[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7E2Q38CSHEPCPC18KKYHWDM":3,"skill-same:01M7E2Q38CSHEPCPC18KKYHWDM":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M7E2Q38CSHEPCPC18KKYHWDM","building-vulnerability-scanning-workflow",null,"Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.","sanjeevafk\u002Fagent-skills","sanjeevafk","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F230678117?v=4","01M7C540EFY46ETG1NNWKS5X3Q","Sanjeev","01M7C540F366J5C1D587BMKH9Q",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fcollections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fcollections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: building-vulnerability-scanning-workflow\ndescription: 'Builds a structured vulnerability scanning workflow using tools like\n  Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security\n  vulnerabilities across infrastructure. Use when SOC teams need to establish recurring\n  vulnerability assessment processes, integrate scan results with SIEM alerting, and\n  build remediation tracking dashboards.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- vulnerability-scanning\n- nessus\n- qualys\n- openvas\n- cvss\n- remediation\n- patch-management\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1595.002\n- T1190\n- T1046\n---\n# Building Vulnerability Scanning Workflow\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to establish or improve recurring vulnerability scanning programs\n- Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence\n- Vulnerability data must be integrated into SIEM for correlation with exploitation attempts\n- Remediation tracking needs formalization with SLA-based dashboards and reporting\n\n**Do not use** for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.\n\n## Prerequisites\n\n- Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS\u002FGreenbone)\n- Asset inventory with criticality classifications (business-critical, standard, development)\n- Network access from scanner to all target segments (agent-based or network scan)\n- SIEM integration for scan result ingestion and correlation\n- Patch management system (WSUS, SCCM, Intune) for remediation tracking\n\n## Workflow\n\n### Step 1: Define Scan Scope and Scheduling\n\nCreate scan policies covering all asset types:\n\n**Nessus Scan Configuration (API):**\n```python\nimport requests\n\nnessus_url = \"https:\u002F\u002Fnessus.company.com:8834\"\nheaders = {\"X-ApiKeys\": f\"accessKey={access_key};secretKey={secret_key}\"}\n\n# Create scan policy\npolicy = {\n    \"uuid\": \"advanced\",\n    \"settings\": {\n        \"name\": \"SOC Weekly Infrastructure Scan\",\n        \"description\": \"Weekly credentialed scan of all server and workstation segments\",\n        \"scanner_id\": 1,\n        \"policy_id\": 0,\n        \"text_targets\": \"10.0.0.0\u002F16, 172.16.0.0\u002F12\",\n        \"launch\": \"WEEKLY\",\n        \"starttime\": \"20240315T020000\",\n        \"rrules\": \"FREQ=WEEKLY;INTERVAL=1;BYDAY=SA\",\n        \"enabled\": True\n    },\n    \"credentials\": {\n        \"add\": {\n            \"Host\": {\n                \"Windows\": [{\n                    \"domain\": \"company.local\",\n                    \"username\": \"nessus_svc\",\n                    \"password\": \"SCAN_SERVICE_PASSWORD\",\n                    \"auth_method\": \"Password\"\n                }],\n                \"SSH\": [{\n                    \"username\": \"nessus_svc\",\n                    \"private_key\": \"\u002Fpath\u002Fto\u002Fnessus_key\",\n                    \"auth_method\": \"public key\"\n                }]\n            }\n        }\n    }\n}\n\nresponse = requests.post(f\"{nessus_url}\u002Fscans\", headers=headers, json=policy,\n                         verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\")  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\nscan_id = response.json()[\"scan\"][\"id\"]\nprint(f\"Scan created: ID {scan_id}\")\n```\n\n**Qualys VMDR Scan via API:**\n```python\nimport qualysapi\n\nconn = qualysapi.connect(\n    hostname=\"qualysapi.qualys.com\",\n    username=\"api_user\",\n    password=\"API_PASSWORD\"\n)\n\n# Launch vulnerability scan\nparams = {\n    \"action\": \"launch\",\n    \"scan_title\": \"Weekly_Infrastructure_Scan\",\n    \"ip\": \"10.0.0.0\u002F16\",\n    \"option_id\": \"123456\",  # Scan profile ID\n    \"iscanner_name\": \"Internal_Scanner_01\",\n    \"priority\": \"0\"\n}\n\nresponse = conn.request(\"\u002Fapi\u002F2.0\u002Ffo\u002Fscan\u002F\", params)\nprint(f\"Scan launched: {response}\")\n```\n\n### Step 2: Process and Prioritize Scan Results\n\nDownload results and apply risk-based prioritization:\n\n```python\nimport requests\nimport csv\n\n# Export Nessus results\nresponse = requests.get(\n    f\"{nessus_url}\u002Fscans\u002F{scan_id}\u002Fexport\",\n    headers=headers,\n    params={\"format\": \"csv\"},\n    verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n)\n\n# Parse and prioritize\nvulns = []\nreader = csv.DictReader(response.text.splitlines())\nfor row in reader:\n    cvss = float(row.get(\"CVSS v3.0 Base Score\", 0))\n    asset_criticality = get_asset_criticality(row[\"Host\"])  # From asset inventory\n\n    # Risk-based priority calculation\n    risk_score = cvss * asset_criticality_multiplier(asset_criticality)\n\n    # Boost score if actively exploited (check CISA KEV)\n    if row.get(\"CVE\") in cisa_kev_list:\n        risk_score *= 1.5\n\n    vulns.append({\n        \"host\": row[\"Host\"],\n        \"plugin_name\": row[\"Name\"],\n        \"severity\": row[\"Risk\"],\n        \"cvss\": cvss,\n        \"cve\": row.get(\"CVE\", \"N\u002FA\"),\n        \"risk_score\": round(risk_score, 1),\n        \"asset_criticality\": asset_criticality,\n        \"kev\": row.get(\"CVE\") in cisa_kev_list\n    })\n\n# Sort by risk score\nvulns.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n```\n\n**CISA KEV (Known Exploited Vulnerabilities) Check:**\n```python\nimport requests\n\nkev_response = requests.get(\n    \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n)\nkev_data = kev_response.json()\ncisa_kev_list = {v[\"cveID\"] for v in kev_data[\"vulnerabilities\"]}\n\n# Check if vulnerability is actively exploited\ndef is_actively_exploited(cve_id):\n    return cve_id in cisa_kev_list\n```\n\n### Step 3: Define Remediation SLAs\n\nApply SLA-based remediation timelines:\n\n| Priority | CVSS Range | Asset Type | SLA | Examples |\n|----------|-----------|------------|-----|---------|\n| **P1 Critical** | 9.0-10.0 + KEV | All assets | 24 hours | Log4Shell, EternalBlue on prod servers |\n| **P2 High** | 7.0-8.9 or 9.0+ non-KEV | Business-critical | 7 days | RCE without known exploit |\n| **P3 Medium** | 4.0-6.9 | Business-critical | 30 days | Authenticated privilege escalation |\n| **P4 Low** | 0.1-3.9 | Standard | 90 days | Information disclosure, low-impact DoS |\n| **P5 Informational** | 0.0 | Development | Next cycle | Best practice findings, config hardening |\n\n### Step 4: Integrate with SIEM for Exploitation Detection\n\nCorrelate vulnerability scan data with SIEM alerts to detect active exploitation:\n\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval vuln_key = Host.\":\".CVE\n| join vuln_key type=left [\n    search index=ids_ips sourcetype=\"snort\" OR sourcetype=\"suricata\"\n    | eval vuln_key = dest_ip.\":\".cve_id\n    | stats count AS exploit_attempts, latest(_time) AS last_exploit_attempt by vuln_key\n  ]\n| where isnotnull(exploit_attempts)\n| eval risk = \"CRITICAL — Vulnerability being actively exploited\"\n| sort - exploit_attempts\n| table Host, CVE, plugin_name, cvss_score, exploit_attempts, last_exploit_attempt, risk\n```\n\n**Alert when KEV vulnerabilities are detected on critical assets:**\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\" severity=\"Critical\"\n| lookup cisa_kev_lookup.csv cve_id AS CVE OUTPUT kev_status, due_date\n| where kev_status=\"active\"\n| lookup asset_criticality_lookup.csv ip AS Host OUTPUT criticality\n| where criticality IN (\"business-critical\", \"mission-critical\")\n| table Host, CVE, plugin_name, cvss_score, kev_status, due_date, criticality\n```\n\n### Step 5: Build Remediation Tracking Dashboard\n\n**Splunk Dashboard for Vulnerability Metrics:**\n```spl\n-- Open vulnerabilities by severity\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| stats count by severity\n| eval order = case(severity=\"Critical\", 1, severity=\"High\", 2, severity=\"Medium\", 3,\n                    severity=\"Low\", 4, 1=1, 5)\n| sort order\n\n-- SLA compliance tracking\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| eval sla_days = case(\n    severity=\"Critical\", 1,\n    severity=\"High\", 7,\n    severity=\"Medium\", 30,\n    severity=\"Low\", 90\n  )\n| eval days_open = round((now() - first_detected) \u002F 86400)\n| eval sla_status = if(days_open > sla_days, \"OVERDUE\", \"Within SLA\")\n| stats count by severity, sla_status\n\n-- Remediation trend over 90 days\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval is_open = if(status=\"open\", 1, 0)\n| eval is_closed = if(status=\"fixed\", 1, 0)\n| timechart span=1w sum(is_open) AS opened, sum(is_closed) AS remediated\n```\n\n### Step 6: Automate Remediation Ticketing\n\nCreate tickets automatically for high-priority findings:\n\n```python\nimport requests\n\nservicenow_url = \"https:\u002F\u002Fcompany.service-now.com\u002Fapi\u002Fnow\u002Ftable\u002Fincident\"\nheaders = {\n    \"Content-Type\": \"application\u002Fjson\",\n    \"Authorization\": f\"Bearer {snow_token}\"\n}\n\nfor vuln in vulns:\n    if vuln[\"risk_score\"] >= 8.0:\n        ticket = {\n            \"short_description\": f\"[VULN] {vuln['cve']} — {vuln['plugin_name']} on {vuln['host']}\",\n            \"description\": (\n                f\"Vulnerability: {vuln['plugin_name']}\\n\"\n                f\"CVE: {vuln['cve']}\\n\"\n                f\"CVSS: {vuln['cvss']}\\n\"\n                f\"Host: {vuln['host']}\\n\"\n                f\"Asset Criticality: {vuln['asset_criticality']}\\n\"\n                f\"CISA KEV: {'YES' if vuln['kev'] else 'NO'}\\n\"\n                f\"Risk Score: {vuln['risk_score']}\\n\"\n                f\"Remediation SLA: {'24 hours' if vuln['kev'] else '7 days'}\"\n            ),\n            \"urgency\": \"1\" if vuln[\"kev\"] else \"2\",\n            \"impact\": \"1\" if vuln[\"asset_criticality\"] == \"business-critical\" else \"2\",\n            \"assignment_group\": \"IT Infrastructure\",\n            \"category\": \"Vulnerability\"\n        }\n        response = requests.post(servicenow_url, headers=headers, json=ticket)\n        print(f\"Ticket created: {response.json()['result']['number']}\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System — standardized severity rating (0-10) for vulnerabilities |\n| **CISA KEV** | Known Exploited Vulnerabilities catalog — CISA-maintained list of vulnerabilities with confirmed active exploitation |\n| **Credentialed Scan** | Vulnerability scan using authenticated access for deeper detection than network-only scanning |\n| **Asset Criticality** | Business impact classification determining remediation priority (mission-critical, business-critical, standard) |\n| **Remediation SLA** | Service Level Agreement defining maximum time allowed to patch vulnerabilities by severity |\n| **EPSS** | Exploit Prediction Scoring System — ML-based probability score predicting likelihood of exploitation |\n\n## Tools & Systems\n\n- **Tenable Nessus \u002F Tenable.io**: Enterprise vulnerability scanner with 200,000+ plugin checks and compliance auditing\n- **Qualys VMDR**: Cloud-based vulnerability management with asset discovery, prioritization, and patching integration\n- **OpenVAS (Greenbone)**: Open-source vulnerability scanner with community-maintained vulnerability feed\n- **CISA KEV Catalog**: US government maintained list of actively exploited vulnerabilities requiring mandatory remediation\n- **Rapid7 InsightVM**: Vulnerability management platform with live dashboards and remediation project tracking\n\n## Common Scenarios\n\n- **Zero-Day Response**: New CVE published — run targeted scan for affected software, cross-reference with KEV and exploit databases\n- **Compliance Audit Prep**: Generate PCI DSS or HIPAA vulnerability report showing scan coverage and remediation status\n- **Post-Patch Verification**: Rescan patched systems to confirm vulnerability closure and update tracking dashboard\n- **Network Expansion**: New subnet added to infrastructure — onboard to scan scope with appropriate policy\n- **Third-Party Risk**: Scan externally-facing assets to validate vendor patch compliance before integration\n\n## Output Format\n\n```\nVULNERABILITY SCAN REPORT — Weekly Summary\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScan Date:    2024-03-16 02:00 UTC\nScan Scope:   10.0.0.0\u002F16 (1,247 hosts scanned)\nDuration:     4h 23m\nCoverage:     98.7% (16 hosts unreachable)\n\nFindings:\n  Severity     Count    New    CISA KEV\n  Critical     23       5      3\n  High         187      34     12\n  Medium       892      78     0\n  Low          1,456    112    0\n  Info         3,891    201    0\n\nTop Priority (P1 — 24hr SLA):\n  CVE-2024-21762  FortiOS RCE           3 hosts   KEV: YES\n  CVE-2024-1709   ConnectWise RCE       1 host    KEV: YES\n  CVE-2024-3400   Palo Alto PAN-OS RCE  2 hosts   KEV: YES\n\nSLA Compliance:\n  Critical: 82% within SLA (4 overdue)\n  High:     91% within SLA (17 overdue)\n  Medium:   88% within SLA (107 overdue)\n\nTickets Created: 39 (ServiceNow)\n```\n","# Building Vulnerability Scanning Workflow\n\n## When to Use\n\nUse this skill when:\n- SOC teams need to establish or improve recurring vulnerability scanning programs\n- Scan results require prioritization beyond raw CVSS scores using asset context and threat intelligence\n- Vulnerability data must be integrated into SIEM for correlation with exploitation attempts\n- Remediation tracking needs formalization with SLA-based dashboards and reporting\n\n**Do not use** for penetration testing or active exploitation — vulnerability scanning identifies weaknesses, penetration testing validates exploitability.\n\n## Prerequisites\n\n- Vulnerability scanner (Tenable Nessus Professional, Qualys VMDR, or OpenVAS\u002FGreenbone)\n- Asset inventory with criticality classifications (business-critical, standard, development)\n- Network access from scanner to all target segments (agent-based or network scan)\n- SIEM integration for scan result ingestion and correlation\n- Patch management system (WSUS, SCCM, Intune) for remediation tracking\n\n## Workflow\n\n### Step 1: Define Scan Scope and Scheduling\n\nCreate scan policies covering all asset types:\n\n**Nessus Scan Configuration (API):**\n```python\nimport requests\n\nnessus_url = \"https:\u002F\u002Fnessus.company.com:8834\"\nheaders = {\"X-ApiKeys\": f\"accessKey={access_key};secretKey={secret_key}\"}\n\n# Create scan policy\npolicy = {\n    \"uuid\": \"advanced\",\n    \"settings\": {\n        \"name\": \"SOC Weekly Infrastructure Scan\",\n        \"description\": \"Weekly credentialed scan of all server and workstation segments\",\n        \"scanner_id\": 1,\n        \"policy_id\": 0,\n        \"text_targets\": \"10.0.0.0\u002F16, 172.16.0.0\u002F12\",\n        \"launch\": \"WEEKLY\",\n        \"starttime\": \"20240315T020000\",\n        \"rrules\": \"FREQ=WEEKLY;INTERVAL=1;BYDAY=SA\",\n        \"enabled\": True\n    },\n    \"credentials\": {\n        \"add\": {\n            \"Host\": {\n                \"Windows\": [{\n                    \"domain\": \"company.local\",\n                    \"username\": \"nessus_svc\",\n                    \"password\": \"SCAN_SERVICE_PASSWORD\",\n                    \"auth_method\": \"Password\"\n                }],\n                \"SSH\": [{\n                    \"username\": \"nessus_svc\",\n                    \"private_key\": \"\u002Fpath\u002Fto\u002Fnessus_key\",\n                    \"auth_method\": \"public key\"\n                }]\n            }\n        }\n    }\n}\n\nresponse = requests.post(f\"{nessus_url}\u002Fscans\", headers=headers, json=policy,\n                         verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\")  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\nscan_id = response.json()[\"scan\"][\"id\"]\nprint(f\"Scan created: ID {scan_id}\")\n```\n\n**Qualys VMDR Scan via API:**\n```python\nimport qualysapi\n\nconn = qualysapi.connect(\n    hostname=\"qualysapi.qualys.com\",\n    username=\"api_user\",\n    password=\"API_PASSWORD\"\n)\n\n# Launch vulnerability scan\nparams = {\n    \"action\": \"launch\",\n    \"scan_title\": \"Weekly_Infrastructure_Scan\",\n    \"ip\": \"10.0.0.0\u002F16\",\n    \"option_id\": \"123456\",  # Scan profile ID\n    \"iscanner_name\": \"Internal_Scanner_01\",\n    \"priority\": \"0\"\n}\n\nresponse = conn.request(\"\u002Fapi\u002F2.0\u002Ffo\u002Fscan\u002F\", params)\nprint(f\"Scan launched: {response}\")\n```\n\n### Step 2: Process and Prioritize Scan Results\n\nDownload results and apply risk-based prioritization:\n\n```python\nimport requests\nimport csv\n\n# Export Nessus results\nresponse = requests.get(\n    f\"{nessus_url}\u002Fscans\u002F{scan_id}\u002Fexport\",\n    headers=headers,\n    params={\"format\": \"csv\"},\n    verify=not os.environ.get(\"SKIP_TLS_VERIFY\", \"\").lower() == \"true\",  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments\n)\n\n# Parse and prioritize\nvulns = []\nreader = csv.DictReader(response.text.splitlines())\nfor row in reader:\n    cvss = float(row.get(\"CVSS v3.0 Base Score\", 0))\n    asset_criticality = get_asset_criticality(row[\"Host\"])  # From asset inventory\n\n    # Risk-based priority calculation\n    risk_score = cvss * asset_criticality_multiplier(asset_criticality)\n\n    # Boost score if actively exploited (check CISA KEV)\n    if row.get(\"CVE\") in cisa_kev_list:\n        risk_score *= 1.5\n\n    vulns.append({\n        \"host\": row[\"Host\"],\n        \"plugin_name\": row[\"Name\"],\n        \"severity\": row[\"Risk\"],\n        \"cvss\": cvss,\n        \"cve\": row.get(\"CVE\", \"N\u002FA\"),\n        \"risk_score\": round(risk_score, 1),\n        \"asset_criticality\": asset_criticality,\n        \"kev\": row.get(\"CVE\") in cisa_kev_list\n    })\n\n# Sort by risk score\nvulns.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n```\n\n**CISA KEV (Known Exploited Vulnerabilities) Check:**\n```python\nimport requests\n\nkev_response = requests.get(\n    \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Ffeeds\u002Fknown_exploited_vulnerabilities.json\"\n)\nkev_data = kev_response.json()\ncisa_kev_list = {v[\"cveID\"] for v in kev_data[\"vulnerabilities\"]}\n\n# Check if vulnerability is actively exploited\ndef is_actively_exploited(cve_id):\n    return cve_id in cisa_kev_list\n```\n\n### Step 3: Define Remediation SLAs\n\nApply SLA-based remediation timelines:\n\n| Priority | CVSS Range | Asset Type | SLA | Examples |\n|----------|-----------|------------|-----|---------|\n| **P1 Critical** | 9.0-10.0 + KEV | All assets | 24 hours | Log4Shell, EternalBlue on prod servers |\n| **P2 High** | 7.0-8.9 or 9.0+ non-KEV | Business-critical | 7 days | RCE without known exploit |\n| **P3 Medium** | 4.0-6.9 | Business-critical | 30 days | Authenticated privilege escalation |\n| **P4 Low** | 0.1-3.9 | Standard | 90 days | Information disclosure, low-impact DoS |\n| **P5 Informational** | 0.0 | Development | Next cycle | Best practice findings, config hardening |\n\n### Step 4: Integrate with SIEM for Exploitation Detection\n\nCorrelate vulnerability scan data with SIEM alerts to detect active exploitation:\n\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval vuln_key = Host.\":\".CVE\n| join vuln_key type=left [\n    search index=ids_ips sourcetype=\"snort\" OR sourcetype=\"suricata\"\n    | eval vuln_key = dest_ip.\":\".cve_id\n    | stats count AS exploit_attempts, latest(_time) AS last_exploit_attempt by vuln_key\n  ]\n| where isnotnull(exploit_attempts)\n| eval risk = \"CRITICAL — Vulnerability being actively exploited\"\n| sort - exploit_attempts\n| table Host, CVE, plugin_name, cvss_score, exploit_attempts, last_exploit_attempt, risk\n```\n\n**Alert when KEV vulnerabilities are detected on critical assets:**\n```spl\nindex=vulnerability sourcetype=\"nessus:scan\" severity=\"Critical\"\n| lookup cisa_kev_lookup.csv cve_id AS CVE OUTPUT kev_status, due_date\n| where kev_status=\"active\"\n| lookup asset_criticality_lookup.csv ip AS Host OUTPUT criticality\n| where criticality IN (\"business-critical\", \"mission-critical\")\n| table Host, CVE, plugin_name, cvss_score, kev_status, due_date, criticality\n```\n\n### Step 5: Build Remediation Tracking Dashboard\n\n**Splunk Dashboard for Vulnerability Metrics:**\n```spl\n-- Open vulnerabilities by severity\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| stats count by severity\n| eval order = case(severity=\"Critical\", 1, severity=\"High\", 2, severity=\"Medium\", 3,\n                    severity=\"Low\", 4, 1=1, 5)\n| sort order\n\n-- SLA compliance tracking\nindex=vulnerability sourcetype=\"nessus:scan\" status=\"open\"\n| eval sla_days = case(\n    severity=\"Critical\", 1,\n    severity=\"High\", 7,\n    severity=\"Medium\", 30,\n    severity=\"Low\", 90\n  )\n| eval days_open = round((now() - first_detected) \u002F 86400)\n| eval sla_status = if(days_open > sla_days, \"OVERDUE\", \"Within SLA\")\n| stats count by severity, sla_status\n\n-- Remediation trend over 90 days\nindex=vulnerability sourcetype=\"nessus:scan\"\n| eval is_open = if(status=\"open\", 1, 0)\n| eval is_closed = if(status=\"fixed\", 1, 0)\n| timechart span=1w sum(is_open) AS opened, sum(is_closed) AS remediated\n```\n\n### Step 6: Automate Remediation Ticketing\n\nCreate tickets automatically for high-priority findings:\n\n```python\nimport requests\n\nservicenow_url = \"https:\u002F\u002Fcompany.service-now.com\u002Fapi\u002Fnow\u002Ftable\u002Fincident\"\nheaders = {\n    \"Content-Type\": \"application\u002Fjson\",\n    \"Authorization\": f\"Bearer {snow_token}\"\n}\n\nfor vuln in vulns:\n    if vuln[\"risk_score\"] >= 8.0:\n        ticket = {\n            \"short_description\": f\"[VULN] {vuln['cve']} — {vuln['plugin_name']} on {vuln['host']}\",\n            \"description\": (\n                f\"Vulnerability: {vuln['plugin_name']}\\n\"\n                f\"CVE: {vuln['cve']}\\n\"\n                f\"CVSS: {vuln['cvss']}\\n\"\n                f\"Host: {vuln['host']}\\n\"\n                f\"Asset Criticality: {vuln['asset_criticality']}\\n\"\n                f\"CISA KEV: {'YES' if vuln['kev'] else 'NO'}\\n\"\n                f\"Risk Score: {vuln['risk_score']}\\n\"\n                f\"Remediation SLA: {'24 hours' if vuln['kev'] else '7 days'}\"\n            ),\n            \"urgency\": \"1\" if vuln[\"kev\"] else \"2\",\n            \"impact\": \"1\" if vuln[\"asset_criticality\"] == \"business-critical\" else \"2\",\n            \"assignment_group\": \"IT Infrastructure\",\n            \"category\": \"Vulnerability\"\n        }\n        response = requests.post(servicenow_url, headers=headers, json=ticket)\n        print(f\"Ticket created: {response.json()['result']['number']}\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **CVSS** | Common Vulnerability Scoring System — standardized severity rating (0-10) for vulnerabilities |\n| **CISA KEV** | Known Exploited Vulnerabilities catalog — CISA-maintained list of vulnerabilities with confirmed active exploitation |\n| **Credentialed Scan** | Vulnerability scan using authenticated access for deeper detection than network-only scanning |\n| **Asset Criticality** | Business impact classification determining remediation priority (mission-critical, business-critical, standard) |\n| **Remediation SLA** | Service Level Agreement defining maximum time allowed to patch vulnerabilities by severity |\n| **EPSS** | Exploit Prediction Scoring System — ML-based probability score predicting likelihood of exploitation |\n\n## Tools & Systems\n\n- **Tenable Nessus \u002F Tenable.io**: Enterprise vulnerability scanner with 200,000+ plugin checks and compliance auditing\n- **Qualys VMDR**: Cloud-based vulnerability management with asset discovery, prioritization, and patching integration\n- **OpenVAS (Greenbone)**: Open-source vulnerability scanner with community-maintained vulnerability feed\n- **CISA KEV Catalog**: US government maintained list of actively exploited vulnerabilities requiring mandatory remediation\n- **Rapid7 InsightVM**: Vulnerability management platform with live dashboards and remediation project tracking\n\n## Common Scenarios\n\n- **Zero-Day Response**: New CVE published — run targeted scan for affected software, cross-reference with KEV and exploit databases\n- **Compliance Audit Prep**: Generate PCI DSS or HIPAA vulnerability report showing scan coverage and remediation status\n- **Post-Patch Verification**: Rescan patched systems to confirm vulnerability closure and update tracking dashboard\n- **Network Expansion**: New subnet added to infrastructure — onboard to scan scope with appropriate policy\n- **Third-Party Risk**: Scan externally-facing assets to validate vendor patch compliance before integration\n\n## Output Format\n\n```\nVULNERABILITY SCAN REPORT — Weekly Summary\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nScan Date:    2024-03-16 02:00 UTC\nScan Scope:   10.0.0.0\u002F16 (1,247 hosts scanned)\nDuration:     4h 23m\nCoverage:     98.7% (16 hosts unreachable)\n\nFindings:\n  Severity     Count    New    CISA KEV\n  Critical     23       5      3\n  High         187      34     12\n  Medium       892      78     0\n  Low          1,456    112    0\n  Info         3,891    201    0\n\nTop Priority (P1 — 24hr SLA):\n  CVE-2024-21762  FortiOS RCE           3 hosts   KEV: YES\n  CVE-2024-1709   ConnectWise RCE       1 host    KEV: YES\n  CVE-2024-3400   Palo Alto PAN-OS RCE  2 hosts   KEV: YES\n\nSLA Compliance:\n  Critical: 82% within SLA (4 overdue)\n  High:     91% within SLA (17 overdue)\n  Medium:   88% within SLA (107 overdue)\n\nTickets Created: 39 (ServiceNow)\n```\n",{"name":5,"tags":25,"author":34,"domain":35,"license":15,"version":36,"nist_csf":37,"subdomain":42,"description":43,"mitre_attack":44},[26,27,28,29,30,31,32,33],"soc","vulnerability-scanning","nessus","qualys","openvas","cvss","remediation","patch-management","mahipal","cybersecurity","1.0",[38,39,40,41],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across infrastructure. Use when SOC teams need to establish recurring vulnerability assessment processes, integrate scan results with SIEM alerting, and build remediation tracking dashboards.\n",[45,46,47],"T1595.002","T1190","T1046","main","4e084e84eb42fc53e144c89c0f7f48b39c8a4b0f","collections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow",1,"https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills","https:\u002F\u002Fgithub.com\u002Fsanjeevafk","First make it work. Then make it right. Then make it fast.","2026-11-14 13:36:16",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add sanjeevafk\u002Fagent-skills --skill building-vulnerability-scanning-workflow",{"tool":62,"command":63},"bunx","bunx skills add sanjeevafk\u002Fagent-skills --skill building-vulnerability-scanning-workflow",{"tool":65,"command":66},"pnpm","pnpm dlx skills add sanjeevafk\u002Fagent-skills --skill building-vulnerability-scanning-workflow","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fcollections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002FSKILL.md",true,[70,74,80],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fapi-reference.md","REFERENCE","参考文档",1780,"https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fcollections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002Freferences\u002Fapi-reference.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fagent.py","SCRIPT","脚本",6296,"https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fcollections\u002Fcybersecurity-skills\u002Fskills\u002Fbuilding-vulnerability-scanning-workflow\u002Fscripts\u002Fagent.py",[87,95,103,111,119,126],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":91,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":20},"01M7EFHX67M3KKXT1BXVPA5ADT","zarr-python","Chunked N-D arrays for cloud storage (Zarr-Python 3). Compressed arrays, parallel I\u002FO, S3\u002FGCS via fsspec, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","MIT","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzarr-python\u002FSKILL.md",[],[],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":91,"licenseFileUrl":99,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":20},"01M7EFFQGM51TZBGRENXY50ZYM","whiteboard-diagrams","Create accurate, simple, hand-drawn whiteboard diagrams from a user's process, system, architecture, learning workflow, comparison, or causal explanation. Use when the user asks for a scribbly whiteboard visual, educational workflow graphic, hand-drawn explainer, or diagram like the bundled reference; ask one focused clarification question when the subject or relationships are missing, then generate and visually verify the final image.","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwhiteboard-diagrams\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwhiteboard-diagrams\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":20},"01M7EFF1CSQNTDMHFK4ZGY6NYK","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":115,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":20},"01M7EFE8106X6C28FT8PA74427","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fweb-artifacts-builder\u002FSKILL.md",[],[],{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":91,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":20},"01M7EFCSNZM9G7ZHS6F127Q71X","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":91,"licenseFileUrl":130,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":20},"01M7EFCE7EZMKPRYDDNKBQ9EEH","vercel-deploy","Deploy applications and websites to Vercel. Use when the user requests deployment actions like \"deploy my app\", \"deploy and give me the link\", \"push this live\", or \"create a preview deployment\".","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fvercel-deploy\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fsanjeevafk\u002Fagent-skills\u002Fblob\u002Fmain\u002Fskills\u002Fvercel-deploy\u002FSKILL.md",[],[]]