<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-vulnerability-remediation
description: >-
  Automate vulnerability remediation workflows including CVE prioritization,
  patch deployment orchestration, compensating control application, and
  verification scanning. Integrates with vulnerability scanners (Nessus, Qualys,
  OpenVAS) via API and produces audit-ready remediation evidence.
domain: cybersecurity
subdomain: automation-scripting
tags:
  - vulnerability-management
  - patch-management
  - cve-prioritization
  - remediation
  - nessus
  - qualys
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Automating Vulnerability Remediation

## Overview

Manual vulnerability remediation does not scale. This skill covers building
automated pipelines that ingest scan results, prioritize by exploitability
and asset criticality, generate remediation tickets, orchestrate patching,
and verify fixes with rescan. Output is structured for audit trails and
SIEM correlation.

Mode: `[MODE: BLUE]` — Defensive remediation with risk prioritization.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `jinja2` | Required |
| API access to vulnerability scanner (Nessus, Qualys, or OpenVAS) | Required |
| Ticket system API (Jira, ServiceNow) for remediation tracking | Required |
| SSH/WinRM access to target systems for patch deployment | Required |

## Key Concepts

### CVE Prioritization Engine

```python
from dataclasses import dataclass

@dataclass
class VulnFinding:
    cve_id: str
    cvss_score: float
    epss_score: float
    asset_criticality: str  # critical, high, medium, low
    exploit_available: bool
    patch_available: bool

    @property
    def priority_score(self) -> float:
        """Calculate weighted priority: EPSS + CVSS + asset value + exploit status."""
        weights = {"critical": 1.0, "high": 0.75, "medium": 0.5, "low": 0.25}
        asset_weight = weights.get(self.asset_criticality, 0.25)
        exploit_bonus = 2.0 if self.exploit_available else 0.0
        return (self.epss_score * 40) + (self.cvss_score * 3) + (asset_weight * 20) + exploit_bonus

def prioritize_vulns(findings: list[VulnFinding]) -> list[VulnFinding]:
    """Sort findings by composite priority score descending."""
    return sorted(findings, key=lambda f: f.priority_score, reverse=True)
```

### Nessus Scan Results Ingestion

```python
import requests

def fetch_nessus_results(host: str, port: int, token: str, scan_id: int) -> list[dict]:
    """Pull scan results from Nessus API."""
    url = f"https://{host}:{port}/scans/{scan_id}"
    headers = {"X-ApiKeys": token}
    resp = requests.get(url, headers=headers, verify=False, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    findings = []
    for vuln in data.get("vulnerabilities", []):
        findings.append({
            "plugin_id": vuln["plugin_id"],
            "plugin_name": vuln["plugin_name"],
            "severity": vuln["severity"],
            "count": vuln["count"],
        })
    return findings
```

### Patch Verification via Rescan

```python
def verify_remediation(host: str, cve_id: str, scanner_api: str) -> dict:
    """Trigger targeted rescan and verify CVE is resolved."""
    # Trigger scan targeting specific host
    scan_result = requests.post(
        f"{scanner_api}/scans",
        json={"targets": host, "template": "basic"},
        timeout=30,
    )
    scan_data = scan_result.json()
    # Check if CVE still present
    remaining = [v for v in scan_data.get("vulns", []) if v.get("cve") == cve_id]
    return {
        "host": host,
        "cve": cve_id,
        "remediated": len(remaining) == 0,
        "remaining_instances": len(remaining),
    }
```

## Workflow

### Step 1: Ingest and Prioritize Vulnerabilities

```bash
node scripts/agent.js --action prioritize --scanner-export /tmp/scan_results.json
```

### Step 2: Generate Remediation Plan

```bash
node scripts/agent.js --action plan --scanner-export /tmp/scan_results.json --sla-days 30
```

### Step 3: Verify Remediation

```bash
node scripts/agent.js --action verify --target 192.168.1.10 --cve CVE-2024-1234
```

## Verification

- [ ] Prioritization engine weights EPSS, CVSS, asset criticality, and exploit status
- [ ] Scanner API integration handles authentication and pagination
- [ ] Remediation plans include SLA deadlines and owner assignments
- [ ] Verification confirms CVE absence after patching
- [ ] Exit code 0 on success, 1 on unresolved findings, 2 on error

## References

- [NIST NVD API](https://nvd.nist.gov/developers)
- [EPSS Model](https://www.first.org/epss/)
- [Nessus REST API](https://docs.tenable.com/nessus/api/)
- [MITRE ATT&CK T1203 — Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203/)
