Automate Vulnerability Exception Management in InsightVM.icon

{
  "kom": {
    "komandVersion": "1.111.4-0-gb43d1",
    "komFileVersion": "2.0.0",
    "exportedAt": "2022-09-03T10:13:19.383701568Z",
    "workflowVersions": [
      {
        "name": "Automate Vulnerability Exception Management in InsightVM",
        "type": "runnable",
        "version": "",
        "description": "# Description\n\nThis workflow helps automate vulnerability exception management in InsightVM by approving exception requests for low-risk, low-scope vulnerabilities. This workflow can help remediators remove vulnerabilities that cannot be remediated from their task list, helping alleviate false positives while saving InsightVM administrator time.\n\nBoth the risk threshold and the scope acceptable for automatic approval may be customized. By default, this workflow will automatically approve exception requests for vulnerabilities with a CVSS risk score of 0 scoped to a single asset.\n\n# Key Features\n\n* Automatically approve low-risk vulnerability exception requests\n* Reduce overhead associated with manual vulnerability exception reviews\n* Maintain visibility into approved exception requests with Job History in InsightConnect\n\n# Requirements\n\n* InsightConnect\n* InsightVM\n\n# Documentation\n\n## Setup\n\n*This workflow requires deployment of the [Insight Orchestrator](https://docs.rapid7.com/insightconnect/install-and-activate-the-orchestrator) and a [connection to the InsightVM Console](https://extensions.rapid7.com/extension/rapid7_insightvm#Documentation-Setup).*\n\nImport the workflow and proceed through the Import Workflow wizard in InsightConnect. Import plugins and create connections during the import process as necessary.\n\n## Usage\n\n*Note: This workflow can be activated immediately with the default exception approval settings. This will automatically approve InsightVM vulnerability exceptions where the CVSSv2 risk score is 0 and the exception scope is a single asset.*\n\n**To run the workflow**, simply submit (do not approve!) a new Vulnerability Exception in InsightVM. A new InsightConnect Job should start within a few minutes. If the vulnerability exception is within the scope of the approval settings, then it will be automatically approved. The workflow will include a comment linking the exception in InsightVM to the InsightConnect Job for audit purposes.\n\n**To adjust the exception approval settings**, edit the workflow draft and open the `SETTINGS` step. Inside, you may adjust either or both of the following options: \n\n1. Acceptable CVSS `risk_threshold` for auto-approving vulnerability exceptions (`0 - 10`)\n    * If the threshold is set to `1`, then all vulnerabilities with CVSS risk score equal to or less then 1 will be automatically approved\n2. Acceptable `scope` for auto-approving vulnerability exceptions (`global`, `site`, `asset group`, or  `asset`)\n    * If `global` is selected, then all exception scopes will be allowed\n    * If `site` is selected, then exceptions for `asset` and `instance` will also be allowed\n    * If `asset group` is selected, then exceptions for `asset` and `instance` will also be allowed\n\nWhen combined, these settings provide users with control over when exception requests are automatically approved. For example, if the `risk_threshold` is set to `1` and the `scope` is set to `asset group`, then an exception request for a single asset with CVSS risk of 1 would be automatically approved. Conversely, the following exception requests would not be automatically approved:\n    *  `global` scope and CVSS risk of 0\n    *  `asset group` scope and CVSS risk of 5 \n\n## Technical Details\n\nPlugins utilized by workflow:\n\n|Plugin|Version|Count|\n|----|----|--------|\n|Type Converter|1.6.0|1|\n|Rapid7 InsightVM|4.2.0|3|\n\n\n## Troubleshooting\n\n_There is no troubleshooting information at this time_\n\n# Version History\n\n* 1.0.1 - Revised workflow title\n* 1.0.0 - Initial workflow\n\n# Links\n\n## References\n\n\n",
        "graph": {
          "edges": {
            "0727b6d9-079f-4a3e-9eb3-ac29224e1a92": {
              "id": "0727b6d9-079f-4a3e-9eb3-ac29224e1a92",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "1da51899-1cbe-4dea-8135-1dd3a901db33",
              "toNodeId": ""
            },
            "0dd3a4f0-63bf-4d3f-9ff1-78ff445ba13c": {
              "id": "0dd3a4f0-63bf-4d3f-9ff1-78ff445ba13c",
              "name": "No",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "0b4b58d2-795e-48d1-95c4-9631e571b078",
              "toNodeId": "5240176d-a7f2-46f3-8f24-5032d3e2332e"
            },
            "3fa6d096-3983-45e5-b4ab-f8f52df2bbee": {
              "id": "3fa6d096-3983-45e5-b4ab-f8f52df2bbee",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a",
              "toNodeId": "a42b563f-1a53-4dd4-8c53-425c10cabf68"
            },
            "4891f58d-0abd-4639-aded-b1f4bf255764": {
              "id": "4891f58d-0abd-4639-aded-b1f4bf255764",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b",
              "toNodeId": "526bc01a-da26-4af7-85dd-36dc9cbe8208"
            },
            "6b110ded-5d4d-4f44-a494-8a7f615247cb": {
              "id": "6b110ded-5d4d-4f44-a494-8a7f615247cb",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "5655d560-a12a-451b-86e1-808d071c0169",
              "toNodeId": ""
            },
            "84f65765-cc71-49ef-aef4-4bc28570f65e": {
              "id": "84f65765-cc71-49ef-aef4-4bc28570f65e",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "5240176d-a7f2-46f3-8f24-5032d3e2332e",
              "toNodeId": ""
            },
            "9f05e284-27eb-4200-8f38-cf5e49a141d0": {
              "id": "9f05e284-27eb-4200-8f38-cf5e49a141d0",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077",
              "toNodeId": "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b"
            },
            "a4a29a9e-562f-433b-8185-c1bce76062ca": {
              "id": "a4a29a9e-562f-433b-8185-c1bce76062ca",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "a42b563f-1a53-4dd4-8c53-425c10cabf68",
              "toNodeId": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077"
            },
            "a6286118-fcdb-4c25-bf0e-08d3cafab873": {
              "id": "a6286118-fcdb-4c25-bf0e-08d3cafab873",
              "name": "Yes",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "0b4b58d2-795e-48d1-95c4-9631e571b078",
              "toNodeId": "824cb37c-284c-436b-a944-b52cc743d08c"
            },
            "ba6e5dfa-43d8-4506-a0ab-3d929431f152": {
              "id": "ba6e5dfa-43d8-4506-a0ab-3d929431f152",
              "name": "Risk <= Threshold",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "526bc01a-da26-4af7-85dd-36dc9cbe8208",
              "toNodeId": "0b4b58d2-795e-48d1-95c4-9631e571b078"
            },
            "f72b3a93-628c-493a-ad9a-869e9b334530": {
              "id": "f72b3a93-628c-493a-ad9a-869e9b334530",
              "name": "",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "824cb37c-284c-436b-a944-b52cc743d08c",
              "toNodeId": "5655d560-a12a-451b-86e1-808d071c0169"
            },
            "fd7c8e20-4f65-4be8-a586-c284fa0fef53": {
              "id": "fd7c8e20-4f65-4be8-a586-c284fa0fef53",
              "name": "Risk > Threshold",
              "description": "",
              "parentNodeId": "",
              "fromNodeId": "526bc01a-da26-4af7-85dd-36dc9cbe8208",
              "toNodeId": "1da51899-1cbe-4dea-8135-1dd3a901db33"
            }
          },
          "nodes": {
            "0b4b58d2-795e-48d1-95c4-9631e571b078": {
              "id": "0b4b58d2-795e-48d1-95c4-9631e571b078",
              "parentNodeId": ""
            },
            "1da51899-1cbe-4dea-8135-1dd3a901db33": {
              "id": "1da51899-1cbe-4dea-8135-1dd3a901db33",
              "parentNodeId": ""
            },
            "4beb70e9-1241-4824-aa5d-34c3bdf1c01a": {
              "id": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a",
              "parentNodeId": ""
            },
            "5240176d-a7f2-46f3-8f24-5032d3e2332e": {
              "id": "5240176d-a7f2-46f3-8f24-5032d3e2332e",
              "parentNodeId": ""
            },
            "526bc01a-da26-4af7-85dd-36dc9cbe8208": {
              "id": "526bc01a-da26-4af7-85dd-36dc9cbe8208",
              "parentNodeId": ""
            },
            "5655d560-a12a-451b-86e1-808d071c0169": {
              "id": "5655d560-a12a-451b-86e1-808d071c0169",
              "parentNodeId": ""
            },
            "824cb37c-284c-436b-a944-b52cc743d08c": {
              "id": "824cb37c-284c-436b-a944-b52cc743d08c",
              "parentNodeId": ""
            },
            "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b": {
              "id": "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b",
              "parentNodeId": ""
            },
            "a42b563f-1a53-4dd4-8c53-425c10cabf68": {
              "id": "a42b563f-1a53-4dd4-8c53-425c10cabf68",
              "parentNodeId": ""
            },
            "bc23f6b8-1a70-4ab4-9118-fd94cebf3077": {
              "id": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077",
              "parentNodeId": ""
            }
          }
        },
        "steps": {
          "0b4b58d2-795e-48d1-95c4-9631e571b078": {
            "nodeId": "0b4b58d2-795e-48d1-95c4-9631e571b078",
            "name": "Exception in Scope?",
            "type": "automated_decision",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "defaultEdgeId": "0dd3a4f0-63bf-4d3f-9ff1-78ff445ba13c",
              "stepControlParams": [
                {
                  "edgeId": "0dd3a4f0-63bf-4d3f-9ff1-78ff445ba13c",
                  "expression": {},
                  "expressionText": ""
                },
                {
                  "edgeId": "a6286118-fcdb-4c25-bf0e-08d3cafab873",
                  "expression": {
                    "left": {
                      "left": {
                        "name": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077.output.scope",
                        "type": "variable"
                      },
                      "op": "==",
                      "right": {
                        "type": "literal",
                        "value": "global"
                      },
                      "type": "binary"
                    },
                    "op": "OR",
                    "right": {
                      "left": {
                        "left": {
                          "left": {
                            "name": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077.output.scope",
                            "type": "variable"
                          },
                          "op": "==",
                          "right": {
                            "type": "literal",
                            "value": "asset"
                          },
                          "type": "binary"
                        },
                        "op": "AND",
                        "right": {
                          "left": {
                            "left": {
                              "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                              "type": "variable"
                            },
                            "op": "==",
                            "right": {
                              "type": "literal",
                              "value": "asset"
                            },
                            "type": "binary"
                          },
                          "op": "OR",
                          "right": {
                            "left": {
                              "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                              "type": "variable"
                            },
                            "op": "==",
                            "right": {
                              "type": "literal",
                              "value": "instance"
                            },
                            "type": "binary"
                          },
                          "type": "binary"
                        },
                        "type": "binary"
                      },
                      "op": "OR",
                      "right": {
                        "left": {
                          "left": {
                            "left": {
                              "name": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077.output.scope",
                              "type": "variable"
                            },
                            "op": "==",
                            "right": {
                              "type": "literal",
                              "value": "site"
                            },
                            "type": "binary"
                          },
                          "op": "AND",
                          "right": {
                            "left": {
                              "left": {
                                "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                "type": "variable"
                              },
                              "op": "==",
                              "right": {
                                "type": "literal",
                                "value": "site"
                              },
                              "type": "binary"
                            },
                            "op": "OR",
                            "right": {
                              "left": {
                                "left": {
                                  "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                  "type": "variable"
                                },
                                "op": "==",
                                "right": {
                                  "type": "literal",
                                  "value": "asset"
                                },
                                "type": "binary"
                              },
                              "op": "OR",
                              "right": {
                                "left": {
                                  "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                  "type": "variable"
                                },
                                "op": "==",
                                "right": {
                                  "type": "literal",
                                  "value": "instance"
                                },
                                "type": "binary"
                              },
                              "type": "binary"
                            },
                            "type": "binary"
                          },
                          "type": "binary"
                        },
                        "op": "OR",
                        "right": {
                          "left": {
                            "left": {
                              "name": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077.output.scope",
                              "type": "variable"
                            },
                            "op": "==",
                            "right": {
                              "type": "literal",
                              "value": "asset group"
                            },
                            "type": "binary"
                          },
                          "op": "AND",
                          "right": {
                            "left": {
                              "left": {
                                "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                "type": "variable"
                              },
                              "op": "==",
                              "right": {
                                "type": "literal",
                                "value": "asset"
                              },
                              "type": "binary"
                            },
                            "op": "OR",
                            "right": {
                              "left": {
                                "left": {
                                  "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                  "type": "variable"
                                },
                                "op": "==",
                                "right": {
                                  "type": "literal",
                                  "value": "instance"
                                },
                                "type": "binary"
                              },
                              "op": "OR",
                              "right": {
                                "left": {
                                  "name": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a.exception.scope.type",
                                  "type": "variable"
                                },
                                "op": "==",
                                "right": {
                                  "type": "literal",
                                  "value": "asset group"
                                },
                                "type": "binary"
                              },
                              "type": "binary"
                            },
                            "type": "binary"
                          },
                          "type": "binary"
                        },
                        "type": "binary"
                      },
                      "type": "binary"
                    },
                    "type": "binary"
                  },
                  "expressionText": "{{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}} == \"global\"\nOR\n({{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}} == \"asset\" AND ({{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"asset\" OR {{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"instance\"))\nOR\n({{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}} == \"site\" AND ({{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"site\" OR {{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"asset\" OR {{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"instance\"))\nOR\n({{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}} == \"asset group\" AND ({{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"asset\" OR {{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"instance\" OR {{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}} == \"asset group\"))"
                }
              ]
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/automated-decision.svg",
            "connectionType": "NONE"
          },
          "1da51899-1cbe-4dea-8135-1dd3a901db33": {
            "nodeId": "1da51899-1cbe-4dea-8135-1dd3a901db33",
            "name": "Risk > Threshold",
            "type": "artifact",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "input": {
                "content": "Workflow stopped due to Vulnerability CVSS Risk Score being greater than acceptable risk threshold. The vulnerability exception request was not approved.\n\n* CVSS score: `{{[a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b].[vulnerability].[cvss].[v2].[score]}}`\n* Risk Threshold: `{{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[risk_threshold]}}`\n\n*To change your risk threshold, edit the `SETTINGS` step in the workflow builder.*"
              },
              "type": "markdown"
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/artifact.svg",
            "connectionType": "NONE"
          },
          "4beb70e9-1241-4824-aa5d-34c3bdf1c01a": {
            "nodeId": "4beb70e9-1241-4824-aa5d-34c3bdf1c01a",
            "name": "Vulnerability Exception Trigger",
            "type": "trigger",
            "plugin": {
              "name": "Rapid7 InsightVM",
              "slugVendor": "rapid7",
              "slugName": "rapid7_insightvm",
              "slugVersion": "4.2.0",
              "imageData": "https://eu.cdn-assets.connect.insight.rapid7.com/icons/rapid7/rapid7_insightvm/4.2.0/icon.png"
            },
            "identifier": "new_exception_request",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "input": {
                "frequency": 1,
                "status_filter": [
                  "Under Review"
                ]
              }
            },
            "triggerId": "1845edda-f374-4d22-8c3b-1826ba34b4ff",
            "defaultInputJSONSchema": {
              "properties": {
                "frequency": {
                  "default": 5,
                  "description": "How often the trigger should check for new vulnerability exception requests",
                  "order": 1,
                  "title": "Frequency",
                  "type": "integer"
                },
                "status_filter": {
                  "default": [
                    "Under Review"
                  ],
                  "description": "List of vulnerability statuses to match against. Options include: Under Review and Approved",
                  "items": {
                    "type": "string"
                  },
                  "order": 2,
                  "title": "Status Filter",
                  "type": "array"
                }
              },
              "required": [
                "frequency"
              ],
              "title": "Variables",
              "type": "object"
            },
            "defaultOutputJSONSchema": {
              "definitions": {
                "link": {
                  "properties": {
                    "href": {
                      "description": "A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)",
                      "order": 1,
                      "title": "URL",
                      "type": "string"
                    },
                    "rel": {
                      "description": "Link relation type following RFC 5988",
                      "order": 2,
                      "title": "Rel",
                      "type": "string"
                    }
                  },
                  "title": "Link",
                  "type": "object"
                },
                "vulnerability_exception": {
                  "properties": {
                    "expires": {
                      "description": "The date and time the vulnerability exception is set to expire",
                      "displayType": "date",
                      "format": "date-time",
                      "order": 1,
                      "title": "Expires",
                      "type": "string"
                    },
                    "id": {
                      "description": "The ID uniquely identifying the vulnerability exception",
                      "order": 3,
                      "title": "Vulnerability Exception ID",
                      "type": "integer"
                    },
                    "links": {
                      "description": "Hypermedia links to corresponding or related resources",
                      "items": {
                        "$ref": "#/definitions/link"
                      },
                      "order": 7,
                      "title": "Links",
                      "type": "array"
                    },
                    "review": {
                      "description": "Details of the exception review",
                      "order": 6,
                      "title": "Review Details",
                      "type": "object"
                    },
                    "scope": {
                      "description": "Details of the scope of the exception",
                      "order": 4,
                      "title": "Exception Scope",
                      "type": "object"
                    },
                    "state": {
                      "description": "The state of the vulnerability exception",
                      "enum": [
                        "deleted",
                        "expired",
                        "approved",
                        "rejected",
                        "under review"
                      ],
                      "order": 2,
                      "title": "State",
                      "type": "string"
                    },
                    "submit": {
                      "description": "Details of the exception submission",
                      "order": 5,
                      "title": "Submission Details",
                      "type": "object"
                    }
                  },
                  "required": [
                    "state",
                    "id",
                    "scope",
                    "submit"
                  ],
                  "title": "Vulnerability Exception",
                  "type": "object"
                }
              },
              "properties": {
                "exception": {
                  "$ref": "#/definitions/vulnerability_exception",
                  "description": "InsightVM vulnerability exception",
                  "order": 1,
                  "title": "Vulnerability Exception"
                }
              },
              "title": "Variables",
              "type": "object"
            },
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/default.svg",
            "connectionType": "CONNECTION"
          },
          "5240176d-a7f2-46f3-8f24-5032d3e2332e": {
            "nodeId": "5240176d-a7f2-46f3-8f24-5032d3e2332e",
            "name": "Exception out of Scope",
            "type": "artifact",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "input": {
                "content": "Workflow stopped due to the Exception Scope not matching automatic approval settings. The vulnerability exception was not approved.\n\n* Exception Request Scope: `{{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}}`\n* Automatic Approval Scope: `{{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}}`\n\n*To change your automatic approval scope, edit the `SETTINGS` step in the workflow builder.*"
              },
              "type": "markdown"
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/artifact.svg",
            "connectionType": "NONE"
          },
          "526bc01a-da26-4af7-85dd-36dc9cbe8208": {
            "nodeId": "526bc01a-da26-4af7-85dd-36dc9cbe8208",
            "name": "Risk < Threshold?",
            "type": "automated_decision",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "defaultEdgeId": "fd7c8e20-4f65-4be8-a586-c284fa0fef53",
              "stepControlParams": [
                {
                  "edgeId": "ba6e5dfa-43d8-4506-a0ab-3d929431f152",
                  "expression": {
                    "left": {
                      "name": "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b.vulnerability.cvss.v2.score",
                      "type": "variable"
                    },
                    "op": "<=",
                    "right": {
                      "name": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077.output.risk_threshold",
                      "type": "variable"
                    },
                    "type": "binary"
                  },
                  "expressionText": "{{[a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b].[vulnerability].[cvss].[v2].[score]}} <= {{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[risk_threshold]}}"
                },
                {
                  "edgeId": "fd7c8e20-4f65-4be8-a586-c284fa0fef53",
                  "expression": {},
                  "expressionText": ""
                }
              ]
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/automated-decision.svg",
            "connectionType": "NONE"
          },
          "5655d560-a12a-451b-86e1-808d071c0169": {
            "nodeId": "5655d560-a12a-451b-86e1-808d071c0169",
            "name": "Exception Request Approved",
            "type": "artifact",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "input": {
                "content": "This exception request was automatically approved based on the `risk_threshold` and `scope`.\n\n## Vulnerability Exception Request\n* Vulnerability Title: `{{[a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b].[vulnerability].[title]}}`\n* Vulnerability Description: `{{[a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b].[vulnerability].[description].[text]}}`\n* Vulnerability CVSS Score: `{{[a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b].[vulnerability].[cvss].[v2].[score]}}`\n* Exception Scope: `{{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[type]}}`\n\n*View your vulnerability exceptions in InsightVM under **Administration** > **Review** Exceptions and Overrides.*\n\n## Exception Request Auto-Approval Settings\n* Risk Threshold: `{{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[risk_threshold]}}`\n* Scope: `{{[bc23f6b8-1a70-4ab4-9118-fd94cebf3077].[output].[scope]}}`\n\n*To change your automatic approval scope, edit the `SETTINGS` step in the workflow builder.*"
              },
              "type": "markdown"
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/artifact.svg",
            "connectionType": "NONE"
          },
          "824cb37c-284c-436b-a944-b52cc743d08c": {
            "nodeId": "824cb37c-284c-436b-a944-b52cc743d08c",
            "name": "Approve Exception Request",
            "type": "action",
            "plugin": {
              "name": "Rapid7 InsightVM",
              "slugVendor": "rapid7",
              "slugName": "rapid7_insightvm",
              "slugVersion": "4.2.0",
              "imageData": "https://eu.cdn-assets.connect.insight.rapid7.com/icons/rapid7/rapid7_insightvm/4.2.0/icon.png"
            },
            "identifier": "review_exception",
            "continueOnFailure": false,
            "isDisabled": false,
            "isCloud": false,
            "parameters": {
              "input": {
                "comment": "Approved automatically by InsightConnect Job {{[$job].[URL]}}",
                "exception": "{{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[id]}}",
                "review": "Approved"
              }
            },
            "defaultInputJSONSchema": {
              "properties": {
                "comment": {
                  "description": "Comment to include in the review",
                  "order": 3,
                  "title": "Review Comment",
                  "type": "string"
                },
                "exception": {
                  "description": "The vulnerability exception ID to approve or reject",
                  "order": 1,
                  "title": "Exception ID",
                  "type": "integer"
                },
                "review": {
                  "description": "Approval or rejection of the exception",
                  "enum": [
                    "Approved",
                    "Rejected"
                  ],
                  "order": 2,
                  "title": "Review Outcome",
                  "type": "string"
                }
              },
              "required": [
                "review",
                "exception"
              ],
              "title": "Variables",
              "type": "object"
            },
            "defaultOutputJSONSchema": {
              "definitions": {
                "link": {
                  "properties": {
                    "href": {
                      "description": "A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)",
                      "order": 1,
                      "title": "URL",
                      "type": "string"
                    },
                    "rel": {
                      "description": "Link relation type following RFC 5988",
                      "order": 2,
                      "title": "Rel",
                      "type": "string"
                    }
                  },
                  "title": "Link",
                  "type": "object"
                }
              },
              "properties": {
                "links": {
                  "description": "Hypermedia links to corresponding or related resources",
                  "items": {
                    "$ref": "#/definitions/link"
                  },
                  "order": 1,
                  "title": "Links",
                  "type": "array"
                }
              },
              "required": [
                "links"
              ],
              "title": "Variables",
              "type": "object"
            },
            "outputJSONSchema": null,
            "defaultImageData": "",
            "connectionType": "CONNECTION"
          },
          "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b": {
            "nodeId": "a3f0bd68-f8d2-4b4c-9ec4-52e75c10596b",
            "name": "Get Vuln Details",
            "type": "action",
            "plugin": {
              "name": "Rapid7 InsightVM",
              "slugVendor": "rapid7",
              "slugName": "rapid7_insightvm",
              "slugVersion": "4.2.0",
              "imageData": "https://eu.cdn-assets.connect.insight.rapid7.com/icons/rapid7/rapid7_insightvm/4.2.0/icon.png"
            },
            "identifier": "get_vulnerability",
            "continueOnFailure": false,
            "isDisabled": false,
            "isCloud": false,
            "parameters": {
              "input": {
                "id": "{{[4beb70e9-1241-4824-aa5d-34c3bdf1c01a].[exception].[scope].[vulnerability]}}"
              }
            },
            "defaultInputJSONSchema": {
              "properties": {
                "id": {
                  "description": "The identifier of the vulnerability to retrieve from InsightVM",
                  "order": 1,
                  "title": "Vulnerability ID",
                  "type": "string"
                }
              },
              "required": [
                "id"
              ],
              "title": "Variables",
              "type": "object"
            },
            "defaultOutputJSONSchema": {
              "definitions": {
                "cvss": {
                  "properties": {
                    "links": {
                      "description": "List of hypermedia links to corresponding resources",
                      "items": {
                        "$ref": "#/definitions/link"
                      },
                      "order": 1,
                      "title": "Links",
                      "type": "array"
                    },
                    "v2": {
                      "$ref": "#/definitions/cvss_v2",
                      "description": "CVSSv2 details",
                      "order": 2,
                      "title": "V2"
                    },
                    "v3": {
                      "$ref": "#/definitions/cvss_v3",
                      "description": "CVSSv3 details",
                      "order": 3,
                      "title": "V3"
                    }
                  },
                  "title": "Cvss",
                  "type": "object"
                },
                "cvss_v2": {
                  "properties": {
                    "accessComplexity": {
                      "description": "CVSSv2 access complexity metric",
                      "order": 1,
                      "title": "Access Complexity",
                      "type": "string"
                    },
                    "accessVector": {
                      "description": "CVSSv2 access vector metric",
                      "order": 2,
                      "title": "Access Vector",
                      "type": "string"
                    },
                    "authentication": {
                      "description": "CVSSv2 authentication metric",
                      "order": 3,
                      "title": "Authentication",
                      "type": "string"
                    },
                    "availabilityImpact": {
                      "description": "CVSSv2 availability impact metric",
                      "order": 4,
                      "title": "Availability Impact",
                      "type": "string"
                    },
                    "confidentialityImpact": {
                      "description": "CVSSv2 confidentiality impact metric",
                      "order": 5,
                      "title": "Confidentiality Impact",
                      "type": "string"
                    },
                    "exploitScore": {
                      "description": "CVSSv2 combined exploit metric score (Access Complexity/Access Vector/Authentication)",
                      "order": 6,
                      "title": "Exploit Score",
                      "type": "number"
                    },
                    "impactScore": {
                      "description": "CVSSv2 combined impact metric score (Confidentiality/Integrity/Availability)",
                      "order": 7,
                      "title": "Impact Score",
                      "type": "number"
                    },
                    "integrityImpact": {
                      "description": "CVSSv2 integrity impact metric",
                      "order": 8,
                      "title": "Integrity Impact",
                      "type": "string"
                    },
                    "score": {
                      "description": "CVSSv2 score",
                      "order": 9,
                      "title": "Score",
                      "type": "number"
                    },
                    "vector": {
                      "description": "CVSSv2 combined vector string",
                      "order": 10,
                      "title": "Vector",
                      "type": "string"
                    }
                  },
                  "title": "Cvss V2",
                  "type": "object"
                },
                "cvss_v3": {
                  "properties": {
                    "attackComplexity": {
                      "description": "CVSSv3 attack complexity metric",
                      "order": 1,
                      "title": "Attack Complexity",
                      "type": "string"
                    },
                    "attackVector": {
                      "description": "CVSSv3 attack vector metric",
                      "order": 2,
                      "title": "Attack Vector",
                      "type": "string"
                    },
                    "availabilityImpact": {
                      "description": "CVSSv3 availability impact metric",
                      "order": 3,
                      "title": "Availability Impact",
                      "type": "string"
                    },
                    "confidentialityImpact": {
                      "description": "CVSSv3 confidentiality impact metric",
                      "order": 4,
                      "title": "Confidentiality Impact",
                      "type": "string"
                    },
                    "exploitScore": {
                      "description": "CVSSv3 combined exploit metric score (Attack Complexity/Attack Vector/Privilege Required/Scope/User Interaction)",
                      "order": 5,
                      "title": "Exploit Score",
                      "type": "number"
                    },
                    "impactScore": {
                      "description": "CVSSv3 combined impact metric score (Confidentiality/Integrity/Availability)",
                      "order": 6,
                      "title": "Impact Score",
                      "type": "number"
                    },
                    "integrityImpact": {
                      "description": "CVSSv3 integrity impact metric",
                      "order": 7,
                      "title": "Integrity Impact",
                      "type": "string"
                    },
                    "privilegeRequired": {
                      "description": "CVSSv3 privilege required metric",
                      "order": 8,
                      "title": "Privilege Required",
                      "type": "string"
                    },
                    "scope": {
                      "description": "CVSSv3 scope metric",
                      "order": 9,
                      "title": "Scope",
                      "type": "string"
                    },
                    "score": {
                      "description": "CVSSv3 score",
                      "order": 10,
                      "title": "Score",
                      "type": "number"
                    },
                    "userInteraction": {
                      "description": "CVSSv3 user interaction metric",
                      "order": 11,
                      "title": "User Interaction",
                      "type": "string"
                    },
                    "vector": {
                      "description": "CVSSv3 combined vector string",
                      "order": 12,
                      "title": "Vector",
                      "type": "string"
                    }
                  },
                  "title": "Cvss V3",
                  "type": "object"
                },
                "link": {
                  "properties": {
                    "href": {
                      "description": "A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)",
                      "order": 1,
                      "title": "URL",
                      "type": "string"
                    },
                    "rel": {
                      "description": "Link relation type following RFC 5988",
                      "order": 2,
                      "title": "Rel",
                      "type": "string"
                    }
                  },
                  "title": "Link",
                  "type": "object"
                },
                "pci": {
                  "properties": {
                    "adjustedCVSSScore": {
                      "description": "PCI adjusted CVSS score",
                      "order": 1,
                      "title": "Adjusted CVSS score",
                      "type": "integer"
                    },
                    "adjustedSeverityScore": {
                      "description": "PCI adjusted severity score",
                      "order": 2,
                      "title": "Adjusted severity score",
                      "type": "integer"
                    },
                    "fail": {
                      "description": "Whether this vulnerability results in a PCI assessment failure",
                      "order": 3,
                      "title": "Fail",
                      "type": "boolean"
                    },
                    "specialNotes": {
                      "description": "PCI special notes",
                      "order": 4,
                      "title": "Special Notes",
                      "type": "string"
                    },
                    "status": {
                      "description": "PCI status",
                      "order": 5,
                      "title": "Status",
                      "type": "string"
                    }
                  },
                  "title": "Pci",
                  "type": "object"
                },
                "vulnerability": {
                  "properties": {
                    "added": {
                      "description": "Date that the vulnerability was added to InsightVM",
                      "displayType": "date",
                      "format": "date-time",
                      "order": 1,
                      "title": "Added",
                      "type": "string"
                    },
                    "categories": {
                      "description": "List of vulnerabilities categories with which this vulnerability is affiliated",
                      "items": {
                        "type": "string"
                      },
                      "order": 16,
                      "title": "Categories",
                      "type": "array"
                    },
                    "cves": {
                      "description": "List of CVE identifiers associated with this vulnerability",
                      "items": {
                        "type": "string"
                      },
                      "order": 17,
                      "title": "CVEs",
                      "type": "array"
                    },
                    "cvss": {
                      "$ref": "#/definitions/cvss",
                      "description": "Vulnerability CVSS details",
                      "order": 15,
                      "title": "CVSS"
                    },
                    "denialOfService": {
                      "description": "Whether the vulnerability is a denial of service vulnerability",
                      "order": 7,
                      "title": "Denial of Service",
                      "type": "boolean"
                    },
                    "description": {
                      "$ref": "#/definitions/vulnerability_description",
                      "description": "Vulnerability description",
                      "order": 3,
                      "title": "Description"
                    },
                    "exploits": {
                      "description": "Exploit count",
                      "order": 2,
                      "title": "Exploits",
                      "type": "integer"
                    },
                    "id": {
                      "description": "Vulnerability ID",
                      "order": 9,
                      "title": "ID",
                      "type": "string"
                    },
                    "links": {
                      "description": "List of hypermedia links to corresponding resources",
                      "items": {
                        "$ref": "#/definitions/link"
                      },
                      "order": 4,
                      "title": "Links",
                      "type": "array"
                    },
                    "malwareKits": {
                      "description": "Malware kit count",
                      "order": 6,
                      "title": "Malware Kits",
                      "type": "integer"
                    },
                    "modified": {
                      "description": "Date the vulnerability was last modified in InsightVM",
                      "displayType": "date",
                      "format": "date-time",
                      "order": 8,
                      "title": "Modified",
                      "type": "string"
                    },
                    "pci": {
                      "$ref": "#/definitions/pci",
                      "description": "Vulnerability PCI details",
                      "order": 11,
                      "title": "PCI"
                    },
                    "published": {
                      "description": "Date the vulnerability was published",
                      "displayType": "date",
                      "format": "date-time",
                      "order": 12,
                      "title": "Published",
                      "type": "string"
                    },
                    "riskScore": {
                      "description": "Vulnerability risk score using the configured risk scoring strategy (RealRisk by default)",
                      "order": 14,
                      "title": "Risk Score",
                      "type": "number"
                    },
                    "severity": {
                      "description": "Vulnerability severity string (Moderate/Severe/Critical)",
                      "order": 13,
                      "title": "Severity",
                      "type": "string"
                    },
                    "severityScore": {
                      "description": "Vulnerability severity score",
                      "order": 10,
                      "title": "Severity Score",
                      "type": "integer"
                    },
                    "title": {
                      "description": "Vulnerability title",
                      "order": 5,
                      "title": "Title",
                      "type": "string"
                    }
                  },
                  "title": "Vulnerability",
                  "type": "object"
                },
                "vulnerability_description": {
                  "properties": {
                    "html": {
                      "description": "Vulnerability description HTML",
                      "order": 1,
                      "title": "HTML",
                      "type": "string"
                    },
                    "text": {
                      "description": "Vulnerability description raw text",
                      "order": 2,
                      "title": "Text",
                      "type": "string"
                    }
                  },
                  "title": "Vulnerability Description",
                  "type": "object"
                }
              },
              "properties": {
                "vulnerability": {
                  "$ref": "#/definitions/vulnerability",
                  "description": "The details of the vulnerability requested",
                  "order": 1,
                  "title": "Vulnerability Details"
                }
              },
              "required": [
                "vulnerability"
              ],
              "title": "Variables",
              "type": "object"
            },
            "outputJSONSchema": null,
            "defaultImageData": "",
            "connectionType": "CONNECTION"
          },
          "a42b563f-1a53-4dd4-8c53-425c10cabf68": {
            "nodeId": "a42b563f-1a53-4dd4-8c53-425c10cabf68",
            "name": "README",
            "type": "artifact",
            "continueOnFailure": false,
            "isDisabled": false,
            "parameters": {
              "input": {
                "content": "## Adjust workflow settings in the `Settings` step.\n\nThis workflow allows the user to specify:\n* Acceptable CVSS `risk_threshold` for auto-approving vulnerability exceptions (`0 - 10`)\n    * If the threshold is set to `1`, then all vulnerabilities with CVSS risk score equal to or less then 1 will be automatically approved\n* Acceptable `scope` for auto-approving vulnerability exceptions (`global`, `site`, `asset group`, or  `asset`)\n    * If `global` is selected, then all exception scopes will be allowed\n    * If `site` is selected, then exceptions for `asset` and `instance` will also be allowed\n    * If `asset group` is selected, then exceptions for `asset` and `instance` will also be allowed\n\nWhen combined, these settings provide users with control over when exception requests are automatically approved. For example, if the `risk_threshold` is set to `1` and the `scope` is set to `asset group`, then an exception request for a single asset with CVSS risk of 0 would be automatically approved. Conversely, the following exception requests would not be automatically approved:\n    *  `global` scope and CVSS risk of 0\n    *  `asset group` scope and CVSS risk of 5 "
              },
              "type": "markdown"
            },
            "defaultInputJSONSchema": null,
            "defaultOutputJSONSchema": null,
            "outputJSONSchema": null,
            "defaultImageData": "https://eu.cdn-assets.connect.insight.rapid7.com/step-type-icons/artifact.svg",
            "connectionType": "NONE"
          },
          "bc23f6b8-1a70-4ab4-9118-fd94cebf3077": {
            "nodeId": "bc23f6b8-1a70-4ab4-9118-fd94cebf3077",
            "name": "SETTINGS",
            "type": "action",
            "plugin": {
              "name": "Type Converter",
              "slugVendor": "rapid7",
              "slugName": "type_converter",
              "slugVersion": "1.6.0",
              "imageData": "https://eu.cdn-assets.connect.insight.rapid7.com/icons/rapid7/type_converter/1.6.0/icon.png"
            },
            "identifier": "string_to_object",
            "continueOnFailure": false,
            "isDisabled": false,
            "isCloud": false,
            "parameters": {
              "input": {
                "input": "{\"scope\": \"asset\", \"risk_threshold\": 0}"
              }
            },
            "defaultInputJSONSchema": {
              "properties": {
                "input": {
                  "description": "Input variable",
                  "order": 1,
                  "title": "Input",
                  "type": "string"
                }
              },
              "required": [
                "input"
              ],
              "title": "Variables",
              "type": "object"
            },
            "defaultOutputJSONSchema": {
              "properties": {
                "output": {
                  "description": "Type converted input",
                  "order": 1,
                  "title": "Output",
                  "type": "object"
                }
              },
              "required": [
                "output"
              ],
              "title": "Variables",
              "type": "object"
            },
            "outputJSONSchema": null,
            "defaultImageData": "",
            "connectionType": "ORCHESTRATOR"
          }
        },
        "tags": [
          "Rapid7",
          "Vulnerability Management"
        ],
        "humanCostSeconds": 300,
        "humanCostDisplayUnit": "minutes",
        "parameters": {
          "definitionSchema": null
        },
        "summary": ""
      }
    ],
    "triggers": [
      {
        "id": "1845edda-f374-4d22-8c3b-1826ba34b4ff",
        "identifier": "new_exception_request",
        "name": "Vulnerability Exception Trigger",
        "description": "",
        "input": {
          "frequency": 1,
          "status_filter": [
            "Under Review"
          ]
        },
        "inputJsonSchema": {
          "properties": {
            "frequency": {
              "default": 5,
              "description": "How often the trigger should check for new vulnerability exception requests",
              "order": 1,
              "title": "Frequency",
              "type": "integer"
            },
            "status_filter": {
              "default": [
                "Under Review"
              ],
              "description": "List of vulnerability statuses to match against. Options include: Under Review and Approved",
              "items": {
                "type": "string"
              },
              "order": 2,
              "title": "Status Filter",
              "type": "array"
            }
          },
          "required": [
            "frequency"
          ],
          "title": "Variables",
          "type": "object"
        },
        "outputJsonSchema": {
          "definitions": {
            "link": {
              "properties": {
                "href": {
                  "description": "A hypertext reference, which is either a URI (see RFC 3986) or URI template (see RFC 6570)",
                  "order": 1,
                  "title": "URL",
                  "type": "string"
                },
                "rel": {
                  "description": "Link relation type following RFC 5988",
                  "order": 2,
                  "title": "Rel",
                  "type": "string"
                }
              },
              "title": "Link",
              "type": "object"
            },
            "vulnerability_exception": {
              "properties": {
                "expires": {
                  "description": "The date and time the vulnerability exception is set to expire",
                  "displayType": "date",
                  "format": "date-time",
                  "order": 1,
                  "title": "Expires",
                  "type": "string"
                },
                "id": {
                  "description": "The ID uniquely identifying the vulnerability exception",
                  "order": 3,
                  "title": "Vulnerability Exception ID",
                  "type": "integer"
                },
                "links": {
                  "description": "Hypermedia links to corresponding or related resources",
                  "items": {
                    "$ref": "#/definitions/link"
                  },
                  "order": 7,
                  "title": "Links",
                  "type": "array"
                },
                "review": {
                  "description": "Details of the exception review",
                  "order": 6,
                  "title": "Review Details",
                  "type": "object"
                },
                "scope": {
                  "description": "Details of the scope of the exception",
                  "order": 4,
                  "title": "Exception Scope",
                  "type": "object"
                },
                "state": {
                  "description": "The state of the vulnerability exception",
                  "enum": [
                    "deleted",
                    "expired",
                    "approved",
                    "rejected",
                    "under review"
                  ],
                  "order": 2,
                  "title": "State",
                  "type": "string"
                },
                "submit": {
                  "description": "Details of the exception submission",
                  "order": 5,
                  "title": "Submission Details",
                  "type": "object"
                }
              },
              "required": [
                "state",
                "id",
                "scope",
                "submit"
              ],
              "title": "Vulnerability Exception",
              "type": "object"
            }
          },
          "properties": {
            "exception": {
              "$ref": "#/definitions/vulnerability_exception",
              "description": "InsightVM vulnerability exception",
              "order": 1,
              "title": "Vulnerability Exception"
            }
          },
          "title": "Variables",
          "type": "object"
        },
        "tags": [],
        "type": "trigger_plugin",
        "plugin": {
          "name": "Rapid7 InsightVM",
          "slugVendor": "rapid7",
          "slugName": "rapid7_insightvm",
          "slugVersion": "4.2.0",
          "imageData": "https://eu.cdn-assets.connect.insight.rapid7.com/icons/rapid7/rapid7_insightvm/4.2.0/icon.png"
        }
      }
    ]
  }
}