Automate vulnerability management with a daily summary across your security tools
Stepwork reads each security tool every morning, writes one summary of what changed since yesterday, and opens tickets for vulnerabilities that are exploited or overdue.
- Use case
- Daily security summary and vulnerability escalationInfoSec & Compliance
- Best for
- Security Operations Lead, Vulnerability Manager, CISO
- Applications used
CrowdStrike
Tenable
Wiz
Microsoft Entra ID
Jira
Slack
- Business outcome
- One morning summary instead of a dozen console logins
The problem
Every tool has its own console, and none of them shows what changed
- Log in to every security console each morning
- Work out what's new since yesterday, tool by tool
- Check which critical CVEs are being exploited
- Track remediation deadlines in a spreadsheet
- Find the devices missing an agent or a scan
- Write the summary leadership asks for every week
Triage
Whatever a tool reports, it lands in the right procedure
Alerts and findings show up in different consoles and in different shapes. Stepwork reads each one where it lives and hands it to the procedure that deals with it.
How it arrives
- Microsoft Entra IDRisky sign-inUser: j.alvarez
Risk: High · Unfamiliar sign-in properties
Location: São Paulo, BRGoes to Daily threat summary
Threat intel feedExploited list updateKnown exploited vulnerabilities · 3 added today
Vendor: Ivanti · Product: Connect SecureGoes to Vulnerability escalation
JamfDevice inventoryMacBook Pro · ENG-MBP-118
Last check-in: today
Security agent: not installedGoes to Coverage and usage check
Systems
Reads the consoles your team checks every morning
Each tool reports in its own console. Stepwork signs in to each one with a login your team grants, reads what changed, and hands it to the chat and ticketing tools your team already works in.
- Endpoint and devices: CrowdStrike, SentinelOne, Sophos Central, Jamf, Microsoft Intune, Kandji
- Vulnerabilities and code: Tenable, Qualys, Snyk, GitHub
- Cloud: Wiz, AWS, Google Cloud Platform, Microsoft Azure
- Identity and email: Microsoft Entra ID, Okta, Duo Security, Proofpoint, Mimecast
- Logs and threat intel: Splunk, Datadog, Threat intel feed
- Where it lands: Slack, Microsoft Teams, Jira, ServiceNow, Jira Service Management
Example procedures
Three security procedures, card by card
One writes the morning summary across every tool, one escalates what's exploited or overdue, and one checks that every device is covered. Swap in your scanner, endpoint tool, or ticketing system above each one and the steps stay the same.
Morning summary of what changed across every security tool
Every weekday morning Stepwork signs in to each security tool on your list, reads what changed since yesterday, and writes one summary for the security channel in Slack. Anything new and critical opens an incident in Jira first.
Excel- Microsoft Entra ID
- Slack
- Jira
Swap in your systemsThe steps stay the same. Only the screens change.
Morning summary of what changed across every security tool
Extraction
Read the tools on the morning list
Scheduled · weekdays at 7:00
Extracted variables
- tool_name
- last_run
Extraction
Read what changed since the last run
Input variables
- tool_name
- last_run
Extracted variables
- changes
Summary
Write one summary: new, resolved, and trending
Input variables
- changes
Output
- digest
- new_criticals
Rule logic
Anything new and critical?
Input variables
- new_criticals
Paths
- If a critical detection or finding appeared since the last runThen: Open an incident in Jira
- OtherwiseThen: Post the summary in the Slack security channel
Execution
If a new criticalOpen an incident in Jira
Input variables
- new_criticals
Output
- incident_id
Execution
Post the summary in the Slack security channel
Input variables
- digest
- incident_id
Drag to explore · pinch to zoom
Step by step
- The tool list comes inStepwork reads the list your team keeps in Excel: each console to check and when it was last read. Each row is one pass through the loop.
- Each console gets readInside the solid frame, Stepwork signs in to the tool, like CrowdStrike, Tenable, Wiz, or Microsoft Entra ID, applies the same filters every day, and reads what's new or changed since the last run.Repeats: For each tool on the list · 8 tools
- One summary gets writtenAfter the last tool, the Summary card writes up only what those runs read: new detections and findings, what was resolved, and what is trending up. It also lists anything new and critical.
- The rule checks for criticalsIf anything new is critical, the run takes the top path. If not, the summary goes straight to the channel.
- If a new criticalOpen an incident in Jira
- If nothing criticalPost the summary in the Slack security channel
- Criticals open an incidentOnly on the top path: Stepwork opens an incident in Jira with each new critical item and the console it came from.Only on this path: If a new critical
- The team reads one messageBoth paths end here. The summary lands in the security channel in Slack, with the incident linked when there is one.
Field map
| From | To |
|---|---|
| CrowdStrikeDetections: severity, host, status | SlackSummary: new detections |
| TenableVulnerabilities: CVE, asset, first seen | SlackSummary: new critical findings |
| Microsoft Entra IDRisky sign-ins: user, risk level | SlackSummary: identity |
| WizIssues: severity, resource, project | JiraIncident: what changedNew criticals only |
Escalate exploited and overdue vulnerabilities from Tenable
Every morning Stepwork reads the open critical and high findings in Tenable, checks each CVE against the known exploited list, and escalates the ones that are exploited or past their deadline.
- Threat intel feed
- Jira
- Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The findings come inStepwork signs in to Tenable and reads every open critical and high finding, with its CVE, the asset, how long it has been open, and the asset's owner.
- Each CVE gets checkedInside the dashed frame, Stepwork looks the CVE up in the CISA Known Exploited Vulnerabilities catalog, or in your threat intel portal, and notes whether it is being exploited.Repeats: For each critical or high finding · 23 findings
- The rule picks what can't waitIf the CVE is being exploited, or the finding is past its deadline, the run goes on to escalate it. Anything else stays in the weekly report.
- If exploited or overdueOpen a ticket for the owner in Jira
- OtherwiseInside its deadline, it stays in the weekly report
Repeats: For each critical or high finding · 23 findings - A ticket gets openedStepwork opens a ticket in Jira for the asset's owner, with the CVE, the asset, and why it was escalated.Only on this path: If exploited or overdueRepeats: For each critical or high finding · 23 findings
- The owner hears directlyThe owner gets a message in Slack linking the ticket, so it doesn't wait in a queue.Only on this path: If exploited or overdueRepeats: For each critical or high finding · 23 findings
- The day gets summed upAfter the last finding, the Summary card lists what was escalated and why, for the vulnerability manager.Only on this path: If exploited or overdue
Field map
| From | To |
|---|---|
| TenableFinding: CVE, asset, days open | JiraTicket: summary, asset, due date |
| Threat intel feedKnown exploited: CVE, date added | JiraTicket: priorityExploited CVEs go to the top |
| TenableAsset: owner | SlackMessage: to |
Weekly coverage check: every device in Jamf has CrowdStrike and a Tenable scan
Every Monday Stepwork lines up the devices in Jamf against sensor health in CrowdStrike and scan results in Tenable. Each device missing either one gets a ticket, and the summary reports coverage and how many seats are in use.
- Jamf
- Jira
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The device list comes inStepwork reads every managed device in Jamf, with its owner. Each device is one pass through the loop.
- Sensor health gets readIt reads every sensor in CrowdStrike with its last check-in and status, plus how many seats are in use against how many you pay for.
- Scan coverage gets readIt reads the assets Tenable hasn't scanned in the last 30 days.
- The rule checks each deviceInside the dashed frame, a device with no healthy sensor or no recent scan goes on to a ticket. Covered devices need nothing.
- If something's missingOpen a ticket for IT in Jira
- OtherwiseCovered devices need nothing
Repeats: For each managed device · 412 devices - IT gets a ticketStepwork opens a ticket in Jira naming the device, its owner, and what's missing.Only on this path: If something's missingRepeats: For each managed device · 412 devices
- Coverage gets reportedAfter the last device, the Summary card reports agent and scan coverage as a share of the fleet, the gaps ticketed, and seats used in CrowdStrike.Only on this path: If something's missing
Field map
| From | To |
|---|---|
| JamfDevices: name, owner | JiraTicket: device, assignee |
| CrowdStrikeSensors: last seen, status | JiraTicket: what's missingOnly for devices with a gap |
Flows
The security flows these procedures are built from
Each flow is one recorded read or change in one console. Procedures run them on a schedule, and any of them can also run on its own from a request.
- CrowdStrike
Extract detections summary
Signs into the Falcon console and extracts recent detections with severity, host, and status. - SentinelOne
Extract unresolved threats
Extracts unresolved threats with severity, endpoint, and classification from the management console. - Wiz
Extract critical issues
Extracts open critical and high issues with affected resources and projects from the Wiz console. 
AWSExtract GuardDuty findings
Extracts open GuardDuty findings with severity, resource, and finding type.- Microsoft Entra ID
Extract risky sign-ins
Extracts flagged risky sign-ins with users, risk levels, and locations. - Splunk
Extract notable events summary
Extracts notable events by severity and status from the security dashboard. - Tenable
Extract critical vulnerabilities by asset
Extracts critical and high vulnerabilities with affected assets and plugin details from the console. - Tenable
Extract remediation SLA breaches
Extracts vulnerabilities open past their severity-based SLA with responsible owners. - Tenable
Extract unscanned assets
Extracts known assets not covered by recent scans. - Snyk
Extract critical vulnerabilities by project
Extracts critical and high vulnerabilities with affected projects and fix availability. - CrowdStrike
Extract sensor health report
Extracts hosts with missing, outdated, or silent sensors from host management. - Jamf
Extract devices missing security agent
Cross-references installed applications to extract Macs missing the required security agent. - Threat intel feed
Check CVEs against the known exploited list
Reads the CISA Known Exploited Vulnerabilities catalog, or your threat intel portal, and returns whether each CVE is being exploited and when it was added. - Threat intel feed
Read the daily threat brief
Signs in to your threat intel portal and extracts the day's brief: new campaigns, affected vendors, and indicators to watch.
More procedures
More security operations procedures
Ready-made procedures in the Marketplace for triage, vulnerabilities, and posture reporting.
- 2 moreCrowdStrike · SentinelOne · AWS + 2 more
Daily security triage digest
Each morning extracts new CrowdStrike detections, unresolved SentinelOne threats, GuardDuty findings, and critical Wiz issues, deduplicates and ranks them by severity, and posts one prioritized triage digest to the security channel. 1 more
Tenable · Snyk · Jira + 1 moreVulnerability SLA escalation pipeline
Extracts SLA-breaching vulnerabilities from Tenable and critical Snyk findings daily, opens or updates Jira remediation tickets with owners and due dates, and escalates breaches to engineering leads.
Snyk · GitHub · Wiz + 1 moreWeekly vulnerability report to engineering
Weekly, extracts new Snyk issues, critical Dependabot alerts, and Wiz issues by project, groups everything by owning team, and posts per-team digests with severity counts and links.
1 moreSecurityScorecard · AWS · Vanta + 1 moreWeekly security posture exec report
Weekly, extracts the company scorecard, AWS Security Hub compliance score, and Vanta failing controls, tracks the trend versus prior weeks, and sends the posture summary to security leadership.- Cloudflare · Datadog · Slack
Edge and application threat review
Weekly, extracts the Cloudflare WAF event summary and Datadog security signals, correlates spikes against known campaigns, and posts the threat review with any rules or monitors needing tuning. - Proofpoint · Mimecast · Slack
Email security morning check
Each morning extracts the Proofpoint quarantine summary, Mimecast held-message counts, and impersonation attempts, flags anomalous spikes against baseline, and posts the email threat picture to the security channel.
Why Stepwork
The same checks every morning, with the evidence behind them
Stepwork is a deterministic agent platform: every morning it opens the same consoles, applies the same filters, and reads the same columns. The Summary card only writes up what those runs read, so every line traces back to the console and the time it came from. Rules decide what gets a ticket, so an exploited CVE never depends on who happens to read the channel. Credentials stay in your vault.
Deterministic agentsCredentials
Book a DemoFAQ
Common questions
The math
What the manual version costs a security team
Example volumes for a team running eight security tools. Swap in yours.
Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
| The manual task | Times a week | Minutes each | Hours a week |
|---|---|---|---|
| Check a console for what changed overnight | 40 | 6 | 4 |
| Check a critical CVE against exploited lists | 15 | 5 | 1.3 |
| Open and assign a ticket for an overdue finding | 12 | 8 | 1.6 |
| Reconcile agent and scan coverage with inventory | 1 | 90 | 1.5 |
| Write the weekly summary for leadership | 1 | 60 | 1 |
- Hours a week
- 9.3
- Hours a year
- 468
- Of one full-time person
- 23%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.