# Vulnerability response timeline and exposure record

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Advisory and deployment join

Incident EX-9, coordinator Noor, product owner Ravi. Synthetic advisory SYN-PARSE-1 affects parsekit below 2.4.1 when XML external entities are enabled. It is an exercise advisory, not a real CVE. Release A contains 2.4.0; release B contains 2.4.1. Both are known by immutable digest. Impact outside retained logs remains unknown.

## Timeline

| UTC | Observation or action | Evidence | Confidence | Owner / next decision |
| --- | --- | --- | --- | --- |
| 10:00 | Advisory validated against vendor statement | advisory-copy-1 | Confirmed synthetic input | Noor opens incident |
| 10:10 | Two production-like exercise workers run A | inventory-12 | Confirmed | Ravi checks configuration |
| 10:20 | Worker one enables XML path; worker two disables it | config-snapshot-5 | Confirmed | Isolate worker one input |
| 10:25 | Preserve access and process events before replacement | evidence-set-8 | Confirmed | Noor assesses calls |
| 10:35 | Disable XML import route; normal JSON requests still work | containment-test-2 | Confirmed for tested routes | Ravi stages B |
| 11:15 | B passes malformed XML denial and ordinary import tests | run-B-3 | Confirmed for fixture | Deploy B with rollback plan |
| 11:30 | Both running digests observed as B | runtime-inventory-13 | Confirmed | Remove temporary rule after smoke test |

## Exposure and closure

Worker one was exposed to authenticated XML import users; this is a vulnerable-path finding, not proof of exploitation. Worker two's disabled path lowers the assessed exposure for that configuration but still receives the patch. Retained logs contain no suspicious calls in their recorded interval; gaps before that interval remain unknown. If investigation finds executed code or credential access, expand containment and credential rotation accordingly.

Closure requires observed B on every intended worker, the tested rollback path, route-level verification and a documented impact assessment. Follow-up: add artifact/configuration joins to inventory and test that the XML feature cannot be enabled without review. Noor owns impact communication through the established incident channel; no automated external notification is implied by this template.