Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
Instrucciones de origen · Vista previa de solo lectura
name
building-vulnerability-scanning-workflow
description
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.
SOC teams need to establish or improve recurring vulnerability scanning programs
Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence
Vulnerability data must be integrated into SIEM for correlation with exploitation attempts
Remediation tracking needs formalization with SLA-based dashboards and reporting
Do not use for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.
Prerequisites
Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS/Greenbone)
Asset inventory with criticality classifications (business-critical, standard, development)
Network access from scanner to all target segments (agent-based or network scan)
SIEM integration for scan result ingestion and correlation
Patch management system (WSUS, SCCM, Intune) for remediation tracking
Download results and apply risk-based prioritization:
import requests
import csv
# Export Nessus results
response = requests.get(
f"{nessus_url}/scans/{scan_id}/export",
headers=headers,
params={"format": "csv"},
verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
)
# Parse and prioritize
vulns = []
reader = csv.DictReader(response.text.splitlines())
for row in reader:
cvss = float(row.get("CVSS v3.0 Base Score", 0))
asset_criticality = get_asset_criticality(row["Host"]) # From asset inventory# Risk-based priority calculation
risk_score = cvss * asset_criticality_multiplier(asset_criticality)
# Boost score if actively exploited (check CISA KEV)if row.get("CVE") in cisa_kev_list:
risk_score *= 1.5
vulns.append({
"host": row["Host"],
"plugin_name": row["Name"],
"severity": row["Risk"],
"cvss": cvss,
"cve": row.get("CVE", "N/A"),
"risk_score": round(risk_score, 1),
"asset_criticality": asset_criticality,
"kev": row.get("CVE") in cisa_kev_list
})
# Sort by risk score
vulns.sort(key=lambda x: x["risk_score"], reverse=True)
CISA KEV (Known Exploited Vulnerabilities) Check:
import requests
kev_response = requests.get(
"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
)
kev_data = kev_response.json()
cisa_kev_list = {v["cveID"] for v in kev_data["vulnerabilities"]}
# Check if vulnerability is actively exploiteddefis_actively_exploited(cve_id):
return cve_id in cisa_kev_list
Step 3: Define Remediation SLAs
Apply SLA-based remediation timelines:
Priority
CVSS Range
Asset Type
SLA
Examples
P1 Critical
9.0-10.0 + KEV
All assets
24 hours
Log4Shell, EternalBlue on prod servers
P2 High
7.0-8.9 or 9.0+ non-KEV
Business-critical
7 days
RCE without known exploit
P3 Medium
4.0-6.9
Business-critical
30 days
Authenticated privilege escalation
P4 Low
0.1-3.9
Standard
90 days
Information disclosure, low-impact DoS
P5 Informational
0.0
Development
Next cycle
Best practice findings, config hardening
Step 4: Integrate with SIEM for Exploitation Detection
Correlate vulnerability scan data with SIEM alerts to detect active exploitation:
index=vulnerability sourcetype="nessus:scan"
| eval vuln_key = Host.":".CVE
| join vuln_key type=left [
search index=ids_ips sourcetype="snort" OR sourcetype="suricata"
| eval vuln_key = dest_ip.":".cve_id
| stats count AS exploit_attempts, latest(_time) AS last_exploit_attempt by vuln_key
]
| where isnotnull(exploit_attempts)
| eval risk = "CRITICAL — Vulnerability being actively exploited"
| sort - exploit_attempts
| table Host, CVE, plugin_name, cvss_score, exploit_attempts, last_exploit_attempt, risk
Alert when KEV vulnerabilities are detected on critical assets:
index=vulnerability sourcetype="nessus:scan" severity="Critical"
| lookup cisa_kev_lookup.csv cve_id AS CVE OUTPUT kev_status, due_date
| where kev_status="active"
| lookup asset_criticality_lookup.csv ip AS Host OUTPUT criticality
| where criticality IN ("business-critical", "mission-critical")
| table Host, CVE, plugin_name, cvss_score, kev_status, due_date, criticality
