building-vulnerability-scanning-workflow

name	building-vulnerability-scanning-workflow
description	Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
domain	cybersecurity
tags	["soc","vulnerability-scanning","nessus","qualys","openvas","cvss","remediation","patch-management"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Building Vulnerability Scanning Workflow

Overview

Cybersecurity skill for building vulnerability scanning workflow. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "building vulnerability scanning workflow"
• "SOC teams need to establish or improve recurring vulnerability scanning programs"
• "Scan results require prioritization beyond raw CVSS scores using asset context a"
• "Vulnerability data must be integrated into SIEM for correlation with exploitatio"

Use this skill when:

• SOC teams need to establish or improve recurring vulnerability scanning programs
• Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence
• Vulnerability data must be integrated into SIEM for correlation with exploitation attempts
• Remediation tracking needs formalization with SLA-based dashboards and reporting

Do not use for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS/Greenbone)
• Asset inventory with criticality classifications (business-critical, standard, development)
• Network access from scanner to all target segments (agent-based or network scan)
• SIEM integration for scan result ingestion and correlation
• Patch management system (WSUS, SCCM, Intune) for remediation tracking

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}