Before
Analysts had to compare assets across four security consoles and the configuration inventory, match host names or identifiers, and decide whether missing evidence represented a real control gap or an unreliable source. They then manually calculated severity and deadlines, updated the gap register, assembled team tasks, and preserved coverage history.
How it works
- Start the review and collect configuration items, service context, prior source counts, existing gaps, active tasks, and endpoint, backup, logging, and vulnerability evidence.
- Validate source health, match evidence to assets, apply the required-control and freshness rules, and classify each finding by status, severity, deadline, and owner.
- Write or update the gap register, asset mappings, daily coverage snapshot, and team remediation tasks, then return a summary; if no source is usable, stop before creating gaps.
Workflow details
- Trigger and scope: A manual webhook starts the review, reading assets, service relationships, criticality, prior source counts, known mappings, existing gaps, and active tasks. It then collects endpoint, backup, logging, and vulnerability evidence, including seven days of backup sessions.
- Source validation: Each source is checked for availability. An unavailable source, or one returning less than 80% of the previous host count, leaves the related control unknown. Evidence is matched to configuration items using identifiers, serial numbers, MAC addresses, hostnames, and network addresses.
- Coverage assessment: The workflow evaluates freshness, prevention policy, sensor version, backup results, RPOs, log types, log recency, scan age, and authenticated scanning. Each control is classified as covered, degraded, missing, unknown, or exempt, then assigned tier, severity, deadline, and an accountable team.
- Gap lifecycle: New, continuing, fixed, reopened, and excepted findings are compared with the existing register. Deadlines reflect severity; gaps are routed to asset, hosting, service-support, or security operations groups.
- Output: When at least one source is usable, the flow writes gap records, asset mappings, daily snapshots, and one remediation task per team, then returns a summary. If no source is usable, it stops before writing gaps.
What changed
Each review now produces an evidence-linked coverage assessment with automatic source-health validation, asset matching, control decisions, severity, deadlines, and routing. Gaps and team tasks are updated from the current state, fixes and reopenings are tracked across runs, and unreliable evidence is marked unknown or prevents writes rather than being treated as a confirmed failure.
Work removed
Comparing host lists across four source consoles and the configuration inventory; checking prior host counts; matching identifiers; reviewing endpoint, backup, logging, and scan evidence; calculating control status, severity, deadlines, and ownership; creating, updating, fixing, or reopening gap records; assembling one remediation task per team; and writing daily coverage snapshots.
Expected outcome
A conservative expectation is that each review removes at least four recurring source-check activities—endpoint, backup, logging, and vulnerability evidence—along with manual gap and team-task compilation; actual time savings depend on the size of the asset estate.
