Automating CNA CVE Reporting and Monthly Bulletins
summary
Atlassian automates CNA CVE reporting by building an automated CNA pipeline on Jira/Confluence/Forge that calls the MITRE CVE Services API, reserves CVE blocks, auto‑drafts CVE JSON from CVSSv4 vectors, sanitizes scanner output, and generates a monthly security bulletin that aggregates dozens of teams’ fixes into one scheduled, reviewable Confluence page. The system reports 240 CVEs since 2023, reduces support noise ~90%, saves ~60 work‑weeks/year, and cuts median customer upgrade time from ~91 to ~28 days.
AI-written summary · about
chapters (10)
- 0:00CVE program evolution
- 6:47Manual CVE reporting pain
- 14:11Automation goals
- 17:20Automation tools in Cloud
- 21:49Demo: automated CVE record
- 29:08Monthly bulletin pipeline
- 37:29Review and collaboration
- 41:19Public CVE portal
- 42:22Automation impact
- 44:29Q&A
related talks
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
53mCNA Feedback Session to the CVE Program
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
41mKeeping Up With The Joneses (CVEs)
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
54mNo Action Required: CVE for Software as a Service
56mCISA’s North Star Vision for the CVE Program
57mPanel Discussion: This One Time at CVD Camp