Vulnerability Response Management Workflows

use vrm workflows to move vulnerability data from ingestion through enrichment, case management, remediation, and reporting choose your path goal go to follow finding data from ingestion to enrichment ingest vulnerability data /#ingest vulnerability data understand asset, exception, and case processing associate findings and assets /#associate findings and assets trace remediation and ticket synchronization create and track remediation /#create and track remediation monitor automation and reporting monitor the workflow /#monitor the workflow workflow summary stage primary automation outcome 1 ingest source data accept findings and assets from csv input, a webhook, or connector specific integration logic 2 create ingestion pages split large finding sets into file backed page records for asynchronous processing 3 normalize and filter map source records to the turbine schema and remove known or excluded findings 4 enrich and score associate assets, retrieve vulnerability intelligence, calculate risk, and apply exceptions 5 write and group findings create or update findings and prepare related findings for case creation 6 create and update cases link grouped findings to cases and keep case risk and status synchronized 7 create remediation items route remediation work to owners and it service management channels 8 synchronize and report update ticket and finding status, identify records requiring attention, and generate reporting records ingest vulnerability data vrm supports multiple entry paths that converge on the same enrichment pipeline entry path flow use finding csv ingest csv (button) reads a finding csv attachment from vrm csv import and creates ingestion pages asset csv ingest asset csv reads asset rows, maps source columns, and submits asset pages for writing webhook or integration ingest vulnerability finding via webhook accepts a finding payload and emits it into the standard finding pipeline see ingestion flow docid\ yqfyivkjd842adc6 asky for the published ingestion overview page and process findings write ingestion page creates an ingestion page record and attaches the json page file process ingestion page records selects queued page records on a schedule ingestion page to enrichment pipeline filters inbound findings and maps source fields to the turbine schema the flow submits each normalized finding to enrichment pipeline or close finding , based on finding state the page size controls how many findings are stored in each ingestion page the package uses vrm ingestion page to track page state, finding count, source, and attached data queued ingestion pages are processed on the configured schedule see creating ingestion pages docid 4zov74mieofgknrehuvjq for page status and monitoring details see processing and enrichment docid\ lqdaxjqvdzdocy w1awb0 for the published processing sequence filter and deduplicate findings the filtering stage prevents unchanged findings from repeatedly entering enrichment vrm get findings csv export retrieves the latest known finding export or generates a fresh export vrm inbound findings filter compares incoming findings with known findings filter remove known findings removes matches and applies configured exclusion logic vrm filtering activity records processing time, memory use, excluded findings, and unseen findings vrm export results identifies the current export used for later comparisons see filtering and deduplication docid\ t2qfi12ilis5utgoclv y for tuning recommendations enrich and score findings the enrichment pipeline flow processes each normalized finding in this order extend the vulnerability finding schema with solution specific data deduplicate the finding within the processing run map the finding to an existing asset or prepare asset data retrieve intelligence for supported vulnerability identifiers calculate the turbine risk score apply active vulnerability exceptions determine automated grouping behavior create or update the vulnerability finding record the separate swimlane intelligence retrieval flow retrieves vulnerability metadata and exploit information on demand, merges the results, and updates the finding to reprocess a finding, open the vulnerability finding record and run re enrich finding the flow repeats asset association, vulnerability enrichment, risk scoring, exception evaluation, grouping, and the finding update associate findings and assets vrm map asset to finding attempts to associate a finding with a vulnerability asset by using available identifiers the component prioritizes the primary asset identifier and can also evaluate mac addresses, hostnames, and ip addresses after association the finding receives asset criticality, zone, remediation owner, and remediation channel data calculate asset risk scores updates aggregate asset risk on a schedule update findings from asset propagates relevant asset changes to open findings refresh asset metadata and vrm calculate asset metadata recalculate metadata used by findings and dashboards asset risk processing runs on the configured schedule apply exceptions vrm manage vulnerability exceptions searches enabled, unexpired exception records that match the current finding a matching exception changes the finding state so that the finding can be excluded from standard remediation and sla calculations exception criteria can include vulnerability identifiers, asset identifiers, asset zones, sources, risk score ranges, and effective dates see exception management docid 0c cv6s6g34j0 7jmi5m for exception configuration and evaluation details group findings and create cases vrm provides three case management paths path automation analyst involvement manual manual case creation and create new case select findings, create a case, and initiate remediation when ready automated grouping case creation and vrm automate grouping review the generated case and create remediation items automated grouping and remediation vrm automate grouping and vrm automate remediation monitor automatically created cases and remediation items manual workflow manual workflow for grouping findings and creating a vulnerability case automated grouping workflow automated workflow for grouping findings into a vulnerability case automated grouping and remediation workflow automated workflow for grouping findings, creating a case, and starting remediation supporting flows keep the case current case tracking id changed updates finding state when a finding receives a case tracking id manual case creation case tracking id updated replaces the temporary group id with the case tracking id update case risk score recalculates one case update case risk scores recalculates open cases on a schedule automated case creation and open case risk recalculation run on configured schedules see vulnerability case management docid\ xu7asa7xgljyn xte5vk for case fields, grouping modes, and remediation actions create and track remediation create remediation items creates work records from a case and its associated findings automatically create itsm ticket submits eligible new items when automatic routing is enabled manually create itsm ticket submits an item after a user initiates the action check itsm ticket status polls open tickets on a schedule update finding/case status from remediation item propagates ticket state to findings and cases close itsm ticket updates the remediation item when the external work is closed close finding writes the resolved finding state the package supports delaying external ticket creation until the user initiates create itsm ticket the exact behavior depends on the variables configured in the remediation component ticket status checks run on the configured schedule see creating and managing remediation items docid\ oktubygx22ptkmv8g8nzv and itsm response data model (ticket creation and updating) docid\ nd5uycairhizgjio jxb4 for record and interface details identify records requiring attention record triggered flows evaluate requires attention for vulnerability asset vulnerability case management vulnerability finding vulnerability remediation item each flow evaluates required data and automation state, updates the flag only when it changes, and stores supporting documentation on the record use the requires attention view dashboard to locate records that can block downstream automation generate reporting data the vrm reporting playbook runs four scheduled flows flow output exceptions reporting exception metric records remediation items reporting remediation metric records asset reporting asset metric records findings reporting finding metric records the scheduled flows write records to vrm reporting the vrm reporting dashboard uses these records for current and historical views configure the turbine tenant credentials asset before enabling the reporting playbook monitor the workflow use the following views vrm utilities dashboard for ingestion and enrichment queues vrm ingestion page for page level status and errors vrm filtering activity for deduplication and filtering metrics requires attention view for records blocked by missing data or failed automation vrm reporting for historical and aggregate metrics see monitoring ingestion and enrichment docid\ jfceyuzxvdvxwwgvorlo4 for operational monitoring guidance next steps use vrm applications and dashboards docid\ l9p4peqrmb2t3y0zhfyzl to identify where each workflow stores its results use vrm playbooks and components docid c4ksjvnm0ixzzecpx4yq to review playbook flows, component dependencies, and outputs