Vulnerability Response Management Workflows

Use VRM workflows to move vulnerability data from ingestion through staged enrichment, case management, remediation, and reporting.

Choose Your Path

Goal	Go To
Follow findings from CSV or API into staging	Ingest and Page Findings
Understand bulk enrichment and scoring	Stage, Enrich, and Write Findings
Trace cases and remediation	Group Findings and Create Cases
Monitor automation and reporting	Monitor the Workflow

Workflow Summary

Stage	Primary Automation	Outcome
1	Ingest source data	Accept findings and assets from CSV input, a webhook, or connector-specific integration logic.
2	Create ingestion pages	Split large finding sets into file-backed VRM - Ingestion Page records.
3	Stage a batch	VRM - Stage Enrichment collects pending pages into a VRM - Staged Ingestion record.
4	Populate intelligence	VRM - Populate Swimlane Intelligence Cache looks up CVE metadata for the staged findings.
5	Enrich and write	VRM - Enrich Findings compares known findings and assets, applies exceptions, scores risk, and creates or updates Vulnerability Finding records.
6	Create and update cases	Link grouped findings to cases and keep case risk and status synchronized.
7	Create remediation items	Route remediation work to owners and IT service management channels.
8	Synchronize and report	Update ticket and finding status, identify records requiring attention, and generate reporting records.

Ingest and Page Findings

VRM supports multiple entry paths that converge on ingestion pages.

Entry Path	Action	Use
Finding CSV	Ingest Finding CSV	Reads a finding CSV attachment from VRM - CSV Import and creates ingestion pages.
Asset CSV	Ingest Asset CSV	Reads asset rows, maps source columns, and submits asset pages for writing.
Webhook or integration	Scanner playbook or webhook	Accepts a finding payload and writes it into the same ingestion-page path.

Write Ingestion Page creates an ingestion page record and attaches the JSON page file.

Page size on the CSV import record controls how many findings each page stores.

Queued pages wait until VRM - Stage for Enrichment collects them.

See Ingestion Flow, Ingesting Findings, and Creating Ingestion Pages.

Stage, Enrich, and Write Findings

The VRM - Stage for Enrichment playbook runs the bulk path.

VRM - Stage Enrichment collects findings from ingestion pages that are pending or partially submitted. It creates a VRM - Staged Ingestion record, attaches incoming findings, and updates page status. The action is blocked when another staging batch is still in progress.

VRM - Populate Swimlane Intelligence Cache reads CVE identifiers from the staged findings and builds an intelligence cache. Successful and failed CVE lookups are counted on the staging record.

VRM - Enrich Findings uses the intelligence cache, the current findings and assets export, assets, and exceptions. It creates or updates Vulnerability Finding records and writes Created, Updated, Skipped, and Failed. Failed items are attached on Failed Findings.

Grouping rules and risk-score weights come from VRM Client Configuration. See Configuring and Calculating Risk Score.

To reprocess one finding, open the Vulnerability Finding record and click Reprocess Finding in the Details pane.

See Processing and Enrichment and Export Records and Delta Training.

Associate Findings and Assets

VRM - Enrich Findings associates a finding with a Vulnerability Asset by using available identifiers. After association, the finding receives asset criticality, zone, remediation owner, and remediation channel data.

Supporting asset flows still maintain inventory outside the batch path:

Ingest Asset CSV and Write Assets create or update assets.

Asset risk and metadata refresh on the configured schedule.

Asset changes can propagate to associated open findings.

Apply Exceptions

The enrichment action evaluates enabled, unexpired exception records that match the current finding. A matching exception changes the finding state so that the finding can be excluded from standard remediation and SLA calculations.

See Exception Management.

Group Findings and Create Cases

VRM provides three case-management paths.

Path	Automation	Analyst Involvement
Manual	Create New Case	Select findings, create a case, and initiate remediation when ready.
Automated grouping	Grouping rules on VRM Client Configuration and case-creation flows	Review the generated case and create remediation items.
Automated grouping and remediation	Grouping plus VRM - Automate Remediation	Monitor automatically created cases and remediation items.

Manual Workflow

Automated Grouping Workflow

Automated workflow for grouping findings into a vulnerability case

Automated Grouping and Remediation Workflow

Automated workflow for grouping findings, creating a case, and starting remediation

Supporting actions keep the case current:

Update Case Risk Score recalculates one case.

Create New Case links selected findings to a case.

Add Findings adds findings to an existing case.

See Vulnerability Case Management.

Create and Track Remediation

Create Vulnerability Remediation Items creates work records from a case and its associated findings.

Create ITSM Ticket submits an item after a user initiates the action, or automatically when routing is enabled.

Ticket-status checks update open remediation items on the configured schedule.

Close Ticket updates the remediation item when the external work is closed.

See Creating and Managing Remediation Items and ITSM Response Data Model.

Identify Records Requiring Attention

Record-triggered flows evaluate Requires Attention for assets, cases, findings, and remediation items. Use the Requires Attention View dashboard to locate records that can block downstream automation.

Generate Reporting Data

The VRM - Reporting playbook writes metric records for assets, exceptions, findings, and remediation items. The VRM - Reporting dashboard uses these records for current and historical views.

Monitor the Workflow

Use the following views:

VRM Utilities Dashboard for Ingestion and Enrichment Queue, CSV ingest volume, and enrichment over time.

VRM - Ingestion Page for page-level status and errors.

VRM - Staged Ingestion for Status, Created, Updated, Skipped, Failed, and Failed Findings.

VRM - Export Findings & Assets for the current known-finding and asset files.

Requires Attention View for records blocked by missing data or failed automation.

VRM - Reporting for historical and aggregate metrics.

See Monitoring Ingestion and Enrichment.

Next Steps

Use VRM Applications and Dashboards to identify where each workflow stores its results.

Use VRM Playbooks and Components to review VRM - Stage for Enrichment.