Before
Security analysts would likely check for new vulnerability records on a recurring basis, review CVSS details, and search network intelligence for exposed assets matching each affected product and version. They would then copy findings into a spreadsheet and manually notify the team with the report location, creating repeated tool changes and handoffs.
How it works
- On a schedule, retrieve new vulnerability records and stop cleanly when no new records are available.
- Normalize the vulnerability data, validate CVSS information, and search the network for matching public-facing assets using the affected product and version details.
- Append the exposure evidence to a spreadsheet and notify the designated team channel with the report link when relevant matches are found.
Workflow details
- Scheduled collection: The workflow runs on a predefined schedule and retrieves newly reported vulnerabilities for the selected software from a saved vulnerability search. If no new records are returned, it stops and reports that there are no new vulnerabilities for the selected software.
- Data validation and normalization: New vulnerability records are processed by a script that standardizes the CVE title, service, version, description, publication date, and CVSS information. The workflow checks whether usable CVSS or CVSSv3 details are present before continuing with the relevant reporting path.
- Network exposure validation: Each normalized vulnerability is evaluated against the selected network, country, city, port, product, and version criteria. The workflow then checks whether matching public-facing assets are identified by the network search.
- Evidence capture: For each relevant match, the automation captures asset and vulnerability context—including the port, product, version, IP address, CVE information, publication details, description, severity, and score—and appends it to a structured spreadsheet report.
- Notification and handoff: After the scan is processed, the workflow sends a message to the designated team channel when matching exposure is identified. The notification includes the vulnerability context and a link to the completed spreadsheet report so analysts can investigate and remediate the findings.
What changed
New vulnerability collection, CVSS validation, network exposure searches, report updates, and team notification now occur as one scheduled workflow. Analysts receive a structured report and contextual handoff after processing, while human investigation and remediation decisions remain with the security team.
Work removed
Repeatedly checking for new vulnerability records, reviewing CVSS and CVSSv3 fields, searching for exposed assets by product and version, copying vulnerability and asset details into a spreadsheet, and manually sending the completed report link to the team.
Expected outcome
Each scheduled run can conservatively remove at least four recurring manual action categories—vulnerability lookup, data validation, exposure searching, and report notification—while providing a repeatable record of detected public-facing risks.
