Vulnerability-to-Remediation Workflow

The problem

Scanner findings pile up in a console that engineering never opens, and severity scores alone do not say who should fix what. Turning findings into tickets by hand is slow and inconsistent, so remediation deadlines slip without anyone noticing. When the same finding reappears in the next scan, a duplicate ticket often follows.

How it runs on Neblex

A Neblex flow polls Qualys Container Security for findings and detects changes with cursors and content hashing, so resolved and reopened findings are tracked as well as new ones. A lookup on finding and asset keeps one open ticket per finding per asset, and an ownership table in Data Tables maps images and clusters to the teams that run them.

Conditional branching applies your prioritization policy, combining scanner severity with asset context such as environment and exposure. Each actionable finding becomes a ServiceNow ticket assigned to the owning team, with a Slack notification to the team channel, and chunked batch processing with checkpoints handles large scan result sets without losing progress.

A scheduled flow checks each ticket against your remediation deadlines and escalates through Slack when a deadline approaches. The hash-chained audit trail records every finding, routing decision, and escalation, which gives compliance a single verifiable record.

Step by step

1. 1
   Poll for new findingsThe flow polls Qualys Container Security on a schedule and detects new, changed, and resolved findings via cursors and content hashing.
2. 2
   Deduplicate per assetA lookup on finding and asset ensures one open ticket per pair, so rescans update tickets instead of duplicating them.
3. 3
   Match to ownersA Data Tables ownership map assigns each finding to the team responsible for the affected image or cluster.
4. 4
   Create tracked ticketsServiceNow tickets are created with severity and asset context, and Slack notifies the owning team.
5. 5
   Enforce remediation SLAsA scheduled check escalates findings that approach their deadline, and closures write back when the next scan confirms the fix.

Platform capabilities used

• Poll-based change detection
• Dedup with lookups and upserts
• Data Tables ownership mapping
• Chunked batch processing with checkpoints
• Scheduled deadline checks with escalation
• Hash-chained audit trail

Common questions