Vulnerability management playbook vulnerability

Vulnerability Management Playbook
Vulnerability management services help enterprises reduce
their attack surface by finding vulnerabilities before the ad -
versaries do. Security orchestration playbooks can automate
enrichment and context addition for vulnerabilities before
handing off control to the analysts for manual remediation.
By maintaining a balance between automated and manual
processes, analyst time is not spent in executing repetitive
tasks but in making critical decisions and drawing inferences.
Let’s look at a walkthrough of a possible vulnerability man-
agement playbook, including ingestion, enrichment, and
remediation.
Ingestion
The playbook ingests asset and vulnerability information
from a vulnerability management tool, such as Qualys.
Ingest
Ingest vulnerability and asset
information from vulnerability
management tool
Close playbook
Enrich Entities
• Enrich endpoint and CVE data
through relevant tools
• Add custom fields to vulnerability
data
Vulnerability Context
• Check if there are diagnoses,
consequences, and remediations
tied to the vulnerability
• Add vulnerability context to
incident data
Calculate Severity
Use gathered context to calculate
incident severity
Remediate
Hand over control to analyst for
manual remediation or automate
patch application
Vulnerability
management
Vulnerability
management
EDR
Playbook
Figure 5: Example of a vulnerability management playbook

8
Cortex by Palo Alto Networks | Cortex XSOAR for Managed Security Service Providers | White Paper
2. Looking at the email “ingredients”—subject, email
address, attachments, etc.—the playbook assigns inci-
dent severity by cross-referencing these details against
external threat databases.
3. Next, the playbook extracts IOCs from the email and
checks for any reputational red flags in the SOC’s existing
threat intelligence tools.
4. Once this enrichment is done, the playbook checks
whether any malicious indicators were found.
Response
Depending on whether malicious indicators were detected
in the suspected phishing email (see figure 6), one of two
branches will execute.
If malicious indicators were detected:
1. The playbook emails the affected user further instructions.
2. It then scans all organizational mailboxes/endpoints to
identify and delete other instances of the suspected email
to avoid further damage.
3. Finally, the playbook adds the malicious IOCs to black-
lists/watchlists on the SOC’s other tools.
If malicious indicators were not detected, some precautions
are still taken before confirming that the email is harmless:
1. The playbook checks for any attachments in the email
and, if found, detonates them in a sandbox for further
analysis.
2. If that analysis doesn’t throw up any alarms, the play-
book can give way to analysts for qualitative and manual
investigation. Once the analysts are satisfied the email is
benign, the playbook sends an email to the affected user
apprising them of the false alarm.