Building Vulnerability Scanning Workflow

---
name: building-vulnerability-scanning-workflow
description: 'Use when builds a structured vulnerability scanning workflow using tools
  like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation
  of security vulnerabilities across infrastructure. Use when SOC teams need to establish
  recurring vulnerability assessment processes, integrate scan results with SIEM alerting,
  and build remediation tracking dashboards.

  '
domain: cybersecurity
tags:
- soc
- vulnerability-scanning
- nessus
- qualys
- openvas
- cvss
- remediation
- patch-management
subdomain: soc-operations
version: '1.0'
author: oyi77
license: Apache-2.0
nist_csf:
- DE.CM-01
- DE.AE-02
- RS.MA-01
- DE.AE-06
category: cybersecurity
---

# Building Vulnerability Scanning Workflow

## Overview

Cybersecurity skill for building vulnerability scanning workflow. Follows industry best practices and security standards.

## When to Use

**Trigger phrases:**
- "building vulnerability scanning workflow"
- "SOC teams need to establish or improve recurring vulnerability scanning programs"
- "Scan results require prioritization beyond raw CVSS scores using asset context a"
- "Vulnerability data must be integrated into SIEM for correlation with exploitatio"


Use this skill when:
- SOC teams need to establish or improve recurring vulnerability scanning programs
- Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence
- Vulnerability data must be integrated into SIEM for correlation with exploitation attempts
- Remediation tracking needs formalization with SLA-based dashboards and reporting

**Do not use** for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites

- Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS/Greenbone)
- Asset inventory with criticality classifications (business-critical, standard, development)
- Network access from scanner to all target segments (agent-based or network scan)
- SIEM integration for scan result ingestion and correlation
- Patch management system (WSUS, SCCM, Intune) for remediation tracking

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Assess Requirements** — Evaluate current environment and define vulnerability scanning workflow implementation requirements.
2. **Design Architecture** — Plan the vulnerability scanning workflow architecture, including components, integrations, and data flows.
3. **Configure Components** — Set up and configure each vulnerability scanning workflow component according to best practices.
4. **Test Integration** — Validate that all components work together. Run functional and security tests.
5. **Deploy to Production** — Roll out the implementation with monitoring and rollback capabilities.
6. **Validate and Document** — Verify the implementation meets requirements. Document configuration and runbooks.

## Tools

- **Configuration Management** — Infrastructure as code and automation
- **Monitoring Stack** — Observability and alerting
- **Documentation Platform** — Runbooks and architecture docs


## Process

1. **Reconnaissance** — Gather target information, identify attack surface, enumerate services
1. **Analysis/Exploitation** — Execute the technique, analyze results, document findings
1. **Reporting** — Document IOCs, write findings, provide remediation recommendations

## Verification

- [ ] All vulnerability scanning workflow procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |