# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### Tool Support  
There are two commonly used process mining tools, ProM and Celonis [31]. While ProM is used in most scientific publications about process mining, Celonis is the market leader for process mining in a business context [39]. ProM is free of charge and platform-independent, offering different process mining techniques, including all of the algorithms explained above [40]. The many different techniques that it offers allow for a wide variety of process mining, but they also make it more difficult to set up and more complicated to use [39]. Celonis is designed to support process mining in business operation [41]. It is easy to set up and use, with little process mining knowledge needed. The data need to be provided and put into a specific form. Celonis then uses a pre-defined algorithm and provides the results for business users to analyze. The discovery algorithm provides a DFG. One disadvantage of this is that most discovered process models are spaghetti models with many more complicated patterns, such as concurrency, not being discovered. Conformance is provided by token replay. In addition to the ease of use, a big advantage of Celonis is that the discovered processes can be explored on many different levels, as far as going down to individual activity level or filtering for one specific attribute. We used two products of Celonis in the project: \"Data Integration\" and \"Studio\". The product Data Integration integrates data from a source system, in our case ServiceNow, and transforms them into data that can be used for process mining. The data integration tool offers the following structure for projects: each data integration workflow is clustered in a data pool. Each data pool can include several data connections, data jobs, and data models. Data connections are connections to one or several source systems, such as SAP, ServiceNow, or Microsoft Outlook E-Mail. After creating a connection, data can be retrieved and imported into Celonis. This happens in an extraction data job. After extraction, transformation data jobs create the event logs necessary for process mining; in \begin{table}
\begin{tabular}{l l l} \hline
**Work Package from** & **Nr** & **Steps Taken Throughout the** \\
**CRISP-DM** & & **Project** \\ \hline Business Understanding & 1 & Understanding the vulnerability \\  & & management process \\  & 2 & Formulating business goals \\ \hline Data Understanding & 3 & Data integration \\  & 4 & Data exploration \\  & 5 & Defining activities \\  & & and enhancement data \\ \hline Data Preparation & 6 & Filling the activity table \\  & 7 & Creating the data model \\ \hline Modeling & 8 & Creating process models \\ \hline Evaluation & 9 & Process discovery, \\  & & process enhancement, and \\  & & dashboard development \\ \hline Deployment & 10 & Publishing app \\  & 11 & Hand-over \\ \hline \end{tabular}
\end{table} 
Table 1: Work packages. Celonis, these are called activity tables. They are filled with user-defined activities. These data jobs are written in SQL. Lastly, there are data model load data jobs, which regularly load defined data models. Data models define how the activity table is connected to the case table and other helping tables. Case tables are where the data of the process instances are stored, e.g., a vulnerability or a business order. Other tables in the data model add more information that can be used in the analysis, such as user data. The second Celonis product, Studio, is used to create analysis applications. Each app can be connected to a data model to then analyze its data. There are a few special analysis tools, such as Process Explorer and Conformance Checker. The Process Explorer is the result of the discovery algorithm. It shows the \"most frequent activities and connections\" [42] in a process model as a directly follows graph. It can also show the path of every single process instance at once.