Aggregate Endpoint Security Risk Scores with EDR & Google Sheets

This workflow automates endpoint security risk assessment by fetching endpoint-specific CVE data from EDR or external feeds and loading enriched internal asset inventories (IP, department, criticality). It calculates a composite risk score using a weighted formula: (CVE severity × Asset risk rating × Exposure coefficient), then applies custom playbook rules to categorize actions (Notify/Investigate/Isolate). Results are filtered into a triaged list of high-risk endpoints, logged to active and historical Google Sheets, and summary email alerts are sent.

Ideal for security teams and SOC analysts prioritizing incidents based on business risk rather than raw scores. Benefits include time savings on manual triage, improved prioritization of critical assets, and scalable automation for small-to-mid IT teams using Google Sheets inventories. Use cases: Daily/hourly risk aggregation from vulnerability scans, proactive threat hunting, and integrating with tools like CyberScan.

Setup requires Google Sheets OAuth for asset/vulnerability inputs, editing thresholds in the Risk Score Calculator node, and configuring email credentials. Add Cron/Webhook triggers for scheduling. No advanced coding needed—sticky notes provide clear instructions. Customize by swapping Sheets for Supabase/Airtable, adjusting formulas, or integrating additional feeds.