Before
Security teams likely had to review confirmed vulnerability findings, identify the affected configuration item, and locate its owner manually. They then had to create and assign an incident, decide whether approval was needed, update the incident, and notify the relevant team through a separate channel.
How it works
- Retrieve confirmed, still-open vulnerability findings on the daily schedule and prepare one record per affected asset.
- Validate the asset and owner in the configuration database, calculate the maximum risk score and urgency, and create an assigned incident when the required data exists.
- Request approval and notify the team for scores of 70 or higher; otherwise leave the incident as a ticket without approval, while missing asset or owner records are skipped.
Workflow details
- Scheduled detection review: Each day at 07:00 Europe/Paris, the workflow retrieves confirmed vulnerability detections and keeps only findings that remain open with New, Active, or Re-Opened status, excluding fixed findings.
- Asset and ownership validation: For every affected asset, it identifies the host, confirmed vulnerability IDs, maximum Qualys Detection Score, and urgency, then looks up the corresponding configuration item and owner in the configuration database. Assets without a matching configuration item or owner are not processed further.
- Incident creation and prioritization: For valid matches, the workflow creates an incident assigned to the asset owner, links it to the configuration item, records the vulnerability correlation details, and sets urgency according to the maximum score. The incident is tracked without approval when the maximum score is below 70.
- Approval handoff: When the maximum score is 70 or higher, the incident is moved to an approval-requested state and a Teams message identifies the incident, asset, score, and vulnerability IDs, with a link for review. Once an authorized person changes the incident approval to Approved, the related downstream workflow can create the Qualys Patch Management job.
What changed
The daily workflow now performs the vulnerability filtering, CMDB validation, incident creation, prioritization, and approval routing automatically. Humans only need to review and approve the qualifying high-score incidents before the downstream virtual patch job can be created.
Work removed
Reviewing qualifying vulnerability findings one by one, looking up asset ownership, copying vulnerability details into incidents, assigning incidents to owners, calculating urgency from the maximum score, changing the approval state, and manually posting approval requests to Teams.
Expected outcome
For each qualifying asset, roughly four to five recurring manual actions can be replaced by one scheduled workflow run, producing consistent incident coverage and approval routing without claiming a measured time saving.
