Before
Security staff likely had to retrieve the CISA vulnerability feed, filter the entries by date, and review each CVE individually. They then had to look up findings in Tenable, notify the security team, and create Jira issues by hand.
How it works
- Retrieve and filter the CISA vulnerability feed to the configured date range.
- Check each filtered CVE against Tenable and determine whether a matching vulnerability is found.
- Send the finding to the security team in Microsoft Teams and create a Jira issue when the condition is met.
Workflow details
- Feed retrieval: When the flow runs, it retrieves the current CISA known exploited vulnerabilities feed and extracts the published vulnerability records.
- Date filtering: The workflow calculates date values and limits the records to the configured date range before processing them further.
- Vulnerability validation: It iterates through each filtered vulnerability and looks up the associated CVE in Tenable Vulnerability Management to determine whether the vulnerability is present.
- Security notification: When a vulnerability is found, the workflow sends a report to the security team in Microsoft Teams so the finding is available for review.
- Issue tracking: The same finding is recorded as an issue in Atlassian Jira, creating a follow-up item for continued vulnerability management.
What changed
CISA vulnerability records are retrieved and screened automatically before a human review handoff. Matching findings now arrive in Microsoft Teams with a Jira issue created for tracking instead of requiring separate manual lookup, notification, and ticket-entry steps.
Work removed
Downloading or retrieving the CISA feed, filtering vulnerability entries by date, checking each CVE in Tenable, copying findings into a security-team report, and manually creating Jira issues.
Expected outcome
For each matching vulnerability, the workflow removes at least three recurring manual actions: the Tenable lookup, security-team notification, and Jira issue creation.
