Before
Analysts likely had to retrieve new vulnerability results on a recurring basis, review descriptions individually, identify affected software and versions, and decide whether action was needed. They then had to copy the findings into the vulnerability database and notify the review team separately.
How it works
- Retrieve the latest vulnerability results on a configured recurring schedule.
- Extract the affected software and version, assess whether action is needed, and merge those findings with the vulnerability details.
- Create a database record for each vulnerability and notify the review team that the scan is ready.
Workflow details
- Scheduled collection: The workflow runs on a configured schedule and retrieves the latest vulnerability results since the previous pull from a query-based vulnerability subscription.
- Vulnerability triage: An AI task reviews each vulnerability description to identify the matching software and full version from the configured software list, then determines whether mitigation action is needed.
- Data consolidation: A script combines the retrieved vulnerability details with the software, version, and action assessment, while validating that the corresponding result lists have matching lengths.
- Database enrichment: Each consolidated vulnerability is written to the vulnerability database with its CVE identifier, severity, score, publication date, reference, affected software, version, description, scan date, and action-needed status.
- Team notification: After the records are created, a message informs the designated review channel that the scheduled scan is complete and provides a link to the vulnerability database.
What changed
Vulnerability collection, triage fields, severity mapping, record creation, and team notification now occur as one scheduled workflow. Analysts receive an updated database and review link after the scan instead of performing the retrieval and data-entry sequence themselves.
Work removed
Manually retrieving newly released vulnerabilities, reviewing descriptions one by one, identifying software and versions, assessing whether action is needed, merging findings, entering vulnerability records, and sending the scan-completion notification.
Expected outcome
Each scheduled run produces a consistently structured vulnerability inventory with affected software, severity, and action-needed status, while removing the recurring manual retrieval, triage, database-entry, and notification cycle.
