Vulnerability Management

Purpose

This document describes the automated vulnerability management system used to notify device owners of required security remediation actions. The system processes vulnerability scan exports, groups findings by remediation action, and sends consolidated email notifications to the appropriate owners.

Architecture Overview

The system is built on AWS Lambda and triggered automatically when a new Risk CSV export is uploaded to S3. Notifications are sent via Amazon SES to group mailboxes based on device type.

Arctic Wolf
     │
     ▼
Arctic Wolf Risk CSV Export
     │
     ▼
S3 Bucket (CSV upload triggers Lambda)
     │
     ▼
Lambda Function
     ├── Reads Risk CSV
     ├── Reads Asset Owner mapping CSV
     ├── Groups findings by remediation action
     ├── Maps devices to group mailboxes
     └── Sends consolidated emails via SES
          │
          ├── AZP group mailbox   (Azure VMs)
          ├── AWP group mailbox   (AWS VMs)
          ├── WRKBIZAP mailbox    (Workstations)
          ├── BC-HOST mailbox     (Hosted systems)
          └── Remote PC mailbox   (Remote user devices)

Components

S3 Bucket

Two CSV files are stored in S3:

File	Purpose
Risk CSV export	Vulnerability findings from Arctic Wolf
Asset owner mapping CSV	Maps device names to owners and group mailboxes

Uploading a new Risk CSV to the S3 bucket automatically triggers the Lambda function via an S3 event notification. No manual intervention is required after the CSV is uploaded.

Lambda Function

The Lambda function is the core processing engine. It:

1. Reads the Risk CSV from S3
2. Reads the asset owner mapping CSV from S3
3. Groups vulnerabilities by remediation action rather than individual CVEs
4. Maps each device to its appropriate group mailbox
5. Sends one consolidated email per group with all affected devices and required actions

Grouping by remediation action rather than individual CVEs significantly reduces notification volume and makes it easier for device owners to act. Instead of receiving one email per CVE, owners receive a single email listing everything that needs to be done.

Amazon SES

SES handles outbound email delivery. Each group mailbox receives a single consolidated email per scan cycle containing all devices and remediation actions relevant to that group.

Environment variables control email routing configuration, allowing mailbox addresses to be updated without code changes.

Device Groups

Devices are categorized into groups based on naming patterns. Each group routes to a dedicated mailbox.

Group	Device Pattern	Environment
AZP	AZP-*	Azure virtual machines
AWP	AWP-*	AWS virtual machines
WRKBIZAP	WRKBIZAP-*	Business workstations
BC-HOST	BC-HOST-*	Hosted/managed systems
Remote PCs	User remote devices	Remote workforce endpoints

Device-to-owner mapping is maintained in the asset owner mapping CSV stored in S3. Updating this file keeps routing current without any code changes.

Notification Design

Why Group by Remediation Action

Early iterations of vulnerability notification systems send one alert per CVE, which creates alert fatigue — a device with 40 vulnerabilities generates 40 emails, most of which require the same patch or update. This system groups findings so that a device owner receives one email listing all actions required, organized by what needs to be done rather than what CVE triggered it.

Email Content

Each notification includes:

• List of affected devices in the group
• Required remediation actions grouped logically
• Severity context to help prioritize

Triggering the Process

1. Run the Arctic Wolf vulnerability scan against the environment
2. Export the Risk CSV from the Arctic Wolf portal
3. Upload the Risk CSV to the designated S3 bucket
4. Lambda triggers automatically — no further action needed
5. Group mailboxes receive consolidated notifications within minutes

Maintenance

Updating Device Owners

Edit the asset owner mapping CSV and re-upload it to S3. The next scan cycle will use the updated mappings.

Adding a New Device Group

1. Add the new device pattern and mailbox to the asset owner mapping CSV
2. Add the new mailbox address as an environment variable in the Lambda configuration
3. Update the Lambda function code if a new routing pattern is needed
4. Test with a sample CSV before the next scheduled scan

Updating Group Mailbox Addresses

Update the relevant environment variable in the Lambda function configuration. No code changes required.

Compliance Relevance

Automated vulnerability management supports several HIPAA and SOC2 requirements:

Requirement	How This Addresses It
HIPAA §164.308(a)(1) — Risk Management	Systematic identification and notification of vulnerabilities
HIPAA §164.308(a)(5) — Security Awareness	Device owners are actively notified of risks on their systems
SOC2 CC7.1 — Vulnerability Detection	Automated scanning and notification process
SOC2 CC7.2 — Vulnerability Remediation	Owners receive actionable remediation guidance

Document History

Date	Change	Author
March 2026	Updated all references to explicitly name Arctic Wolf as the scanning tool	Rory
February 2026	Initial draft	Rory

Related Documentation

• AWS DR Overview
• Azure Infrastructure Overview