), matches components against Known Exploited Vulnerabilities (KEVs) via the public db.gcve.eu API, outputs an actionable remediation report, and executes a confirmation-gated semi-automated remediation chain: pre-remediation snapshot/backup, package upgrade, container base-image update & recreate, security-group port blocking, and post-remediation re-scan verification. Triggers include: ECS漏洞扫描, ECS漏洞发现, 主机漏洞扫描, 容器漏洞发现, ECS资产收集, KEV漏洞检测, ecs vulnerability audit, ecs vuln scan, gcve vulnerability auditor, 漏洞自动修复, 一键修复漏洞, 漏洞修复执行, 修复验证复扫, vulnerability remediation, auto fix vulnerability, apply remediation, rescan verification

Huawei Cloud ECS Vulnerability Auditor & Remediation

Overview

Audit Huawei Cloud ECS instances across host operating systems, active network services, application language runtimes, and container workloads for known and actively exploited vulnerabilities, then execute a confirmation-gated semi-automated remediation chain:

1. IAM Authorization — Verify or initialize the ServiceAgencyForCOC cross-service agency trusting op_svc_coc.
2. Asset Collection via COC — Remotely execute a safe, read-only Python-based inventory collector on the target ECS instance using Huawei Cloud Cloud Operations Center (COC).
3. Multi-Tier Asset Extraction — Symmetrically collect host and container assets focusing on running processes and $PATH directory drill-down:
   • Host Level: Host OS packages (dpkg/rpm/apk), listening network services (ss/netstat), active running processes (/proc enumeration), full $PATH directory drill-down, and application libraries (Java .jar manifests, pip, npm, php).
   • Container Level: For running containers (docker, podman), enters container namespaces via exec and /proc/<pid>/root to inspect the internal OS distribution (/etc/os-release), package manager inventories (apk, dpkg, rpm), active running processes (top), container $PATH directory drill-down, and embedded Java libraries.
4. Result Retrieval from COC Logs — Fetch execution output via COC GetScriptJobBatch and extract the structured inventory between demarcated boundary markers (===ECS_ASSET_INVENTORY_START=== / ===END===).
5. Vulnerability & KEV Matching — Cross-reference identified assets against https://db.gcve.eu/api/ (/vulnerability/?product={product} for product CVEs, /kev for confirmed in-the-wild exploitation, and /epss for exploit prediction scoring).
6. Automatic Version Range Matching & CVSS Fallback — Automatically evaluate whether the installed version falls within the CVE's affected version range, extract CVSS scores with graceful fallback policies, and extract official vulnerability disclosure dates.
7. Remediation Report Generation — Output prioritized remediation guidance (P0 KEV criticals, package upgrade commands, container base image updates, network security group rules).
8. Semi-Automated Remediation — Build a confirmation-gated remediation plan (build_remediation_plan.py) and drive its execution: pre-remediation EVS snapshot/CBR backup (auto), package upgrade via COC (remediate_packages.sh), container base-image update & recreate (remediate_containers.sh), security-group deny rules for exposed KEV ports (VPC CreateSecurityGroupRule/v3, original rules recorded for rollback), and post-remediation re-scan verification against the baseline (rescan_verify.py).
9. Security Cleanup — Automatically remove temporary COC scripts and remote scan artifacts.

Tool chain: Huawei Cloud KooCLI (hcloud) + Python 3 + https://db.gcve.eu/api/.

[!IMPORTANT] Safety model — no blind full-auto. Every mutating remediation action (package upgrade, container recreate, security-group rule change) is confirm_required: true in the generated plan and is executed only after explicit user/agent confirmation (per-action or "confirm all"). Snapshot/backup (FP-4) runs automatically before the first write; re-scan verification (FP-5) is read-only.

Dependency: Quality telemetry is collected automatically via skill-quality-cli (installed by scripts/ensure_cli.sh if absent).

Prerequisites

• KooCLI (hcloud) authenticated with AK/SK — see CLI Installation Guide
• IAM permissions to operate COC, ECS, EVS (snapshots), and VPC (security-group rules) — see IAM Policies
• Target ECS instance ID or Elastic IP (ACTIVE state)
• Network access to https://db.gcve.eu/api from the auditing environment — see GCVE API Reference
• Python 3.8+ for build_remediation_plan.py / rescan_verify.py local analysis
• Docker/podman available on the target ECS when container remediation is needed (executed remotely via COC)
• skill-quality-cli — ensured by bash scripts/ensure_cli.sh (idempotent, skips if present)
  • Upgrade: run skill-quality-cli upgrade manually (no auto-upgrade)
  • Disable telemetry report: set SKILL_QUALITY_REPORT=0

Workflow

1. IAM Authorization & Target Resolution

One-time per-account setup. Authorize COC to operate on ECS instances:

1. Get domain ID — Call KeystoneListAuthDomains and extract the domain id.
2. Create agency — Call CreateAgency with name ServiceAgencyForCOC and trust domain op_svc_coc.
   • HTTP 200 — New agency created. Record agency.id. Proceed to step 3.
   • HTTP 409 — Agency already exists. Skip the entire agency creation and role binding (steps 3–4) and proceed to Step 5 (Target Resolution).
3. Find role IDs — Call KeystoneListPermissions for each of the 4 roles: IAM ReadOnlyAccess, RMS ReadOnlyAccess, DCS UserAccess, COCServiceAgencyPolicy. If any role is not found, stop — the account may lack access.
4. Bind roles — Call AssociateAgencyWithAllProjectsPermission for each of the 4 role IDs.
   • HTTP 200 — Bound successfully.
   • HTTP 409 — Already bound, skip and continue.
5. Resolve ECS Instance — If only an Elastic IP was provided, query NovaListServersDetails to obtain the instance UUID and region. Ensure the instance is in ACTIVE state.

2. Deploy & Execute Remote Asset Collector via COC

1. Create Collector Script: Register scripts/collect_assets.sh as a temporary COC shell script via COC CreateScript.

2. Execute on Target ECS: Dispatch the script to the target instance using COC ExecuteScript.

3. Poll Status: Poll COC GetScriptJobInfo until status reaches SUCCESS.

4. Retrieve Inventory Output: Call COC GetScriptJobBatch to obtain the batch instance execution details. The collector script emits the inventory surrounded by markers:

   text

   ===ECS_ASSET_INVENTORY_START===
   { ... json inventory ... }
   ===ECS_ASSET_INVENTORY_END===
   

   The intelligence engine scripts/query_gcve.py can directly ingest this batch JSON response, raw log text, or extracted JSON file.

3. Vulnerability & KEV Intelligence Matching

Run the intelligence engine scripts/query_gcve.py against the collected inventory:

1. Product Selection & Exhaustive Audit:
   • Use --product <name> (or -p <name>) to audit a specific product (e.g. --product nginx or --product php).
   • If --product is omitted, query_gcve.py automatically audits ALL discovered network services, application libraries, container workloads, and core system packages.
2. Product Vulnerability Query: Query https://db.gcve.eu/api/vulnerability/?product={product}&per_page=20&date_sort=published&sort_order=desc.
3. Automatic Version Matching: Checks installed version against the CVE affected ranges (lessThan, lessThanOrEqual, version prefixes).
4. KEV & EPSS Querying: Query /api/kev?vuln_id={cve} for active in-the-wild exploitation evidence and /api/epss/{cve} for exploit probability.
5. CVSS Extraction & Fallback: Extracts CVSS base score and severity from CNA or ADP metrics. If missing, applies an intelligent fallback estimation based on KEV exploitation and EPSS score.

4. Prioritized Remediation Reporting

Render findings ranked by threat severity:

• P0 (Critical): Actively exploited vulnerabilities present in KEV on externally exposed services.
• P1 (High): High CVSS / high EPSS vulnerabilities on internal or auxiliary services.
• P2 / P3 (Medium / Low): Hardening advisories, unmanaged library updates, and base image refreshes.
• Disclosure Timestamps: Each vulnerability lists its published date (date_published) and update date.
• Machine-Readable Findings: For the remediation plan, also render the findings as JSON (see §4.1 note below).

⚠️ Mandatory: every hcloud command and every analysis script in this skill MUST be wrapped with skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- — bare hcloud calls are strictly forbidden.

run uses a strict allowlist: hcloud, plus python3/python invoked with exactly scripts/query_gcve.py, scripts/build_remediation_plan.py, or scripts/rescan_verify.py, and bash invoked with exactly scripts/collect_assets.sh (all from the skill directory). Any other command or script is rejected — do not attempt to pass arbitrary python3/bash commands (such as bash -c) through the wrapper.

bash

skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/query_gcve.py --inventory=<inventory.json> --output-format=json > <findings_before.json>

5. Semi-Automated Remediation

[!CAUTION] All mutating steps below require explicit user confirmation before execution. Step 5.1 (snapshot/backup) is the only auto step, and it runs before any write. Steps 5.2–5.4 confirm per-action (or "confirm all") and record enough state to roll back.

5.1 Build the Remediation Plan (read-only)

bash

skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/build_remediation_plan.py \
  --inventory=<inventory.json> \
  --findings=<findings_before.json> \
  --output-plan=remediation_plan.json \
  --output-format=markdown

The plan groups every actionable finding into:

• Host package upgrades (with exact apt-get/yum/apk command + fixed version), confirm_required: true
  • A remediation token that is a bare git commit hash (^[0-9a-f]{7,40}$, i.e. a GCVE affected-range boundary rather than a distro package version) is never pinned into a command. Such packages degrade to a whole-package upgrade — yum: sudo yum update -y <pkg>, apt: sudo apt-get --only-upgrade install -y <pkg> — and the action is marked version_source: "range_unverified" with a version_note asking for manual version confirmation. Real versions (3.0.20, 1.8.23p1, 1:2.32.0-1) stay pinned.
• Container base-image updates (with docker/podman pull + recreate command), confirm_required: true
• Security-group deny rules for externally exposed KEV-hit ports (record original rules for rollback), confirm_required: true
• Pre-remediation snapshot/backup action (auto), and post-remediation re-scan action (read-only)

Review the plan with the user and obtain confirmation (per-action or "confirm all").

5.2 Pre-Remediation Snapshot / Backup (auto — runs before any write)

List the volumes attached to the server, then snapshot each one (or create a CBR checkpoint backup):

bash

# List attached volumes
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud EVS ListVolumes --cli-region={region} --server_id=<instance_id>
# Snapshot each volume (auto step; repeat per volume_id)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud EVS CreateSnapshot --cli-region={region} \
  --snapshot.volume_id="<volume_id>" \
  --snapshot.name="pre_vuln_remediation_<timestamp>" \
  --snapshot.description="Pre-remediation snapshot for vulnerability fix (rollback point)"

# Alternative: CBR backup via checkpoint (requires an existing backup vault)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud CBR ListVault --cli-region={region} --object_type=server
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud CBR CreateCheckpoint --cli-region={region} \
  --checkpoint.vault_id="<vault_id>" \
  --checkpoint.parameters.resources.[1]="<ecs_urn>" \
  --checkpoint.parameters.auto_trigger=false \
  --checkpoint.parameters.name="pre_vuln_remediation_<timestamp>"

Record the returned snapshot IDs / checkpoint ID in remediation_plan.json (rollback points).

5.3 Package Upgrade via COC (semi-auto)

Register scripts/remediate_packages.sh as a COC script and execute it on the target with the package list derived from the plan:

bash

# Create the remediation COC script (SHELL type)
cat > <temp_dir>/coc_remediate_create.json << 'EOF'
{
  "body": {
    "name": "ecs_vuln_remediate_packages",
    "type": "SHELL",
    "description": "Upgrade P0/P1-hit system packages (confirmation-gated)",
    "content": "<insert scripts/remediate_packages.sh content>",
    "properties": {"risk_level": "MEDIUM", "version": "1.0.0"},
    "script_params": [{"param_name": "packages", "param_description": "space-separated package list to upgrade", "param_value": ""}]
  }
}
EOF
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud COC CreateScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_remediate_create.json

# Execute on target (pass package list via execute_param)
cat > <temp_dir>/coc_remediate_execute.json << 'EOF'
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_batches": [{
      "batch_index": 1,
      "rotation_strategy": "CONTINUE",
      "target_instances": [{"region_id": "<region>", "resource_id": "<instance_id>"}]
    }],
    "execute_param": {
      "execute_user": "root",
      "timeout": 600,
      "success_rate": 100,
      "script_params": [
        {"param_name": "packages", "param_value": "openssl curl sudo"}
      ]
    }
  }
}
EOF
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud COC ExecuteScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_remediate_execute.json

Poll COC GetScriptJobInfo, then fetch per-instance results via COC GetScriptJobBatch and parse the ===ECS_REMEDIATION_START=== / ===ECS_REMEDIATION_END=== markers.

5.4 Container Base-Image Update & Recreate (semi-auto)

For each vulnerable container in the plan, register and run scripts/remediate_containers.sh via COC:

bash

# Create the container remediation COC script
cat > <temp_dir>/coc_container_create.json << 'EOF'
{
  "body": {
    "name": "ecs_vuln_remediate_container",
    "type": "SHELL",
    "description": "Pull fixed image tag and recreate container preserving config (confirmation-gated)",
    "content": "<insert scripts/remediate_containers.sh content>",
    "properties": {"risk_level": "HIGH", "version": "1.0.0"},
    "script_params": [
      {"param_name": "container_name", "param_description": "name or id of the container to recreate", "param_value": ""},
      {"param_name": "fixed_image", "param_description": "fixed/patched image tag to pull", "param_value": ""}
    ]
  }
}
EOF
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud COC CreateScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_container_create.json

# Execute with container name + fixed image tag
cat > <temp_dir>/coc_container_execute.json << 'EOF'
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_batches": [{
      "batch_index": 1,
      "rotation_strategy": "CONTINUE",
      "target_instances": [{"region_id": "<region>", "resource_id": "<instance_id>"}]
    }],
    "execute_param": {
      "execute_user": "root",
      "timeout": 600,
      "success_rate": 100,
      "script_params": [
        {"param_name": "container_name", "param_value": "prod-app"},
        {"param_name": "fixed_image", "param_value": "myorg/app:patched"}
      ]
    }
  }
}
EOF
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud COC ExecuteScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_container_execute.json

The script backs up docker inspect output to /tmp/ecs_remediation_container_backup.json on the host for rollback, and reports status: success|fail.

5.5 Security-Group Blocking for Exposed KEV Ports (semi-auto)

For externally exposed services that hit KEV (per plan), add deny inbound rules to the instance's security group and record the original rules for rollback:

bash

# Record current rules (rollback reference)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud VPC ListSecurityGroupRules/v3 --cli-region=<region> --security_group_id.[1]="<sg_id>" \
  > <temp_dir>/sg_rules_before.json

# Add deny rule for each exposed port (confirm before running)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- hcloud VPC CreateSecurityGroupRule/v3 --cli-region=<region> \
  --security_group_rule.direction="ingress" \
  --security_group_rule.security_group_id="<sg_id>" \
  --security_group_rule.ethertype="IPv4" \
  --security_group_rule.protocol="tcp" \
  --security_group_rule.multiport="6379" \
  --security_group_rule.remote_ip_prefix="0.0.0.0/0" \
  --security_group_rule.action="deny"

Rollback: delete the added deny rule (VPC DeleteSecurityGroupRule/v3 --security_group_rule_id="<new_rule_id>") using rules recorded in sg_rules_before.json.

5.6 Post-Remediation Re-Scan Verification (read-only)

Re-collect assets and re-run the intelligence engine, then diff against the baseline findings:

bash

# Re-run asset collection → <inventory_after.json> (collect_assets.sh is a bash script)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- bash scripts/collect_assets.sh /tmp/ecs_assets_inventory_after.json

# Re-run intelligence engine
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/query_gcve.py --inventory=<inventory_after.json> --output-format=json > <findings_after.json>

# Diff against baseline
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/rescan_verify.py --before=<findings_before.json> --after=<findings_after.json>

The verifier reports Resolved, Remaining / Unresolved (unresolved KEVs are flagged prominently), and Newly Discovered items.

6. Security & Resource Cleanup

Delete temporary COC scripts and remote temporary files:

1. Delete COC scripts via COC DeleteScript (collector + remediation scripts).
2. Remove temporary files from the target host: /tmp/ecs_assets_inventory.json, /tmp/ecs_remediation_packages.json, /tmp/ecs_remediation_container_backup.json.

Core Commands

Placeholder values:

Placeholder	Linux / macOS	Windows (PowerShell)
<hcloud>	hcloud	hcloud
<temp_dir>	/tmp	$env:TEMP
<region>	cn-north-4	cn-north-4

[!NOTE] Command syntax conforms to the latest KooCLI standard without legacy /v2.1 or /v3 URL suffixes. Use hcloud <service> <operation> --help to confirm parameters on your local version.

Audit & Report

bash

# 1. Check/setup COC IAM authorization (one-time per account)
<hcloud> IAM KeystoneListAuthDomains
<hcloud> IAM CreateAgency \
  --agency.domain_id="<domain_id>" \
  --agency.name="ServiceAgencyForCOC" \
  --agency.trust_domain_name="op_svc_coc" \
  --agency.description="Agency for COC remote script execution and asset auditing" \
  --agency.duration="FOREVER"
<hcloud> IAM KeystoneListPermissions --display_name="<role_name>"
<hcloud> IAM AssociateAgencyWithAllProjectsPermission \
  --agency_id="<agency_id>" --domain_id="<domain_id>" --role_id="<role_id>"

# 2. Resolve ECS instance details by IP
<hcloud> ECS NovaListServersDetails --ip="<ecs_ip>"

# 3. Check existing COC scripts
<hcloud> COC ListScripts --cli-region=<region> --name_like="ecs_asset_collector" --limit=10

# 4. Create COC script via JSON input (ensure UTF-8 without BOM on Windows)
cat > <temp_dir>/coc_collector_create.json << 'EOF'
{
  "body": {
    "name": "ecs_asset_collector",
    "type": "SHELL",
    "description": "Read-only asset collector for ECS vulnerability auditing",
    "content": "#!/usr/bin/env bash\n...",
    "properties": {"risk_level": "LOW", "version": "1.0.0"}
  }
}
EOF
<hcloud> COC CreateScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_create.json

# 5. Execute script on target instance
cat > <temp_dir>/coc_collector_execute.json << 'EOF'
{
  "path": {"script_uuid": "<script_uuid>"},
  "body": {
    "execute_batches": [{
      "batch_index": 1,
      "rotation_strategy": "CONTINUE",
      "target_instances": [{"region_id": "<region>", "resource_id": "<instance_id>"}]
    }],
    "execute_param": {"execute_user": "root", "timeout": 180, "success_rate": 100}
  }
}
EOF
<hcloud> COC ExecuteScript --cli-region=<region> --cli-jsonInput=<temp_dir>/coc_collector_execute.json

# 6. Poll job status
<hcloud> COC GetScriptJobInfo --cli-region=<region> --execute_uuid="<execute_uuid>"

# 7. Retrieve execution log output
<hcloud> COC GetScriptJobBatch --cli-region=<region> --execute_uuid="<execute_uuid>" --batch_index=1 --limit=10 > <temp_dir>/coc_batch_output.json

# 8. Run GCVE Intelligence Audit & Generate Report (audits all components by default)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --output-format=markdown

# Optional: Audit a specific product only
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/query_gcve.py --inventory=<temp_dir>/coc_batch_output.json --product=nginx

# 9. Cleanup COC script
<hcloud> COC DeleteScript --cli-region=<region> --script_uuid="<script_uuid>"

Remediation

bash

# 1. Build the remediation plan (read-only; review + confirm with user)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/build_remediation_plan.py \
  --inventory=<inventory.json> --findings=<findings_before.json> \
  --output-plan=remediation_plan.json --output-format=markdown

# 2. Pre-remediation snapshot (auto) — list + snapshot each attached volume
<hcloud> EVS ListVolumes --cli-region=<region> --server_id="<instance_id>"
<hcloud> EVS CreateSnapshot --cli-region=<region> --snapshot.volume_id="<volume_id>" \
  --snapshot.name="pre_vuln_remediation_<timestamp>"

# 3. Registered remediation COC scripts, executed confirmation-gated (like audit scripts above):
#    scripts/remediate_packages.sh   → apt/yum/apk upgrade of plan packages
#    scripts/remediate_containers.sh → pull fixed image + recreate container (preserves config)

# 4. Block exposed KEV ports (semi-auto; record rules first for rollback)
<hcloud> VPC ListSecurityGroupRules/v3 --cli-region=<region> --security_group_id.[1]="<sg_id>"
<hcloud> VPC CreateSecurityGroupRule/v3 --cli-region=<region> \
  --security_group_rule.direction="ingress" --security_group_rule.security_group_id="<sg_id>" \
  --security_group_rule.ethertype="IPv4" --security_group_rule.protocol="tcp" \
  --security_group_rule.multiport="<port>" --security_group_rule.remote_ip_prefix="0.0.0.0/0" \
  --security_group_rule.action="deny"

# 5. Post-remediation re-scan verification (read-only)
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/query_gcve.py --inventory=<inventory_after.json> --output-format=json > findings_after.json
skill-quality-cli run --skill-name huawei-cloud-ecs-vulnerability-auditor -- python3 scripts/rescan_verify.py --before=<findings_before.json> --after=<findings_after.json>

Parameter Confirmation

Parameter	Required	Default	Description
ecs_instance_id	Conditional	None	ECS Instance UUID; required if ecs_ip is not provided
ecs_ip	Conditional	None	ECS Elastic IP; required if ecs_instance_id is not provided
region	No	cn-north-4	Huawei Cloud region where ECS, COC, EVS, and VPC reside
product	No	None	Specific product to audit (e.g. php, nginx). If omitted, all discovered assets are audited
output_format	No	markdown	Report format: markdown or json
cleanup	No	true	Automatically clean up COC scripts and remote files
snapshot	No	true	(Remediation) Create EVS/CBR snapshot before writes
rescan	No	true	(Remediation) Run post-remediation re-scan verification
confirm	No	per-action	Confirmation gate: per-action or all

Output Format

The skill provides structured progress updates across each audit and remediation phase:

Phase	Output Content
Target & IAM	Target ECS ID, IP address, OS flavor, and COC agency status
Asset Collection	Count of discovered OS packages, listening services, Java/Python/Node dependencies, and containers
Result Retrieval	Confirmation of log retrieval from GetScriptJobBatch with marker extraction
KEV Matching	Identified Known Exploited Vulnerabilities (KEVs), EPSS scores, CVSS severity, publication dates, and version matches
Remediation Report	Full Markdown report with executive summary, CVE breakdown, and specific remediation commands
Remediation Plan	Confirmation-gated action plan: package upgrades, container updates, SG deny rules, snapshot/backup, re-scan
Remediation Execution	Per-step confirmation prompts + COC execution results (`status: success
Re-Scan Verification	Before/after diff: Resolved, Remaining / Unresolved (unresolved KEVs flagged), Newly Discovered
Cleanup	Deletion confirmation for COC scripts and temporary files

Reference Documents

• CLI Installation Guide — KooCLI install & AK/SK authentication
• IAM Policies — least-privilege IAM configuration for COC / ECS / EVS / VPC
• GCVE API Reference — db.gcve.eu vulnerability / KEV / EPSS endpoints
• Verification Method — per-phase functional verification criteria
• Acceptance Criteria — unit / integration / security acceptance checks
• Remediation Guide — detailed semi-automated remediation reference & rollback