# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### Evaluation
#### 4.8.1 Subgoal 1--Make the Process Faster
Further investigating the remediation phase by assignment group using process flow 3 shows that certain assignment groups have significantly higher throughput times than others. Comparing the process model for those assignment groups with those of faster ones also shows that, on average, it took the slower groups longer to write their first work note, and the rework of the activity \"Add worknotes\" is lower, meaning that they, on average, created fewer work notes. This can be interpreted as a sign that these assignment groups are not very active in the vulnerability management process. This information can be used to ask the assignment group what they need for faster remediation. If needed, trainings can be offered or the assignment groups can be redefined. For further analysis of the remediation phase, more data are needed. Since the remediation mostly happens outside of ServiceNow, e.g., by organizing a patch through e-mail communication, by waiting for a patch or by implementing a patch, details of the actual remediation cannot be retrieved from the available data. There are ways of recording these data and using them for process mining; however, these techniques would record everything that a user carries out, which is too intrusive for the value that it would bring and against the company's culture. The next step was taking a closer look at the assignment phase. For this, we used process flow 1 to include the activities \"Assign to Group\" and \"Assign to User\". Looking at the process model only including the activities with the most occurrences as seen in Figure 11, we can see that this phase includes a loop that costs nine days. This loop is part  
Figure 14: Discovered process model of process flow 2 for critical Qualys vulnerabilities. \begin{table}
\begin{tabular}{l l l} \hline \hline
**source\_display\_** & **Case Count** & **AVG Throughput** \\
**Value** & & **Time in Days** \\ \hline Qualys & 3941 & 159.23 \\ Offensity & 752 & 121.76 \\ DefectDojo & 341 & 117.41 \\ Intgris & 1175 & 114.84 \\ Prisma & 1840 & 99.35 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Average days in remediation phase of critical cases per source. of the target process of first being assigned to a dispatcher group before being assigned to the remediation group. However, knowing that this costs nine additional days might make it worth considering improving the assignment process. This could be achieved by either better training the dispatcher group, adding stricter SLAs to this task, or by finding a way to directly assign the vulnerabilities to the correct remediation group through automation. The extracted data might be useful for creating automation rules since they can be analyzed to determine which factors lead to an assignment to a certain group. Taking a look at the second most common occurrences of the process shows that about 30% of all vulnerabilities pass through the activity \"Assign to Group\" after being assigned. This means that these vulnerabilities do not get assigned to the correct assignment group on the first try, which costs around 22 days. This mostly affects Qualys and Prisma vulnerabilities of moderate priority. Looking at process flow 3, it seems that the assignment groups of certain areas are more often affected. Checking the affected assets, we can see that most affected cases do not have an asset attached but just an IP address or URL. Thus, no automatic mapping to an asset is possible in SNOW. Without an asset, however, it is difficult to figure out which assignment group is responsible for remediation. To ensure a better assignment and thus a quicker remediation, better data on the company assets are needed. Since some assignment groups are affected significantly more often, it can be argued that some areas provide fewer data on their assets than others. Approaching them with the information on which exact information is missing and showing them the consequences of it might lead to more effort in documenting assets on their side.