Before
Security teams likely had to search the vulnerability environment repeatedly for each tag and reporting dimension, then reconcile asset, vulnerability, status, severity, and age counts manually. They also had to copy the results into a spreadsheet template, clear outdated values, update headers, and prepare the sheet for review.
How it works
- Authenticate and expand the configured tag hierarchy, then generate scoped queries for each discovered tag and reporting category.
- Retrieve and normalize asset and vulnerability counts across operating-system scope, status, Qualys severity, CVSS ranges, and vulnerability-age ranges.
- Clone and prepare the reporting sheet, replace stale dashboard values, and append the generated statistics for review.
Workflow details
- Tag discovery and scoping: The workflow authenticates to the vulnerability-management environment, finds the configured root tag and its child tags, expands nested tag relationships, and classifies each tag for reporting. It then builds queries that scope results to the root tag and each discovered tag.
- Exposure analysis: For every tag, the workflow separates operating-system-related assets from other assets and retrieves counts for assets and vulnerabilities. It applies filters for confirmed or potential findings that are found, enabled, and not ignored, while also calculating counts for disabled or ignored findings.
- Severity and status breakdowns: The workflow groups vulnerability results by platform-related scope, vulnerability status, Qualys severity, and CVSS score ranges. Missing categories are normalized to zero so that the resulting records maintain a consistent structure across tags.
- Age-based reporting: Vulnerabilities are also analyzed by configured age ranges covering 0–30, 31–60, 61–90, 91–180, and 181–999 days. Each time range is broken down by severity and combined with the broader tag-level statistics.
- Dashboard publication: The workflow clones a spreadsheet template, renames and moves the resulting sheet, clears the existing reporting area, updates severity headers, and appends the generated rows so the latest exposure metrics are available in the prepared dashboard.
What changed
The dashboard is assembled in one workflow run from a consistent set of tag and vulnerability queries. The required filters, category checks, normalization, spreadsheet preparation, and data handoff occur automatically, leaving users to review the resulting dashboard rather than construct it manually.
Work removed
Repeatedly searching for child tags; running separate asset and vulnerability lookups for each tag; checking operating-system, status, severity, CVSS, and age-range counts; converting missing categories to zero; copying results into spreadsheet rows; clearing old dashboard values; and manually updating report headers.
Expected outcome
One refresh automates at least five recurring reporting dimensions—tag scope, status, severity, CVSS, and vulnerability age—along with the associated spreadsheet preparation; exact time savings will depend on the number of tags and findings processed.
