Ninja Sabaki — the vulnerability-triage manual
Sabaki (裁き, "judgment") ingests your scan data and does the triage for you: it scores and prioritises findings, kills false positives, finds coverage gaps, produces an actionable Top-10, and raises ServiceNow tickets — with live bridges to Raz0r SIEM and the Signal threat graph. It's a windowed desktop with 24 panels in seven sections; this manual walks them.
What Sabaki is
The judgment layer over your scanners. Sabaki takes raw findings and answers the only question that matters at scale — what do we fix first, and what can we ignore? — with multi-factor prioritisation, false-positive suppression and coverage analysis, then drives the fix through tickets and containment. A ⌘K command palette jumps you anywhere.
ninja.ing/ninjasabaki.Command — Dashboard, Analytics, Burndown
Dashboard is the state of play; Analytics the trends and cuts; Burndown tracks remediation velocity — are you closing faster than new findings arrive? There's also a dedicated TRON-style drill-down grid.
Triage — Vulns, Patches, Knowledge
The core loop. Triage applies multi-factor priority scoring (nine factors) and false-positive detection to cut the volume down to what's real and urgent. Vulns and Patches are the working lists; Knowledge is the reference the scoring draws on. The output is a Top-10 you can actually act on.
Surface — Assets, Coverage, Teams, Ingest
Assets is the inventory; Coverage finds the gaps — the false-negatives, the things no scanner is watching; Teams maps owners; Ingest brings scan data in (eight ingesters). Coverage analysis is the difference between "we triaged everything we saw" and "we saw everything."
Threat Graph, Galaxy & Agents
The Threat Graph and 3D Galaxy put findings in context — how a vulnerability connects to assets, actors and campaigns via the Signal bridge. Agents apply AI to the triage and remediation work.
Response — Tickets, Ringfence, Raz0r
Tickets auto-generates ServiceNow tickets and routes them to the right resolver group. Raz0r correlates against the SIEM, and Ringfence contains a compromised host (isolate / restore). This is where a finding becomes a fix or a containment.
Cloud & Zest — exposure management
The Zest section manages cloud exposure: Cloud and Exposures surface what's reachable, Root Cause traces why, and Guardrails, Policies, Remediation, Twin and Resolution drive it closed.
Settings & access
Settings holds configuration. Sign in via ecosystem SSO; a JWT session
(ninja-sabaki-token) gates every window.