<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-vulnerability-remediation-workflows
description: >-
  Automate vulnerability remediation workflows including scan result ingestion,
  prioritization by risk score, remediation ticket creation, patch deployment
  tracking, and SLA compliance monitoring.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - vulnerability-management
  - remediation
  - patching
  - risk-scoring
  - sla
  - nessus
  - qualys
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Automating Vulnerability Remediation Workflows

## Overview

Vulnerability remediation automation bridges the gap between scan results and
actual fixes. This skill automates ingestion of vulnerability scan data,
risk-based prioritization using CVSS and asset context, ticket creation with
remediation guidance, and SLA tracking through closure.

Mode: `[MODE: BLUE]` — Vulnerability lifecycle management.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests` | Required |
| Vulnerability scanner API (Nessus, Qualys, Tenable.io) | Required |
| Ticketing system API (Jira, ServiceNow) | Required |
| Asset inventory / CMDB for context enrichment | Required |

## Key Concepts

### Risk-Based Prioritization

```python
def calculate_risk_score(vuln: dict, asset: dict) -> float:
    """Calculate composite risk score from CVSS and asset context."""
    cvss = vuln.get("cvss_score", 0.0)
    asset_criticality = {"mission-critical": 1.0, "high": 0.8, "standard": 0.5, "low": 0.2}
    criticality_weight = asset_criticality.get(asset.get("criticality", "standard"), 0.5)
    exploit_available = 1.3 if vuln.get("exploit_available") else 1.0
    internet_facing = 1.2 if asset.get("internet_facing") else 1.0
    return round(min(cvss * criticality_weight * exploit_available * internet_facing, 10.0), 1)
```

### SLA Calculation

```python
SLA_DAYS = {"critical": 7, "high": 30, "medium": 90, "low": 180}

def get_sla_deadline(severity: str, discovery_date: str) -> str:
    """Calculate SLA deadline based on severity."""
    from datetime import datetime, timedelta
    discovered = datetime.fromisoformat(discovery_date)
    days = SLA_DAYS.get(severity, 180)
    return (discovered + timedelta(days=days)).isoformat()
```

## Workflow

### Step 1: Ingest Scan Results

```bash
node scripts/agent.js --action ingest --scanner nessus --scan-id 12345
```

### Step 2: Prioritize Vulnerabilities

```bash
node scripts/agent.js --action prioritize --input /tmp/vulns/scan_results.json
```

### Step 3: Create Remediation Tickets

```bash
node scripts/agent.js --action create-tickets --input /tmp/vulns/prioritized.json
```

### Step 4: Track SLA Compliance

```bash
node scripts/agent.js --action sla-report --scope all
```

## Detection

```yaml
title: Automating Vulnerability Remediation Workflows Detection
id: 40d69f06-fbfe-4bd7-8bcc-e3f099be5a8b
status: experimental
description: Detects suspicious activity related to automating vulnerability remediation workflows techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*automating*vulnerability*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automating Vulnerability Remediation Workflows Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Scan results ingest with correct CVE mapping
- [ ] Risk scores account for asset criticality and exploit availability
- [ ] Tickets include remediation steps and SLA deadline
- [ ] SLA report identifies overdue and at-risk vulnerabilities

## References

- [Tenable.io API](https://developer.tenable.com/reference/navigate)
- [Qualys API Guide](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf)
- [FIRST CVSS v3.1 Calculator](https://www.first.org/cvss/calculator/3.1)
