---
title: VRM Playbooks and Components
slug: solutions/vrm-playbooks-and-components
docTags:
createdAt: 2026-07-30T03:14:36.130Z
---
Use this reference to identify the playbooks, flows, and reusable components included in the VRM solution.
## Choose Your Path
| **Goal** | **Go To** |
| --------------------------------------------------- | ------------------------------------------------------- |
| Review core enrichment, case, and remediation flows | [Core VRM Playbook Flows](./#core-vrm-playbook-flows) |
| Review ingestion and export flows | [Utility Playbook Flows](./#utility-playbook-flows) |
| Review scheduled reporting flows | [Reporting Playbook Flows](./#reporting-playbook-flows) |
| Find reusable automation logic | [Component Reference](./#component-reference) |
## Solution Playbooks
| **Solution Playbook** | **Purpose** |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **VRM - Vulnerability Response Management** | Runs finding enrichment, scoring, exceptions, grouping, cases, remediation, IT service management synchronization, and automation-health checks. |
| **VRM - Utilities** | Imports assets and findings, creates and processes ingestion pages, and maintains known-finding exports. |
| **VRM - Reporting** | Creates reporting records for assets, exceptions, findings, and remediation items. |
## How Playbooks and Components Connect
Use this map to identify the playbook flow, supporting components, required records or configuration, and resulting VRM record for each workflow stage.
| **Stage** | **Primary Flows** | **Major Components** | **Dependencies** | **Result** |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| Finding ingestion | **Ingest CSV (Button)**, **Ingestion Page to Enrichment Pipeline**, or **Ingest Vulnerability Finding via Webhook** | **Write CSV Ingestion Pages**, **VRM - Map Raw JSON to TEDS Findings**, **VRM - Inbound Findings Filter**, and **Filter - Remove Known Findings** | **VRM - CSV Import**, **VRM - Ingestion Page**, and the current known-finding export | Normalized findings submitted to the enrichment pipeline |
| Asset ingestion and association | **Ingest Asset CSV**, **Write Assets**, and **Update Findings from Asset** | **VRM - Map Asset to Finding**, **VRM - Update Enrichment with Found Asset**, and **VRM - Calculate Asset Metadata** | Asset identifiers, criticality, zone, owner, and remediation channel | **Vulnerability Asset** records and associated finding context |
| Finding enrichment | **Enrichment Pipeline**, **Swimlane Intelligence Retrieval**, and **Re-Enrich Finding** | **VRM - Enrich - Vulnerability**, **VRM - Calculate Turbine Risk Score**, **VRM - Manage - Vulnerability Exceptions**, and **VRM - Write - Create/Update Vulnerability Finding** | Normalized finding, asset context, vulnerability intelligence, and active exceptions | Created or updated **Vulnerability Finding** record |
| Grouping and case creation | **Case Creation**, **Manual Case Creation**, and **Create New Case** | **VRM - Automate Grouping**, **VRM - Automated Vulnerability Finding Grouping**, and **VRM - Update Case With Highest Risk Score** | Eligible findings, grouping configuration, and finding risk scores | **Vulnerability Case Management** record linked to grouped findings |
| Remediation and ticketing | **Create Remediation Items**, automatic or manual ticket creation, and **Check ITSM Ticket Status** | **VRM - Create Remediation Items**, **VRM - Route and Submit Ticket to ITSM**, and **VRM - Update Findings With Ticket Status** | Case, grouped findings, remediation owner, remediation channel, and ITSM configuration | **Vulnerability Remediation Item** and synchronized ticket status |
| Reporting | **Asset Reporting**, **Exceptions Reporting**, **Findings Reporting**, and **Remediation Items Reporting** | **Get Application Fields Schema** and **VRM - Calculate Reporting Metrics** | **Turbine Tenant Credentials** and operational application data | **VRM - Reporting** records used by reporting dashboards |
:::hint{type="info"}
Use component names to locate the action that produced an output or error in a playbook run. Configure documented assets and workflow settings rather than modifying packaged components unless the component is identified as a supported customization point.
:::
## Core VRM Playbook Flows
The **VRM - Vulnerability Response Management** playbook contains the following flows.
| **Flow** | **Trigger** | **Purpose** |
| ---------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Ingest Vulnerability Finding via Webhook** | Sensor | Receives a finding and emits it to the standard finding-processing flow. |
| **Enrichment Pipeline** | Flow event | Extends, deduplicates, maps, enriches, scores, checks exceptions, groups, and writes a vulnerability finding. |
| **Swimlane Intelligence Retrieval** | Subflow | Retrieves vulnerability metadata and exploit data for supported vulnerability identifiers and updates the finding. |
| **Re-Enrich Finding** | Button or subflow | Runs enrichment, risk scoring, exceptions, grouping, finding writing, and asset metadata refresh again. |
| **Close Finding** | Flow event | Deduplicates the closure request and writes the resolved finding state. |
| **Case Creation** | Schedule | Finds automatically grouped findings and creates the required cases. |
| **Manual Case Creation** | Record event | Assigns a temporary random group ID when an analyst starts manual case creation. |
| **Manual Case Creation - Case Tracking ID updated** | Record event | Replaces the temporary group ID after the new case receives its tracking ID. |
| **Create New Case** | Button or subflow | Creates a case and updates selected findings with the case tracking ID. |
| **Case Tracking-ID Changed** | Record event | Updates finding status when the finding becomes associated with a case. |
| **Update Case Risk Score** | Button or subflow | Sets one case to the highest risk score among its associated findings. |
| **Update Case Risk Scores** | Schedule | Recalculates risk scores for open cases. |
| **Create Remediation Items** | Button or subflow | Creates remediation work from a case and its grouped findings. |
| **Automatically Create ITSM Ticket** | Record event | Routes and submits an eligible remediation item automatically. |
| **Manually Create ITSM Ticket** | Button or subflow | Routes and submits a remediation item after a user initiates the action. |
| **Check ITSM Ticket Status** | Schedule | Finds stale open remediation items and retrieves current ticket status. |
| **Close ITSM Ticket** | Button or subflow | Updates the remediation item when external ticket work is closed. |
| **Update Finding/Case Status from Remediation Item** | Record event | Propagates remediation ticket state to associated findings and the parent case. |
| **Calculate Asset Risk Scores** | Schedule | Processes stale assets and recalculates aggregate asset risk. |
| **Update Findings from Asset** | Record event | Propagates relevant asset changes to associated open findings. |
| **Save Finding SLA Calculated Fields** | Record event | Calculates and saves finding SLA values and related timestamps. |
| **Update Requires Attention Flag: Asset** | Record event | Evaluates missing or invalid asset data and updates Requires Attention. |
| **Update Requires Attention Flag: Case** | Record event | Evaluates case automation state and updates Requires Attention. |
| **Update Requires Attention Flag: Finding** | Record event | Evaluates finding data and processing state and updates Requires Attention. |
| **Update Requires Attention Flag: Remediation Item** | Record event | Evaluates remediation routing and ticket state and updates Requires Attention. |
## Utility Playbook Flows
The **VRM - Utilities** playbook contains the following flows.
| **Flow** | **Trigger** | **Purpose** |
| ----------------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------- |
| **Ingest CSV (Button)** | Button or subflow | Creates ingestion pages from a finding CSV attachment. |
| **Write Ingestion Page** | Flow event | Creates one ingestion page record and its JSON page file. |
| **Process Ingestion Page Records** | Schedule | Selects queued ingestion pages and submits each page for conversion and enrichment. |
| **Ingestion Page to Enrichment Pipeline** | Flow event | Filters raw findings, maps them to the Turbine Schema, and submits each finding to enrichment. |
| **Ingest Asset CSV** | Button or subflow | Reads, maps, and pages asset CSV rows. |
| **Write Assets** | Flow event | Creates or updates normalized assets from one submitted page. |
| **Generate Fresh Export** | Record event | Creates a current known-finding export and marks prior exports stale. |
## Reporting Playbook Flows
The **VRM - Reporting** playbook contains the following scheduled flows.
| **Flow** | **Purpose** |
| ------------------------------- | ------------------------------------------------------------------------------------- |
| **Asset Reporting** | Queries asset fields and metrics and writes asset reporting records. |
| **Exceptions Reporting** | Queries exception fields and metrics and writes exception reporting records. |
| **Findings Reporting** | Queries finding fields and metrics and writes finding reporting records. |
| **Remediation Items Reporting** | Queries remediation item fields and metrics and writes remediation reporting records. |
:::hint{type="info"}
Configure the ****Turbine Tenant Credentials asset before enabling the reporting playbook.
:::
## Component Reference
Components are grouped by the workflow stage they support.
### Remediation and Ticketing Components
| **Component** | **Purpose** |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| **VRM - Create Remediation Items** | Creates remediation item records from a case and grouped findings. |
| **VRM - Automate Remediation** | Starts remediation automatically for findings configured for automated grouping and remediation. |
| **VRM - Route and Submit Ticket to ITSM** | Selects the configured remediation route and submits the ticket. |
| **VRM - Submit Ticket to Turbine ITSM** | Creates a ticket through the default Turbine remediation path. |
| **VRM - Check ITSM Ticket Status**
**VRM - Check Ticket Status** | Retrieves current status for open external tickets. |
| **VRM - Get Remediation Status from Turbine** | Retrieves remediation status from the default internal ticket path. |
| **VRM - Update Findings With Ticket Status** | Propagates ticket status to associated findings. |
| **VRM - Update Vulnerability Response Record** | Updates the parent case from remediation results. |
### Grouping and Case Components
| **Component** | **Purpose** |
| -------------------------------------------------- | ----------------------------------------------------------------------------- |
| **VRM - Automate Grouping** | Evaluates grouping settings and prepares related findings for case creation. |
| **VRM - Automated Vulnerability Finding Grouping** | Groups findings by configured criteria and promotes eligible groups to cases. |
| **VRM - Update Case With Highest Risk Score** | Sets case risk to the highest score among associated findings. |
| **Generate Random Group ID** | Creates a temporary group identifier for manual case creation. |
| **Update Group ID From Case Tracking ID** | Replaces a temporary grouping value with the created case tracking ID. |
### Finding Enrichment and Risk Components
| **Component** | **Purpose** |
| ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **VRM - Extend Vulnerability Finding Schema** | Adds solution-specific objects to the normalized finding. |
| **VRM - Enrich - Vulnerability** | Enriches supported vulnerability identifiers with Swimlane Intelligence data. |
| **VRM - Calculate Turbine Risk Score** | Calculates the combined finding risk score from vulnerability and asset factors. |
| **VRM - Manage - Vulnerability Exceptions**
**VRM - Manage - Vulnerability Exceptions (Reprocess Finding)** | Finds applicable active exceptions and applies the correct finding state. The reprocess variant supports finding re-enrichment. |
| **VRM - Identify - Deduplicate Finding** | Identifies an existing finding before create or update operations. |
| **VRM - Write - Create/Update Vulnerability Finding** | Creates a new finding or updates the matching existing finding. |
| **VRM - Re-Enrich Update Finding** | Writes finding changes produced by a re-enrichment run. |
### Asset and Normalization Components
| **Component** | **Purpose** |
| ------------------------------------------------ | --------------------------------------------------------------------------------------- |
| **VRM - Map Raw JSON to TEDS Findings** | Maps scanner-specific source fields to the Turbine Schema vulnerability finding format. |
| **VRM - Normalize - TEDS Vulnerability Finding** | Provides the normalization stage for TEDS vulnerability findings. |
| **VRM - Map Asset to Finding** | Finds the associated asset by primary identifier, MAC address, hostname, or IP address. |
| **VRM - Update Enrichment with Found Asset** | Adds asset context to the finding being enriched. |
| **VRM - Calculate Asset Metadata** | Calculates asset risk and metadata from current findings. |
| **Refresh Asset Metadata** | Refreshes stored asset metadata after finding changes. |
### Ingestion and Filtering Components
| **Component** | **Purpose** |
| ---------------------------------- | ------------------------------------------------------------------------------------ |
| **Write CSV Ingestion Pages** | Divides finding CSV data into ingestion pages. |
| **VRM - Get Findings CSV Export** | Retrieves the current known-finding export or generates a replacement. |
| **VRM - Inbound Findings Filter** | Coordinates comparison of incoming findings with known findings. |
| **Filter - Remove Known Findings** | Removes findings already present in the known-finding export and applies exclusions. |
### Reporting Components
| **Component** | **Purpose** |
| ------------------------------------- | ------------------------------------------------------------------- |
| **Get Application Fields Schema** | Retrieves application field metadata used to map reporting queries. |
| **VRM - Calculate Reporting Metrics** | Calculates metric values from reporting query results. |
## Trace a Workflow
When troubleshooting a record:
1. Identify the application and current record status.
2. Find the corresponding stage in [Vulnerability Response Management Workflows](docId\:nY3lBmo1Jcrpu3oKYIZOX).
3. Locate the responsible solution playbook and flow in this reference.
4. Review the flow run and the component action that produced the current state.
5. Check **Requires Attention**, the supporting status message, and the relevant utility application for processing errors.
## Next Steps
- Use [Installing and Configuring](docId\:Ogy_Ryoz7XlrTm0XG73zm) for solution and integration setup.
- Use [VRM Applications and Dashboards](docId\:L9P4PEQRMb2T3Y0ZhFYZL) to identify the records affected by each flow.
- Use [Monitoring Ingestion and Enrichment](docId\:JfCEyUZxVdVxWWGVOrLo4) to review ingestion operations.