Before
Security teams reviewed vulnerability detections individually, searched the CMDB for the affected asset and owner, and manually gathered exploitation intelligence and remediation guidance. They then created and assigned tickets, assessed whether remediation was disruptive, and coordinated the appropriate patching path through separate handoffs.
How it works
- Retrieve and filter confirmed vulnerability detections, identify affected assets, and calculate priority from the highest QDS.
- Enrich each finding with exploitation, indicator, and remediation context, then validate the asset and owner in the CMDB before creating the incident.
- Pause for human remediation approval and route the approved finding to direct patching or virtual patching according to the selected path.
Workflow details
- Daily detection: Every day at 07:00 Europe/Paris, the workflow queries confirmed vulnerability detections and keeps findings that are new, active, or re-opened, excluding fixed detections. It groups the open findings by affected asset and calculates the maximum QDS to establish priority and urgency.
- Enrichment and ownership: For each vulnerable asset, the workflow investigates available exploitation intelligence, indicators, threat context, and vendor remediation information. It then searches the CMDB to identify the affected configuration item and its owner so the resulting incident can be assigned to the correct person.
- Incident creation and validation: When the asset or owner cannot be found, the workflow creates an urgent unassigned ticket for investigation. When ownership is available, it prepares an enriched incident containing the affected asset, confirmed QIDs, exploitation findings, remediation references, and a proposed remediation path, then pauses for owner or analyst validation. Findings with a maximum QDS of at least 70 are marked for approval and routed through the configured team communication channel.
- Remediation routing: After the proposed action is approved, the workflow dispatches the appropriate remediation process. Non-disruptive remediation is sent toward direct patch deployment, while disruptive remediation is sent toward virtual patching using the collected indicators, allowing the human-approved decision to determine the next operational step.
What changed
Each daily detection is automatically filtered, enriched, linked to an owner, and converted into a remediation-ready incident. Missing CMDB ownership is surfaced through an urgent unassigned ticket, while high-priority findings are sent for approval and the approved remediation decision determines the downstream patching process.
Work removed
Manually querying vulnerability detections, reviewing findings one by one, searching the CMDB for asset ownership, investigating exploitation activity, collecting indicators and remediation references, writing incident summaries, assigning tickets, and coordinating the direct-versus-virtual patch decision.
Expected outcome
The workflow can remove an estimated 10–15 recurring manual actions per vulnerability while providing consistent daily triage coverage and keeping remediation decisions under human validation.
