performing-endpoint-vulnerability-remediation

name	performing-endpoint-vulnerability-remediation
description	Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","vulnerability-management","patching","CVE","remediation","CVSS"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Performing Endpoint Vulnerability Remediation

When to Use

Use this skill when:

• Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)
• Responding to zero-day CVE advisories requiring immediate patching
• Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)
• Building a prioritized remediation plan from vulnerability scan results

Do not use this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).

Prerequisites

• Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV/XML format)
• Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)
• Administrative access to target endpoints or deployment infrastructure
• Change management process for production endpoint patching
• Testing environment for patch validation before production rollout

Workflow

Step 1: Import and Prioritize Vulnerability Findings

Priority scoring combines:
1. CVSS Base Score (0-10)
2. EPSS (Exploit Prediction Scoring System) - probability of exploitation
3. CISA KEV (Known Exploited Vulnerabilities) catalog membership
4. Asset criticality (business impact of affected endpoint)
5. Network exposure (internet-facing vs. internal)

Priority Matrix:
  P1 (Critical - 14 days SLA):
    - CVSS >= 9.0 OR
    - Listed in CISA KEV OR
    - Active exploitation in the wild + CVSS >= 7.0

  P2 (High - 30 days SLA):
    - CVSS 7.0-8.9 AND
    - EPSS > 0.5 (50% probability of exploitation)

  P3 (Medium - 60 days SLA):
    - CVSS 4.0-6.9 OR
    - CVSS 7.0-8.9 with EPSS < 0.1

  P4 (Low - 90 days SLA):
    - CVSS < 4.0 AND
    - No known exploit

Step 2: Identify Remediation Actions

For each vulnerability, determine the appropriate remediation:

Remediation Types:
1. Patch: Apply vendor security update (most common)
2. Configuration change: Modify settings to mitigate (registry, GPO)
3. Upgrade: Update to newer software version
4. Workaround: Apply temporary mitigation when patch unavailable
5. Compensating control: Network segmentation, WAF rule, EDR rule
6. Accept risk: Document accepted risk with CISO sign-off

Step 3: Deploy Patches via WSUS/SCCM

# WSUS: Approve patches for deployment
# 1. Open WSUS Console
# 2. Navigate to Updates → Security Updates
# 3. Approve selected KBs for target computer groups

# SCCM: Create Software Update Group
# 1. Software Library → Software Updates → All Software Updates
# 2. Select required KBs → Create Software Update Group
# 3. Deploy to target collection with maintenance window

# Intune: Create Windows Update Ring
# Devices → Windows → Update rings
# Configure: Quality updates deferral = 0 days (for critical)
# Feature updates deferral = per policy

# PowerShell: Force Windows Update check
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -KBArticleID "KB5034441" -Install -AcceptAll -AutoReboot

# Verify patch installation
Get-HotFix -Id "KB5034441"
systeminfo | findstr "KB5034441"