VRM Playbooks and Components

use this reference to identify the playbooks, flows, and reusable components included in the vrm solution choose your path goal go to review core enrichment, case, and remediation flows core vrm playbook flows /#core vrm playbook flows review ingestion and export flows utility playbook flows /#utility playbook flows review scheduled reporting flows reporting playbook flows /#reporting playbook flows find reusable automation logic component reference /#component reference solution playbooks solution playbook purpose vrm vulnerability response management runs finding enrichment, scoring, exceptions, grouping, cases, remediation, it service management synchronization, and automation health checks vrm utilities imports assets and findings, creates and processes ingestion pages, and maintains known finding exports vrm reporting creates reporting records for assets, exceptions, findings, and remediation items how playbooks and components connect use this map to identify the playbook flow, supporting components, required records or configuration, and resulting vrm record for each workflow stage stage primary flows major components dependencies result finding ingestion ingest csv (button) , ingestion page to enrichment pipeline , or ingest vulnerability finding via webhook write csv ingestion pages , vrm map raw json to teds findings , vrm inbound findings filter , and filter remove known findings vrm csv import , vrm ingestion page , and the current known finding export normalized findings submitted to the enrichment pipeline asset ingestion and association ingest asset csv , write assets , and update findings from asset vrm map asset to finding , vrm update enrichment with found asset , and vrm calculate asset metadata asset identifiers, criticality, zone, owner, and remediation channel vulnerability asset records and associated finding context finding enrichment enrichment pipeline , swimlane intelligence retrieval , and re enrich finding vrm enrich vulnerability , vrm calculate turbine risk score , vrm manage vulnerability exceptions , and vrm write create/update vulnerability finding normalized finding, asset context, vulnerability intelligence, and active exceptions created or updated vulnerability finding record grouping and case creation case creation , manual case creation , and create new case vrm automate grouping , vrm automated vulnerability finding grouping , and vrm update case with highest risk score eligible findings, grouping configuration, and finding risk scores vulnerability case management record linked to grouped findings remediation and ticketing create remediation items , automatic or manual ticket creation, and check itsm ticket status vrm create remediation items , vrm route and submit ticket to itsm , and vrm update findings with ticket status case, grouped findings, remediation owner, remediation channel, and itsm configuration vulnerability remediation item and synchronized ticket status reporting asset reporting , exceptions reporting , findings reporting , and remediation items reporting get application fields schema and vrm calculate reporting metrics turbine tenant credentials and operational application data vrm reporting records used by reporting dashboards use component names to locate the action that produced an output or error in a playbook run configure documented assets and workflow settings rather than modifying packaged components unless the component is identified as a supported customization point core vrm playbook flows the vrm vulnerability response management playbook contains the following flows flow trigger purpose ingest vulnerability finding via webhook sensor receives a finding and emits it to the standard finding processing flow enrichment pipeline flow event extends, deduplicates, maps, enriches, scores, checks exceptions, groups, and writes a vulnerability finding swimlane intelligence retrieval subflow retrieves vulnerability metadata and exploit data for supported vulnerability identifiers and updates the finding re enrich finding button or subflow runs enrichment, risk scoring, exceptions, grouping, finding writing, and asset metadata refresh again close finding flow event deduplicates the closure request and writes the resolved finding state case creation schedule finds automatically grouped findings and creates the required cases manual case creation record event assigns a temporary random group id when an analyst starts manual case creation manual case creation case tracking id updated record event replaces the temporary group id after the new case receives its tracking id create new case button or subflow creates a case and updates selected findings with the case tracking id case tracking id changed record event updates finding status when the finding becomes associated with a case update case risk score button or subflow sets one case to the highest risk score among its associated findings update case risk scores schedule recalculates risk scores for open cases create remediation items button or subflow creates remediation work from a case and its grouped findings automatically create itsm ticket record event routes and submits an eligible remediation item automatically manually create itsm ticket button or subflow routes and submits a remediation item after a user initiates the action check itsm ticket status schedule finds stale open remediation items and retrieves current ticket status close itsm ticket button or subflow updates the remediation item when external ticket work is closed update finding/case status from remediation item record event propagates remediation ticket state to associated findings and the parent case calculate asset risk scores schedule processes stale assets and recalculates aggregate asset risk update findings from asset record event propagates relevant asset changes to associated open findings save finding sla calculated fields record event calculates and saves finding sla values and related timestamps update requires attention flag asset record event evaluates missing or invalid asset data and updates requires attention update requires attention flag case record event evaluates case automation state and updates requires attention update requires attention flag finding record event evaluates finding data and processing state and updates requires attention update requires attention flag remediation item record event evaluates remediation routing and ticket state and updates requires attention utility playbook flows the vrm utilities playbook contains the following flows flow trigger purpose ingest csv (button) button or subflow creates ingestion pages from a finding csv attachment write ingestion page flow event creates one ingestion page record and its json page file process ingestion page records schedule selects queued ingestion pages and submits each page for conversion and enrichment ingestion page to enrichment pipeline flow event filters raw findings, maps them to the turbine schema, and submits each finding to enrichment ingest asset csv button or subflow reads, maps, and pages asset csv rows write assets flow event creates or updates normalized assets from one submitted page generate fresh export record event creates a current known finding export and marks prior exports stale reporting playbook flows the vrm reporting playbook contains the following scheduled flows flow purpose asset reporting queries asset fields and metrics and writes asset reporting records exceptions reporting queries exception fields and metrics and writes exception reporting records findings reporting queries finding fields and metrics and writes finding reporting records remediation items reporting queries remediation item fields and metrics and writes remediation reporting records configure the turbine tenant credentials asset before enabling the reporting playbook component reference components are grouped by the workflow stage they support remediation and ticketing components component purpose vrm create remediation items creates remediation item records from a case and grouped findings vrm automate remediation starts remediation automatically for findings configured for automated grouping and remediation vrm route and submit ticket to itsm selects the configured remediation route and submits the ticket vrm submit ticket to turbine itsm creates a ticket through the default turbine remediation path vrm check itsm ticket status vrm check ticket status retrieves current status for open external tickets vrm get remediation status from turbine retrieves remediation status from the default internal ticket path vrm update findings with ticket status propagates ticket status to associated findings vrm update vulnerability response record updates the parent case from remediation results grouping and case components component purpose vrm automate grouping evaluates grouping settings and prepares related findings for case creation vrm automated vulnerability finding grouping groups findings by configured criteria and promotes eligible groups to cases vrm update case with highest risk score sets case risk to the highest score among associated findings generate random group id creates a temporary group identifier for manual case creation update group id from case tracking id replaces a temporary grouping value with the created case tracking id finding enrichment and risk components component purpose vrm extend vulnerability finding schema adds solution specific objects to the normalized finding vrm enrich vulnerability enriches supported vulnerability identifiers with swimlane intelligence data vrm calculate turbine risk score calculates the combined finding risk score from vulnerability and asset factors vrm manage vulnerability exceptions vrm manage vulnerability exceptions (reprocess finding) finds applicable active exceptions and applies the correct finding state the reprocess variant supports finding re enrichment vrm identify deduplicate finding identifies an existing finding before create or update operations vrm write create/update vulnerability finding creates a new finding or updates the matching existing finding vrm re enrich update finding writes finding changes produced by a re enrichment run asset and normalization components component purpose vrm map raw json to teds findings maps scanner specific source fields to the turbine schema vulnerability finding format vrm normalize teds vulnerability finding provides the normalization stage for teds vulnerability findings vrm map asset to finding finds the associated asset by primary identifier, mac address, hostname, or ip address vrm update enrichment with found asset adds asset context to the finding being enriched vrm calculate asset metadata calculates asset risk and metadata from current findings refresh asset metadata refreshes stored asset metadata after finding changes ingestion and filtering components component purpose write csv ingestion pages divides finding csv data into ingestion pages vrm get findings csv export retrieves the current known finding export or generates a replacement vrm inbound findings filter coordinates comparison of incoming findings with known findings filter remove known findings removes findings already present in the known finding export and applies exclusions reporting components component purpose get application fields schema retrieves application field metadata used to map reporting queries vrm calculate reporting metrics calculates metric values from reporting query results trace a workflow when troubleshooting a record identify the application and current record status find the corresponding stage in vulnerability response management workflows docid\ ny3lbmo1jcrpu3okyizox locate the responsible solution playbook and flow in this reference review the flow run and the component action that produced the current state check requires attention , the supporting status message, and the relevant utility application for processing errors next steps use installing and configuring docid\ ogy ryoz7xlrtm0xg73zm for solution and integration setup use vrm applications and dashboards docid\ l9p4peqrmb2t3y0zhfyzl to identify the records affected by each flow use monitoring ingestion and enrichment docid\ jfceyuzxvdvxwwgvorlo4 to review ingestion operations