Installing and Configuring
Install and configure Vulnerability Response Management (VRM) 26.3.0 so the tenant can ingest findings, run the staged enrichment pipeline, and export known findings and assets.
VRM 26.3.0 is a breaking change from earlier VRM packages. Import the 26.3.0 enterprise or client-tenant package. Do not treat this release as an installer-only update on top of 25.2.x content.
Quick Path
Step | Action | Details |
|---|---|---|
1 | Confirm tenant prerequisites | |
2 | Import the VRM 26.3.0 package | |
3 | Verify the enrichment connector | |
4 | Configure VRM Client Configuration | |
5 | Bootstrap the findings and assets export | |
6 | Connect scanners and ITSM channels |
Confirm Tenant Prerequisites
VRM 26.3.0 requires two account feature flags. Contact Swimlane Support before you import the package and ask Support to enable:
- Security Intelligence
- Bulk Record Ingest
If findings include CVE identifiers, also ask Support to confirm that Security Intelligence is available in the tenant region.
Customers cannot enable these flags. If either flag is missing, staged enrichment cannot complete.
Import the VRM Package
- Obtain the VRM 26.3.0 enterprise or client-tenant solution package (.ssp) from Swimlane.
- Import the package using the standard Swimlane solution package import. See Import Swimlane Solution Packages.
- Confirm that the following solution playbooks are present:
- VRM - Vulnerability Response Management
- VRM - Stage for Enrichment
- VRM - Utilities
- VRM - Reporting
- Confirm that the following applications are present:
Application | Acronym | Use |
|---|---|---|
Vulnerability Finding | VFIN | Primary finding records |
Vulnerability Asset | VAST | Asset inventory associated with findings |
Vulnerability Case Management | VRSP | Grouped finding cases |
Vulnerability Remediation Item | VRI | Remediation and ticket tracking |
Vulnerability Exception | VEXC | Exception rules |
VRM - CSV Import | VCI | Finding and asset CSV intake |
VRM - Ingestion Page | VMIP | Paged finding batches |
VRM - Staged Ingestion | VSI | Staging records for bulk enrichment |
VRM - Export Findings & Assets | VEF | Known-finding and asset export files |
VRM - Reporting | VRPT | Reporting snapshots |
Verify the Swimlane VRM Enrichment Connector
The 26.3.0 package includes the Swimlane VRM Enrichment connector. The staged pipeline uses this connector to stage batches, populate intelligence cache, enrich findings, and export known findings and assets.
- Open Marketplace or Connectors and locate Swimlane VRM Enrichment.
- Confirm that version 2.1.2 or later is installed. The VRM Client Configuration asset banner shows VRM Enrichment and the installed version.
- If the connector is missing or older than 2.1.2, install 2.1.2 or later before you configure the client asset.
Configure VRM Client Configuration
The VRM Client Configuration asset stores tenant connection details, application names, grouping rules, and risk-score weights for the enrichment connector.
- Open Orchestration > Assets.
- Open VRM Client Configuration.
- Confirm that Title is VRM Client Configuration. Do not change Name (VRM_Client_Configuration).
- Enter the required connection values.
The asset editor lists parameter keys, such as
Parameter | Key | What to Enter |
|---|---|---|
Page Size | page_size | How many incoming findings to store in one VRM - Staged Ingestion record. The package default is 5000. |
Account ID | account_id | The Swimlane account ID for this tenant. |
Tenant ID | tenant_id | The Swimlane tenant ID. |
Host | host | The tenant host, such as your-tenant.swimlane.app. |
Private Access Token | pat | A personal access token that can read and write the VRM applications used by enrichment. |
Assets Application Name | assets_app | Default: Vulnerability Asset. |
Exceptions Application Name | exceptions_app | Default: Vulnerability Exception. |
Findings Application Name | findings_app | Default: Vulnerability Finding. |
Ingestion Pages Application Name | ingestion_pages_app | Default: VRM - Ingestion Page. |
Staged Ingestion Application Name | staged_ingestion_app | Default: VRM - Staged Ingestion. |
Export Findings & Assets Application Name | export_findings_app | Default: VRM - Export Findings & Assets. |
Export Findings & Assets Record ID | export_findings_assets_record_id | Tracking ID of the export record that holds the current export attachments, such as VEF-1. Set this after you complete Bootstrap the Findings and Assets Export. |
Swimlane Intelligence Bulk Batch Size | swimlane_intelligence_bulk_batch_size | CVE identifiers per Intelligence bulk request. The package default is 250. Lower the value if enrichment runs out of memory. |
Grouping Parameters | grouping_parameters | Required JSON grouping rules. First matching rule wins. The package includes a default configuration. Use {"rules":[]} to disable automated grouping. |
Risk Score Parameters | risk_score_parameters | JSON weights and keys for the Turbine Risk Score. The package includes a default configuration. Update only when you need different scoring. |
- Click Test Connection.
- Save the asset.
Treat the private access token as a secret. Do not place token values in documentation, exported examples, or unprotected records.
Bootstrap the Findings and Assets Export
The enrichment connector compares incoming findings to the current known-finding and asset export. Create that export record once, then store its tracking ID on VRM Client Configuration.
- In the VRM - Utilities workspace, open VRM - Export Findings & Assets.
- Create a record.
- Open the Support tab.
- Select Enable for Playbook Button.
- Click Save.
- Click Export All Findings & Assets.
- Open the Main tab and confirm attachments in Vulnerability Findings and Vulnerability Assets.
- Note the record tracking ID, such as VEF-1.
- Open VRM Client Configuration.
- Enter that tracking ID in Export Findings & Assets Record ID (export_findings_assets_record_id).
- Save the asset.
The button starts Export All Findings and Export All Assets in VRM - Stage for Enrichment. Those flows call the connector Export All Records action. If attachments do not appear, confirm connector 2.1.2 or later and that the playbook button is enabled on the export record.
Configure Input Sources and ITSM
After the 26.3.0 pipeline is configured, connect scanners and remediation channels.
Input Sources
- Define vulnerability input sources, such as scanner APIs or CSV exports.
- Request any scanner-specific ingestion playbook from your Swimlane representative.
- Configure the connector assets required for each scanner.
Remediation Channels
- Update the Remediation Channels field on Vulnerability Asset so it includes a unique value for each supported channel.
- Create a component that implements the Remediation Item to Ticket v1.0.0 interface. The component creates a work item in that channel.
- Insert the component into VRM - Route and Submit Ticket to ITSM, in the existing parallel path.
- After the new component and before the parallel WAIT, map the following values with Update Variable:
- Ticket_ID
- Ticket_Status_Updated
- Ticket_Opened
- Ticket_Status
- Ticket_Status_Message
- Create a flow that updates Ticket_Status on the remediation item from the channel, using a webhook or an existing connector.
Next Steps
- Review Vulnerability Response Management Workflows for the staged enrichment path.
- Review VRM Applications and Dashboards to confirm where staging and export records appear.
- Review VRM Playbooks and Components for VRM - Stage for Enrichment.
- Review Configuring and Calculating Risk Score before you edit Risk Score Parameters.