Before
A remediation coordinator searched the open incident queue for a matching team and vulnerability, then copied incident details into follow-up records. They also had to attach affected assets and services and enter the ticket reference on each vulnerability register line.
How it works
- Receive a prepared vulnerability group and search for an active incident with the same correlation key.
- Reuse the matching incident or create a new remediation incident with the supplied ownership, priority, scope, and deadline details.
- Link assets and services when creating a ticket, write the incident reference to each finding, and return the incident details.
Workflow details
- Request intake: The flow receives a prepared remediation request containing the incident fields, correlation key, affected configuration items, impacted services, and vulnerability register entries.
- Incident validation: It searches for an active incident with the same team-and-vulnerability key. If one exists, the flow reuses it rather than opening a duplicate and links the relevant findings to that incident.
- Incident creation: If no matching incident is found, the flow creates a security and vulnerability incident using the supplied assignment, priority, description, deadline, and other incident details.
- Traceability: For a newly created incident, affected configuration items and services are linked to the ticket, while every finding in the group receives the incident reference. The flow returns the ticket number, record identifier, and whether a new incident was created.
What changed
The matching-incident check and ticket decision now happen automatically. Each finding is linked to one reusable incident, new tickets receive their affected assets and services, and the resulting incident details are returned for downstream tracking without a manual handoff.
Work removed
Searching the open incident queue for matching tickets, deciding whether to create a duplicate, attaching repeated asset and service information, and copying the incident reference into each vulnerability record.
Expected outcome
One traceable remediation incident per finding group, with repeat scans reusing an active ticket instead of creating additional duplicate incidents.
