Prioritize and Remediate Risks from ETM

The Enterprise TruRisk Management (ETM) integration with TruRisk​™ Eliminate (TE) connects risk prioritization directly to risk elimination. Security Analysts prioritize vulnerabilities in the ETM Risk Workbench and hand off the plan to IT Operations. Patch Managers then act on the elimination plan in TruRisk​™ Eliminate, either by remediating it with patches and configuration changes, or by mitigating it when a patch is not available or cannot be deployed yet. This connected workflow moves vulnerabilities from prioritization to patch or mitigation deployment without leaving the platform, helping you reduce Mean Time to Remediate (MTTR) and keep remediation tied to risk. You can also perform mitigation rollback of the findings in the plan that are already mitigated 

You can eliminate ETM findings in two ways:

  1. From an elimination plan in TE: Prioritize findings in ETM, hand off the plan to IT Ops, and create remediation or mitigation jobs for one or many findings in the plan.
  2. From the ETM Findings tab: Mitigate a single finding directly, without creating or handing off a plan.

Prerequisites

  • ETM Version 1.11.0 or later for patch jobs and ETM 1.14.0 version for Mitigation jobs. 
  • A user with any of the Patch Management roles can be assigned a Remediation Plan, but only users with the Create Job permission can create a job from that plan. 
  • ETM and TE integration enabled on your subscription.
  • The assets have the Cloud Agent installed and are activated for the Patch Management and Mitigation application. 
  • The finding has a Qualys mitigation available. 

Prioritize Vulnerabilities in ETM

To prioritize your workflow, follow these steps:

  1. On the ETM platform, navigate to ETM > Risk Management > Risk Workbench.
  2. Click Start Prioritizing.

  3. Define Scope

    Set the business context and drive prioritization:

    1. Click the desired business entity/entities.

      OR
    2. Click Choose Tags Instead to use asset tags for the prioritization scope.
      1. Click Choose Tags Instead. The Select Tags dialogue box is displayed.
      2. Select the desired tags and then click Add Tag.

  4. Filter Findings

    Decide on the prioritization approach to discern and filter the findings that require immediate attention. To do this effectively, structure the approach based on certain filters:
    1. Select the system-defined template (Highest Risk Reduction) with default filters. 
       
      OR
    2. Create a custom template.
      You can prioritize active vulnerabilities and misconfigurations on demand across tagged assets or selected Business Entities.

      Show me the steps to create a custom templateShow me the steps to create a custom template
      1. Click Let Me Decide.
      2. The Filters page appears with three different types of filters:
        1. Common Attributes: These filters  are common across both the finding types (vulnerabilities and misconfigurations)
        2. Vulnerabilities: These filters are only applicable to vulnerabilities.
        3. Misconfigurations: These filters are only applicable to misconfigurations.
      3. Expand each filter type and then drag and drop the desired filters to build your custom template.
      4. Click Add.
      5. Click Save as Template if you desire to save this custom template for future use.
      6. In the Save Filter As A Template dialog box, enter the Name and Description of the template and click Save.
      7. The saved template appears on the Select Prioritization Approach page.

  5. Start Prioritization

    Click Prioritize Now.

  6. Take Actions on Prioritized Findings

    1. Filter Using Group By:
      If desired, you can further filter these findings using various GroupBy options. To do so, click Group  By, and use any one of the specified options to group and filter the findings further.
    2. Download Findings in CSV Format:
      If desired, you can download these findings in CSV format. To do so, click the ellipsis near Save Plan at the top right corner and then click Download Report as CSV.
    3. Save Prioritization Plan:
      1. Click Save  Plan if you want to save the prioritization scope, findings, and filters for future use. 
      2. In the Save Prioritization Plan dialog box, enter the name and description of the plan and then click Save.
      3. The saved plan is displayed on the prioritization listing page on the Risk Workbench tab
      4. If desired, you can download the prioritization plan in CSV format. To do so, click the ellipsis near View Elimination Plan  at the top right corner and then click Download Report as CSV.

  7. Hand Off to IT Ops 

    To create the Elimination Plan, select a user with Patch Management permissions, and hand off the prioritization plan to the IT Ops team. 
    1. Click Hand Off to IT Ops. A Create Elimination Plan window is displayed. 
    2. Select the Remediation Owner and Priority from the list.
    3. Click Hand Off to IT Ops. The elimination plan is saved successfully. The plan is now replicated to TE.
    4. If desired, you can download the elimination plan in CSV format. To do so, click the three dots near View Elimination Plan at the top right corner and then click Download Report as CSV.

  8.  View the Elimination Plan

    1. Click View Elimination Plan to open the replicated plan in TRE. You can also open the plan from TE > Eliminations > Risk Elimination Plan. This tab lists plans from both ETM and VMDR. To show only plans from ETM, filter the list by Source. 

      The plan displays the number of findings, affected assets, and available eliminations for the filter/scope you selected when creating the plan.

      When a plan is created with Agent Sara in ETM, the plan details page shows an Agent Sara banner. Click View Remediation Waves for Overall Plan to see the plan’s findings grouped into waves and sub-waves by operational impact. You can then create a zero-touch patch job, a ring job, or a mitigation job for each sub-wave. For details, see Risk Remediation Using Agent Sara Waves. 
    2. On the Findings tab, the Elimination Options columns show what you can do for each finding:
      Column Description 
      Patches The patches available for the finding. Shows Remediation not available when no patch is available.
      Mitigations The number of mitigations available for the finding. Shows Mitigation not available when the finding has no mitigation.
      Recommended Actions The suggested next step: Remediate Now or Mitigate Now. Remediate Now is unavailable when the finding has no patch and no configuration change.
    3. Use Pivot Views to Analyze the Plan

      Group plan data in four ways to decide how to remediate.

      Select a clickable metric, such as the affected vulnerabilities count, to filter the list to those findings.

      1. Findings: View vulnerabilities at the finding level. This is the default view.

      2. CVE: Group findings by CVE to see how many findings each CVE affects.

      3. Asset: Group findings by asset to view vulnerabilities and available eliminations for each asset.

      4. Elimination: Group findings by patch to see how many CVEs associated with the patch. 

  9. Remediate, mitigate, or rollback mitigation as per the option available:

    1. To remediate the vulnerabilities, perform the following: 

      1. To remediate an individual CVE, select the CVE and click Create Remediation Job. A Windows/Linux Deployment Job window is displayed. 

      2. To remediate multiple CVEs, select them and from the Actions menu, click  Create Remediation Job.  The Windows/Linux Deployment Job window is displayed. 

    2. To mitigate the findings, perform the following: 

      1. On the Findings tab, search with finding.isQualysMitigable:TRUE to list the findings you can mitigate.

      2. (Optional) To review the mitigation options before you create the job, click the count in the Mitigations column. The mitigation options for each CVE are listed, and the recommended mitigation is selected by default. Select a different option if required.

      3. In the Recommended Action column, click Mitigate Now.
    3. To rollback an applied mitigation, perform the following: 
      1. On the Elimination plan page, use the QQL finding.isMitigated: TRUE to list the findings that are already mitigated.
      2. Select the required finding and click Rollback Mitigation. For more information, see Create Mitigation Rollback Job

Create Remediation Jobs

To complete the steps for Windows job creation, refer to Creating Patch Job for Windows Assets, and for Linux job creation, refer to Creating Patch Job for Linux Assets.

  • In step 2, on the Select Assets tab, assets from the elimination plan are pre-populated under the Assets Selected from Elimination Plan section. 
  • In step 4, on the Select Patches tab, patches from the elimination plan are pre-populated under the Patches Selected from Elimination Plan section. 

 Deploy the patches in stages
To validate patches on test assets before they reach production, create a ring job from an Agent Sara sub-wave. TE creates a job for each ring in your ring configuration, for example, Lab Environment, Staging Environment, and Production. Each ring starts only when the previous ring meets your success criteria. For details, see Roll Out High-Impact Updates in Stages with a Ring Job and Setting Ring Configuration.

Create Mitigation Jobs from the Elimination Plan

Use a mitigation job to reduce the risk from plan findings that have no patch, or whose patch you can not deploy yet. The mitigation job starts with the assets and CVEs from the selected findings, so you don’t need to rebuild the scope. 

For plans created with Agent Sara, Wave 3 – Mitigations for No Patch Findings already groups findings with no patch by asset type and operating system. For details, see Risk Remediation Using Agent Sara Waves.

Mitigate a Single Finding in the Plan

  1. Open the elimination plan. On the Findings tab, search with finding.isQualysMitigable:TRUE to list the findings you can mitigate.
  2. (Optional) To review the mitigation options before you create the job, click the count in the Mitigations column. The mitigation options for each CVE are listed, and the recommended mitigation is selected by default. Select a different option if required. 
  3. In the Recommended Action column, click Mitigate Now. To complete the steps for Windows or Linux Mitigation job creation, refer to Create Mitigation Job. 

Mitigate Multiple Findings in One Job

  • On the Findings tab, select the findings that you want to mitigate.
  • From the Actions menu, click Create Mitigation Job. 

You can also create a mitigation job from the other pivot views of the plan, such as findings grouped by CVE, the Asset view, and the mitigations listed in the Elimination View. 

To complete the steps for Windows or Linux Mitigation job creation, refer to Create Mitigation Job. 

  • In step 2, on the Select Assets tab, assets from the elimination plan are pre-populated under the Assets Selected from Elimination Plan section. Click Preview to view the assets. You can select the assets you want to exclude from the job, then click Exclude Selected. 
  • In step 3, on the Select Actions tab, CVEs from the elimination plan are pre-populated under the CVEs  Selected from Elimination Plan section. Expand the CVE, select the required mitigation script. By default, one of the Qualys scripts is selected for recommendation. 

Create Mitigation Rollback Job

To complete the steps for Windows or Linux Mitigation Rollback job creation, refer to Create Mitigation Rollback Job. 

  • In step 2, on the Select Assets tab, assets from the elimination plan are pre-populated under the Assets Selected from Elimination Plan section. Click Preview to view the assets. You can select the assets you want to exclude from the job, then click Exclude Selected. 
  • In step 3, on the Select Actions tab, the mitigated CVEs from the elimination plan are pre-populated under the CVEs  Selected from Elimination Plan section. All the listed CVEs have been rolled back. 

Related Topics

Prioritization Workflow in ETM

Vulnerability Remediation Using Configuration Scripts

Create Remediation Job

Risk Remediation Using Agent Sara Waves



 

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: October, 2026