performing-endpoint-vulnerability-remediation

name	performing-endpoint-vulnerability-remediation
description	Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.
domain	cybersecurity
tags	["endpoint","vulnerability-management","patching","CVE","remediation","CVSS"]
subdomain	endpoint-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Performing Endpoint Vulnerability Remediation

Overview

Cybersecurity skill for performing endpoint vulnerability remediation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing endpoint vulnerability remediation"
• "Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)"
• "Responding to zero-day CVE advisories requiring immediate patching"
• "Maintaining compliance with patch management SLAs (critical within 14 days, high"

Use this skill when:

• Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)
• Responding to zero-day CVE advisories requiring immediate patching
• Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)
• Building a prioritized remediation plan from vulnerability scan results

Do not use this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV/XML format)
• Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)
• Administrative access to target endpoints or deployment infrastructure
• Change management process for production endpoint patching
• Testing environment for patch validation before production rollout

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}