Before
An operator likely had to review approved ServiceNow incidents, interpret the asset and vulnerability QIDs, and manually create a patch deployment job for each one. They then had to return to each incident, copy the job reference, add a work note, and update its tracking value.
How it works
- On an hourly schedule, retrieve approved ServiceNow incidents whose correlation values identify virtual patch work.
- Extract each asset and its vulnerability QIDs, then create an enabled, on-demand Windows patch job using those details.
- Update each originating incident with a processed correlation value and a note containing the created job information.
Workflow details
- Scheduled intake: At 15 minutes past every hour, the workflow reads ServiceNow incidents that are approved and carry the expected Qualys correlation format.
- Incident preparation: It extracts the affected asset and vulnerability QIDs from each qualifying incident and builds the corresponding virtual patch job details.
- Patch job creation: For each incident, it creates an enabled, on-demand Windows deployment job using a vulnerability query based on the identified QIDs.
- Incident reconciliation: After the job is created, the workflow updates the originating ServiceNow incident with a processed correlation value and a work note containing the created job's identifier and name.
- Completion: The process handles qualifying incidents sequentially and completes with the set of patch jobs created during the scheduled run.
What changed
The approved-incident-to-patch-job handoff now runs automatically every hour. The workflow performs the eligibility check, extracts the patch scope, creates the job, and reconciles the originating incident without requiring a person to move between the incident record and patch-management process for each case.
Work removed
Reviewing approved incidents one by one, parsing asset and QID values, creating individual patch deployment jobs, copying job identifiers and names, adding work notes, and updating incident correlation values.
Expected outcome
For every qualifying incident, at least four recurring manual actions are automated: incident review, patch-job creation, job-detail copying, and incident tracking update.
