Every 6 hours

Open incidents for new vulnerabilities in your products

Critical CVEs that mention software you run turn into incidents with severity and affected product filled in.

Runs: Every 6 hours
Apps: ServiceNow
AI: Yes, uses the built-in AI allowance
Access: write incident

Send this to your assistant

Create a ClickRuntime automation: every 6 hours, check the NVD feed for new critical CVEs that mention Apache Tomcat, Citrix or VMware, pull out the severity and affected product, and create a ServiceNow incident for each one.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

Security teams track new vulnerabilities by watching feeds, mailing lists and vendor bulletins, and then deciding which ones affect the software the company actually runs. A critical CVE in a library that powers a customer-facing service may be published at 2 am, and the person who reads the feed on Monday morning is already behind. Reading hundreds of entries a week, and writing up the ones that matter in ServiceNow, is slow work, so important items are late and trivial ones clutter the queue.

Every six hours the automation fetches a public CVE feed, skips entries it has seen before, and uses ClickRuntime's built-in AI to judge relevance against the products you list and to fill in incident fields such as short description, severity and recommended action. It then creates a ServiceNow incident for each relevant one. Security and IT operations teams use it to keep vulnerability tracking in their normal workflow.

What you get out of it

Critical CVEs reach the queue quickly
An incident for a serious vulnerability exists within hours of publication, with an owner to be assigned. Patching sooner shrinks the window in which attackers can use a known flaw.
Only relevant entries create work
Filtering against your own product list stops the queue from filling with CVEs for software you do not run. Analysts review a short list of real exposures instead of the entire feed.
Incidents are written consistently
Each record has a clear title, severity and recommended action in the same format. Whoever picks it up knows what to do next, which speeds triage and reduces reliance on one expert.
An audit trail of vulnerability handling
Every CVE evaluated and every incident created is recorded. When an auditor or customer asks how you track new vulnerabilities, you can show the process and the specific dates. When a customer security questionnaire asks how new CVEs are tracked, you can point to dated incidents.
Weekend and night coverage
A feed read by a person works only when that person is working. A job that runs every six hours covers holidays and nights, so exposure does not increase just because the calendar says it is the weekend.

How it works

What happens, step by step

Every 6 hours, ClickRuntime reads the public list of newly published vulnerabilities (CVEs).
It keeps the critical ones that mention software you run, and skips any it has already handled.
AI reads each one and fills in the severity, the affected product and versions, and a short description.
A new ServiceNow incident is opened for each, ready for your team to work on.

Before it runs live

Connect ServiceNow

What you get

RunsEvery 6 hours

Open incidents for new vulnerabilities in your productstoday, 9:00Succeeded

ServiceNow · IncidentINC0041207: CVE-2026-31842 (9.8) in Apache Tomcat 10.1.0–10.1.34

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Change what the AI looks for, or how it writes the result
Add another app, for example also send it to Slack
Combine it with other ServiceNow steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

create_security_incidents_from_new_cves.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, state, ai, notify

INSTANCE = "northwind"
PRODUCTS = ["Apache Tomcat", "Citrix", "VMware"]
SCHEMA = {"type": "object", "required": ["product", "summary"],
          "properties": {"product": {"type": "string"}, "summary": {"type": "string"}}}

def snow(method, path, **kw):
    resp = http.request(method, f"https://{INSTANCE}.service-now.com/api/now/{path}",
                        auth=(credentials.secret("SERVICENOW_USER"), credentials.secret("SERVICENOW_PASSWORD")),
                        headers={"Accept": "application/json"}, **kw)
    resp.raise_for_status()
    return resp.json()["result"]

@on_trigger
def run(event):
    now = datetime.now(timezone.utc)
    seen = set(state.get("seen") or [])
    created = []
    for product in PRODUCTS:
        data = http.get("https://services.nvd.nist.gov/rest/json/cves/2.0", params={
            "keywordSearch": product, "cvssV3Severity": "CRITICAL",
            "pubStartDate": (now - timedelta(days=2)).isoformat(timespec="milliseconds")[:23],
            "pubEndDate": now.isoformat(timespec="milliseconds")[:23]}).json()
        for v in data.get("vulnerabilities", []):
            cve = v["cve"]
            if cve["id"] in seen:
                continue
            desc = next(d["value"] for d in cve["descriptions"] if d["lang"] == "en")
            score = cve["metrics"]["cvssMetricV31"][0]["cvssData"]["baseScore"]
            f = ai.generate(desc[:2000], json_schema=SCHEMA, max_output_tokens=120,
                            system="Name the affected product and version range, and summarise the risk in one sentence.").json
            inc = snow("POST", "table/incident", json={"short_description": f"{cve['id']} ({score}) in {f['product']}",
                       "description": f"{f['summary']}\n\nhttps://nvd.nist.gov/vuln/detail/{cve['id']}",
                       "category": "security", "impact": 1, "urgency": 1})
            created.append(inc["number"])
            seen.add(cve["id"])
    if created:
        notify.email_me(f"{len(created)} CVE incidents created", ", ".join(created))
    state.set("seen", sorted(seen)[-2000:])
    return {"created": created}

FAQ

Common questions

Which CVE feed does it use?

It uses a public feed you specify, such as the National Vulnerability Database or a vendor advisory feed. The feed's address is part of the setup, so you can change to a source your security team already trusts.

How does it decide a CVE is relevant to us?

You supply a list of products, libraries and versions you run, and the AI compares each CVE's affected products to that list. It is a screening step, so a security analyst should still confirm exposure before patching.

What happens to CVEs it creates incidents for twice?

It stores the IDs it has processed, so a CVE already handled is skipped in later runs. If a CVE is later updated with a new score, it will not create a new incident unless you ask it to.

What permissions does it need?

write incident. Nothing else in your accounts is used.

Does it need AI?

Yes. It uses ClickRuntime's built-in AI, so you don't need an OpenAI or Anthropic key. Every plan includes a monthly AI allowance.

How many runs does it use?

One run each time it runs (every 6 hours). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily