# Risk Rancher Field Manual: the working files

These are the files the book works. Everything here is sample data; no real
systems, no real credentials. The kev column in sample-findings.csv matches the
CISA Known Exploited Vulnerabilities catalog as of 2026-10-13.

- sample-findings.csv .......... 29 messy scanner findings across 8 assets. The pile you triage.
- sample-assets.csv ............ the 8 assets, with criticality, exposure, and owner. The tool loads this file as it is (Configuration, Asset inventory).
- triage-sheet.csv ............. blank working sheet: fill false_positive, duplicate_of, factors, score, priority.
- ranked-queue-answer-key.csv .. the finished triage, so you can check your work.
- removed-before-scoring.csv ... the two false positives and the three merges, with reasons.
- ticket-template.md ........... the remediation ticket (chapter 7). Chapter 9 names every state a ticket passes through.
- exception-log.csv ............ the accepted-risk log (chapter 8).
- metrics-sheet.csv ............ the only numbers that matter (chapter 11).
- weekly-loop.md ............... the one-page weekly discipline (conclusion).
- make-million.py .............. generates findings-1m.csv (not shipped; 206 MB), the million-row export chapter 10 runs through the tool, and assets-1m.csv, its inventory
- score.py ..................... the chapter 6 rubric as a script: python3 score.py sample-findings.csv
- metrics.py ................... MTTR, adherence, breaches: python3 metrics.py sample-remediation-log.csv
- sample-remediation-log.csv ... 12 closed findings with found/due/resolved dates (chapter 11).

The scoring rubric (chapter 6):
  score = base(severity) x exposure x criticality
  base:        Critical 4, High 3, Medium 2, Low 1
  exposure:    internet 2, internal 1, isolated 0.5
  criticality: crown-jewel 2, standard 1, dev 0.5
  KEV override: if the finding is on your known-exploited list, it is P1.
  bands: P1 >= 12,  P2 6 to 11,  P3 3 to 5,  P4 < 3
  SLA (remediation): P1 3 days, P2 14, P3 30, P4 90.
  The tool ships with the same rubric (Configuration, Priority rubric) and applies it at ingest
  to every finding on an asset in the loaded inventory; KEV comes from the catalog you load.