Performing Endpoint Vulnerability Remediation

---
name: performing-endpoint-vulnerability-remediation
description: Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, Dağıt:ing patches, applying configuration changes, and validating fixes. Use remediating yaparken Bul:ings
  from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching,
  endpoint vulnerability management, or security fix Dağıt:ment.
tags:
- CVSS
- vulnerability-management
- CVE
- endpoint-security
- fetih
- remediation
- endpoint
- cybersecurity
- patching
- siber-güvenlik
triggers:
- api
- authentication
- cloud
- dns
- endpoint
- exploit
- http
- log
- network
- performing
- remediation
- vulnerability
category: endpoint-security
source_subdomain: endpoint-security
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
adapted_for: fetih
---

# Performing Endpoint Vulnerability Remediation


## Ne Zaman Kullanılır

Use bu skill when:
- Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)
- Responding to zero-day CVE advisories requiring immediate patching
- Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)
- Building a prioritized remediation plan from vulnerability scan results

**Kullanma:** bu skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).

## Ön Gereksinimler

- Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV/XML format)
- Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)
- Administrative Erişim: target endpoints or Dağıt:ment infrastructure
- Change management process for production endpoint patching
- Testing environment for patch validation before production rollout

## İş Akışı

### Adım 1: Import and Prioritize Vulnerability Bul:ings

```
Priority scoring combines:
1. CVSS Base Score (0-10)
2. EPSS (Exploit Prediction Scoring System) - probability of exploitation
3. CISA KEV (Known Exploited Vulnerabilities) catalog membership
4. Asset criticality (business impact of affected endpoint)
5. Network exposure (internet-facing vs. internal)

Priority Matrix:
  P1 (Critical - 14 days SLA):
    - CVSS >= 9.0 OR
    - Listed in CISA KEV OR
    - Active exploitation in the wild + CVSS >= 7.0

  P2 (High - 30 days SLA):
    - CVSS 7.0-8.9 AND
    - EPSS > 0.5 (50% probability of exploitation)

  P3 (Medium - 60 days SLA):
    - CVSS 4.0-6.9 OR
    - CVSS 7.0-8.9 with EPSS < 0.1

  P4 (Low - 90 days SLA):
    - CVSS < 4.0 AND
    - No known exploit
```

### Adım 2: Identify Remediation Actions

For each vulnerability, Belirle: the appropriate remediation:

```
Remediation Types:
1. Patch: Apply vendor security update (most common)
2. Configuration change: Modify settings to mitigate (registry, GPO)
3. Upgrade: Update to newer software version
4. Workaround: Apply temporary mitigation when patch unavailable
5. Compensating control: Network segmentation, WAF rule, EDR rule
6. Accept risk: Document accepted risk with CISO sign-off
```

### Adım 3: Dağıt: Patches via WSUS/SCCM

```powershell


Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate -KBArticleID "KB5034441" -Install -AcceptAll -AutoReboot

Get-HotFix -Id "KB5034441"
systeminfo | Bul:str "KB5034441"
```

### Adım 4: Apply Configuration-Based Remediations

```powershell
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
  -Name EnableMulticast -Value 0 -PropertyType DWORD -Force

```

### Adım 5: Handle Zero-Day Vulnerabilities (No Patch Available)

```
When vendor patch is not yet available:

1. Check vendor advisory for workarounds
   - Microsoft: https://msrc.microsoft.com/update-guide
   - Adobe: https://helpx.adobe.com/security.html
   - Linux: Distribution security trackers

2. Apply temporary mitigations:
   - Disable vulnerable feature/service
   - Dağıt: EDR Tespit rule for exploitation attempt
   - Apply network-level blocking (WAF/firewall rules)
   - Restrict Erişim: vulnerable application

3. Monitor for patch release:
   - Subscribe to vendor security mailing list
   - Monitor CISA KEV additions
   - Set calendar reminder for next Patch Tuesday

4. Document workaround with expiration date
```

### Adım 6: Validate Remediation

```powershell
nessuscli scan --target 192.168.1.0/24 --plugin-id 12345

$kb = Get-HotFix -Id "KB5034441" -ErrorAction SilentlyContinue
if ($kb) {
    Write-Host "PASS: KB5034441 kurulu: $(hostname)" -ForegroundColor Green
} else {
    Write-Host "FAIL: KB5034441 missing on $(hostname)" -ForegroundColor Red
}

$svc = Get-Service -Name Spooler
if ($svc.StartType -eq 'Disabled') {
    Write-Host "PASS: Print Spooler disabled" -ForegroundColor Green
}

$val = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" `
  -Name SMB1 -ErrorAction SilentlyContinue
if ($val.SMB1 -eq 0) {
    Write-Host "PASS: SMBv1 disabled" -ForegroundColor Green
}
```

### Adım 7: Report and Track

Generate remediation status report:
```
Remediation Metrics:
  - Total vulnerabilities: X
  - Remediated: Y (Z%)
  - Pending (within SLA): A
  - Overdue (past SLA): B
  - Accepted risk: C
  - Mean time to remediate (MTTR): D days
  - SLA compliance rate: E%
```

## Key Concepts

| Term | Definition |
|------|-----------|
| **CVSS** | Common Vulnerability Scoring System; 0-10 severity scale for vulnerabilities |
| **EPSS** | Exploit Prediction Scoring System; probability (0-1) that a CVE will be exploited in the wild within 30 days |
| **CISA KEV** | CISA Known Exploited Vulnerabilities catalog; federal mandate to patch these CVEs within specified timeframes |
| **SLA** | Service Level Agreement for remediation timelines based on vulnerability severity |
| **MTTR** | Mean Time To Remediate; average days from vulnerability discovery to confirmed fix |
| **Compensating Control** | Alternative security measure when direct remediation is not feasible |

## Tools & Systems

- **Nessus/Tenable.io**: Vulnerability scanning and remediation tracking
- **Qualys VMDR**: Vulnerability management, Tespit, and response platform
- **Rapid7 InsightVM**: Vulnerability assessment with live dashboards
- **WSUS/SCCM/Intune**: Microsoft patch Dağıt:ment infrastructure
- **Automox**: Cloud-native patch management for Windows, macOS, Linux
- **CISA KEV Catalog**: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Common Pitfalls

- **Patching without testing**: Apply patches to a test group first. Some patches cause application compatibility issues or BSOD.
- **Ignoring EPSS scores**: A CVSS 9.8 vulnerability with EPSS 0.01 may be less urgent than a CVSS 7.5 with EPSS 0.95 (actively exploited).
- **Not validating remediation**: Dağıt:ing a patch does not guarantee installation. Always re-scan to confirm closure.
- **Excluding critical servers from patching**: Servers that "cannot be rebooted" accumulate critical vulnerabilities. Schedule maintenance windows.
- **Treating all CVEs equally**: Risk-based prioritization (CVSS + EPSS + asset criticality + exposure) is more effective than patching all criticals first.

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: 8587220f8290276e
-->