Skip to content

Vulnerability Remediation Pipeline

Nexplane closes the loop between scanner findings and automated remediation. Findings arrive via webhook or scheduled poll, get matched to assets, and automatically generate draft change requests based on your remediation policies.

Ingest

Webhook (push): Scanners post findings to POST /vulnerability/webhooks/vulnerability-findings. The endpoint is HMAC-verified using the WEBHOOK_SECRET environment variable.

Scheduled poll: Nexplane polls connected scanners (Tenable, Qualys, Snyk, Wiz) on a configurable schedule and imports new findings.

Asset Matching

Each finding is matched to a Nexplane asset by IP address or hostname. Matched assets link the finding to its connector, environment label (prod/staging), and associated change history.

Auto-Generated Draft CRs

RemediationPolicy rules map finding characteristics to change types:

  • Finding type → change type (e.g., outdated_package → patch_packages)
  • Environment → approval level (prod findings require human approval; staging can auto-approve)
  • Severity → whether to auto-generate and/or auto-approve

Draft CRs are created automatically for matched findings. Operators review and approve from the Vulnerability Remediation dashboard.

CVE Blast-Radius

Enter a CVE in the CVE Blast-Radius panel. Nexplane queries all findings matching that CVE, maps them to assets, and displays affected hosts with their environment, connector, and current CR status. Click Generate Patch Campaign to create a batch of patch_packages change requests in one click.

SLA Tiers

SLA thresholds are configurable per severity:

Severity Default SLA
Critical 4 hours
High 24 hours
Medium 72 hours

Configure via GET/PUT /vulnerability/sla/config.

Auto-Escalation

A background job runs continuously and marks findings that have breached their SLA threshold. Escalated findings are flagged in the UI and can trigger notifications.

SLA Dashboard

The SLA tab in the Vulnerability Remediation section shows:

  • Summary cards: total / breached / due-soon per severity
  • Overdue findings list sorted by most-overdue
  • Inline SLA configuration panel

Policy Editor

The policy editor (Settings → Remediation Policies) configures per-severity:

  • Auto-generate — automatically create a draft CR for new findings
  • Auto-approve — automatically approve the generated CR (use with caution in prod)
  • SLA days — override the default SLA threshold