Performing Endpoint Vulnerability Remediation

---
name: performing-endpoint-vulnerability-remediation
description: 'Use when performs vulnerability remediation on endpoints by prioritizing
  CVEs based on risk scoring, deploying patches, applying configuration changes, and
  validating fixes. Use when remediating findings from vulnerability scans, responding
  to critical CVE advisories, or maintaining endpoint compliance with patch management
  SLAs. Activates for requests involving vulnerability remediation, CVE patching,
  endpoint vulnerability management, or security fix deployment.

  '
domain: cybersecurity
tags:
- endpoint
- vulnerability-management
- patching
- CVE
- remediation
- CVSS
subdomain: endpoint-security
version: 1.0.0
author: oyi77
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
category: cybersecurity
---

# Performing Endpoint Vulnerability Remediation

## Overview

Cybersecurity skill for performing endpoint vulnerability remediation. Follows industry best practices and security standards.

## When to Use

**Trigger phrases:**
- "performing endpoint vulnerability remediation"
- "Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)"
- "Responding to zero-day CVE advisories requiring immediate patching"
- "Maintaining compliance with patch management SLAs (critical within 14 days, high"


Use this skill when:
- Remediating vulnerabilities identified by scanners (Nessus, Qualys, Rapid7)
- Responding to zero-day CVE advisories requiring immediate patching
- Maintaining compliance with patch management SLAs (critical within 14 days, high within 30 days)
- Building a prioritized remediation plan from vulnerability scan results

**Do not use** this skill for vulnerability scanning itself (use scanning tools) or for application-layer vulnerability remediation (use DevSecOps processes).


## When NOT to Use

- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope


## Prerequisites

- Vulnerability scan results (Nessus, Qualys, or Rapid7 export in CSV/XML format)
- Patch management platform (WSUS, SCCM, Intune, or third-party like Automox)
- Administrative access to target endpoints or deployment infrastructure
- Change management process for production endpoint patching
- Testing environment for patch validation before production rollout

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Plan Operations** — Define objectives, scope, and success criteria for endpoint vulnerability remediation operations.
2. **Prepare Environment** — Set up tools, access, and data sources required for endpoint vulnerability remediation.
3. **Execute Core Workflow** — Perform the endpoint vulnerability remediation operations following established procedures.
4. **Validate Results** — Verify that results meet quality standards and objectives.
5. **Report Findings** — Document results, observations, and recommendations.
6. **Follow Up** — Track remediation actions and verify fixes where applicable.

## Tools

- **Analysis Platform** — Data processing and visualization
- **Collaboration Tools** — Team coordination and knowledge sharing


## Process

1. **Reconnaissance** — Gather target information, identify attack surface, enumerate services
1. **Analysis/Exploitation** — Execute the technique, analyze results, document findings
1. **Reporting** — Document IOCs, write findings, provide remediation recommendations

## Verification

- [ ] All endpoint vulnerability remediation procedures executed completely and documented
- [ ] Findings validated against multiple data sources
- [ ] False positives identified and filtered
- [ ] Results documented with evidence and timestamps
- [ ] Recommendations provided with risk-based prioritization

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |