Cybersecurity Automation Examples

SI-01: Tenable Vulnerability Import

Receive vulnerability findings from Tenable.io via webhook and create or update Vulnerability objects with proper asset correlation and SLA calculation.

Tenable Field Mapping:

Asset Resolution AQL:

objectType = "Security Asset" AND (FQDN = "{asset.fqdn}" OR "IP Address" = "{asset.ipv4}")

Deduplication Check:

objectType = "Vulnerability" AND "Scanner Plugin ID" = "TEN-{plugin.id}" AND "Affected Asset" = "{resolved_asset_key}"

SI-02: Multi-Scanner Deduplication

When multiple scanners detect the same vulnerability, prevent duplicate records while maintaining scanner-specific metadata.

Pre-Import AQL Check:

objectType = "Vulnerability" AND "CVE ID" = "{incoming_cve}" AND "Affected Asset" = "{asset_key}" AND "Remediation Status" IN ("Open", "In Progress")

Deduplication Logic:

1. If existing record found with same CVE + Asset: Update Discovery Date, append scanner to notes
2. If no CVE available: Create per-scanner records using Scanner Plugin ID
3. Use scanner prefixes for differentiation: TEN-, QID-, R7-

RS-01: SLA Calculation on Creation

Automatically calculate and set Remediation Due date when vulnerabilities are imported based on severity and asset criticality.

SLA Matrix:

Asset Criticality Lookup:

objectType = "Security Asset" AND Key = "{{object.Affected Asset.Key}}"

RS-02: SLA Breach Notification

Alert security operations and asset owners when vulnerability remediation SLAs are breached.

AQL Query:

objectType = "Vulnerability" AND "Remediation Status" = "Open" AND "Remediation Due" < now()

Escalation Path:

Email Template:

RS-03: SLA Warning (Pre-Breach)

Provide advance warning before SLA breach to enable proactive remediation.

Critical vulnerabilities due within 24 hours:

objectType = "Vulnerability" AND "Remediation Status" = "Open" AND Severity = "Critical" AND "Remediation Due" < now(24h) AND "Remediation Due" > now()

High vulnerabilities due within 48 hours:

objectType = "Vulnerability" AND "Remediation Status" = "Open" AND Severity = "High" AND "Remediation Due" < now(48h) AND "Remediation Due" > now()

RM-01: Risk Review Scheduling

Automatically schedule and notify risk owners when risk reviews are due based on risk score.

Review Cadence by Risk Score:

Query (Critical risks due for review):

objectType = "Risk" AND "Risk Score" >= 20 AND Status IN ("Open", "In Treatment") AND "Review Date" < now(7d)

RM-02: Risk Acceptance Expiration

Alert when accepted risks reach their acceptance expiration date and require re-evaluation.

AQL Query:

objectType = "Risk" AND Status = "Accepted" AND "Review Date" < now()

Actions:

1. Change Status from "Accepted" to "Open"
2. Send notification to Risk Owner
3. Add to CISO weekly risk report

CA-01: Compliance Assessment Reminder

Notify compliance owners when scheduled assessments are approaching.

Requirements due within 30 days:

objectType = "Compliance Requirement" AND "Compliance Status" != "Not Assessed" AND "Next Assessment" < now(30d) AND "Next Assessment" > now()

Email Template:

CA-02: Compliance Gap Detection

Identify compliance requirements without adequate control coverage and alert the compliance team.

Requirements without mapped controls:

objectType = "Compliance Requirement" AND "Compliance Status" IN ("Partial", "Non-Compliant") AND "Mapped Controls" is EMPTY

Requirements with controls but still non-compliant:

objectType = "Compliance Requirement" AND "Compliance Status" = "Non-Compliant" AND "Mapped Controls" is NOT EMPTY

AL-01: Stale Asset Detection

Identify security assets not seen by discovery tools within expected timeframes, indicating potential decommissioning, agent failure, or shadow IT.

Active assets not seen in 30 days:

objectType = "Security Asset" AND Status = "Active" AND "Last Seen" < now(-30d)

Active assets without discovery source:

objectType = "Security Asset" AND Status = "Active" AND "Discovery Source" is EMPTY

AL-02: Asset Decommission Workflow

When an asset status changes to "Decommissioned", trigger cleanup workflows to close open vulnerabilities and update compliance scope.

Trigger:

Object updated - Security Asset - Status changed to "Decommissioned"

Query open vulnerabilities:

objectType = "Vulnerability" AND "Affected Asset" = "{{object.Key}}" AND "Remediation Status" IN ("Open", "In Progress")

Actions:

1. Update all open vulnerabilities to "Remediated" with note "Asset decommissioned"
2. Notify Compliance team of scope change
3. Update risks referencing this asset