Help & workflow guide
Quarterly vulnerability delivery from ConnectSecure through client email, review meeting, and remediation tickets.
First-time setup
- Settings - Add ConnectSecure API credentials (Global → Settings → Users → API Key). Set Reports Base Path to your synced client documentation root (OneDrive/SharePoint local sync folder). Enter your name under Prepared By and your default TimeZest scheduling link.
- Client mappings - Map each ConnectSecure company ID to the relative folder path under Reports Base Path
(e.g.
Acme Corp/Network Documentation/Vulnerability Scans). This is a local path, not a share URL. Extra contacts holds any number of additional deliverable email recipients per company. - Rules (optional) - Customize remediation text appended to ticket instructions by product pattern.
- Templates (optional) - Edit the client email and Manage PSA ticket-note templates (RMIT vs RMIT+ variants).
Quarterly workflow
Technician steps before and through the client call. Remediation work after delivery is handled by new tickets, not in this flow.
Typical order: sidebar Prep, then Start client review → Review → Export → Deliverables.
- Prep (sidebar) - Company review, Probe & credentials, and patching checks so coverage is current before you pull reports.
- Start client review - Download All Vulnerabilities (application, network-scanner, and registry) plus an external scan file if you need a fresh set. If the output folder already has those reports (including after an interrupted download), use existing reports and start the session without waiting on ConnectSecure again.
- Review - Curate the export set (Top N, Add to export, remediation, time estimates). Walk findings on the client call.
- Export - From the review session, open Export client reports to write DOCX, PDF, XLSX, and an experimental PowerPoint walkthrough of the Top N set to the quarterly folder. The official ConnectSecure executive summary downloads by default. VScanMagic Full and Actionable executive summaries are an experimental checkbox on that page. Deliverables uses the quarter-folder files for the client email.
- Deliverables - Copy ticket instructions and Manage PSA notes; on the Email tab paste OneDrive share links (from Explorer Copy link after export) and send the client email.
- Client schedules meeting - Client may book via TimeZest, or proceed without a meeting.
- Live review with client - Revise remediation and scope during the call; re-export if needed.
- Remediation - New tickets from the review handle actual remediation work; not part of this prep/send flow. After delivery, Remediation status Refresh saves a check of the original export-set list and current ConnectSecure status, including hosts unchecked on Review. Reopen any check later. On still-open items, set Owner to Client, River Run, or Other and add a note during the client review. Apply to session writes Remediated and live vuln counts on Complete or Suppressed items only - it does not rewrite Revised remediation or still-open findings.
Review session
Use the workflow banner on each page. The app checks that report files exist before Deliverables email.
Before the client call
Adjust the export set, then Export client reports. External scan items start at the top. Add network findings from Add to export when they belong on the client report. Preliminary time estimates and remediation text often change after the client call.
VScanMagic executive scores
Export shows a Full grade (every finding in All Vulnerabilities) and an Actionable grade (default: Critical and High with EPSS above 0). Checking Medium or Low still drops rows at or under the EPSS threshold unless Keep selected severities is on. Filters are on the page so you can try other cutoffs before you generate. Export client reports writes the official ConnectSecure executive summary by default. Check VScanMagic executive summaries (experimental) to add Full and Actionable. Those grades use a finding mix (all-Critical is 100). Actionable is the leftover share of that mix. Clean hosts come from active ConnectSecure inventory. Those reports follow the ConnectSecure executive summary: landscape cover with the padlock behind a left white card, asset counts, a severity pie next to Authenticated Vulnerability Summary, company grade letter and scale, AD counts, OS and vendor tables, network assessment, product grids, and the standard CS assessment / SANS / AD essays. Active Directory counts come from the ConnectSecure AD APIs when the session has a company id. Microsoft Secure Score is included only when CS has a score for that company. The official ConnectSecure portal executive summary is the default client executive report.
Findings review tab
Work through the export set. External scan findings sort first and use an orange highlight - they are internet-facing and take priority over internal items. Edit remediation text, meeting notes, and per-host inclusion. Use ConnectSecure suppress when a finding should be company-wide suppressed.
Add to export tab
Application and registry findings share Top N by the same risk score (EPSS and CVSS). External scan items always start at the top of the export set and do not use those slots. Network findings usually have no EPSS - add any that belong on the client report. Email DNS is optional and counts toward Top N when you add it. Settings Min EPSS applies to application and registry ranking only. Severity filters still apply. After you save your own Hatz key and model on Settings, AI review is on the Review session bar. It suggests an export set from known exploited, EPSS, host count, and risk score, including findings from below Top N when those are a better client topic than the bottom of the set. Those rows are checked. Check the list before you apply.
Time estimates tab
Enter hours and billing options (after-hours work, third party, ticket already created). RMIT+ sessions show additional billing fields. Update after the client call when scope is agreed.
Deliverables & email links
Used in workflow steps 4-6 and again at Deliver after the client call. On the Linux server, use Generate OneDrive share links after export (waits for rclone sync, then creates anonymous links). Or paste links from Explorer/SharePoint on Windows.
- Top N report link - Anonymous view link for the Top N document; must open for external clients.
- Reports folder link - Anonymous view link for the quarterly folder.
- Scheduling link - TimeZest (or similar) from Settings; lets the client book the review meeting.
- All items already in tickets - Email note says tickets are already created and omits third-party quote language. Client can still use the scheduling link to discuss.
- Remaining remediations - After first-party tickets exist (or for RMIT/CMIT), send a client-facing list of leftover 3rd-party or outstanding Top N items. Copy the follow-up email or generate a Word report. Default selection is 3rd-party items that are still open. This is separate from the quarterly email.
- Sales quote ticket - Creates a Manage Sales ticket (New Quote, New Proposal, Sales Team). The discussion note is the quote list. Next Steps is an internal note on the same ticket. Use after hours are agreed on Review.
- Edit before send - Expand a ticket to change the subject or body. The Email, remaining remediations, and Sales quote tabs have the same editors. Create tickets, Copy, and Open in Outlook use the edited text. Reset to generated restores the template.
- Improve ticket bodies - After a Hatz key and model are saved on Settings, Deliverables can draft a clearer body for the selected tickets or for all of them. Apply a draft to keep it on the session. Tickets already created in Manage are not changed.
Quarterly client email: enter the external client address in To. Exchange transport rules encrypt on send and copy to security-deliverables@river-run.com automatically - no Encrypt button and no Cc in Outlook.
Tabs: ticket instructions and Manage PSA notes for technician tickets; email for the client send; Sales quote ticket for Sales; remaining remediations for leftover 3rd-party or outstanding work.
Pages in the app
- Prep (sidebar)
- Company review, probes, and patching - useful when you want a current scan before a new review.
- Company review
- Pick a company and check probes, scan targets, and leftover agents. After the run, Liongard may list possible subnets in use and WAN IPs ConnectSecure is not scanning yet. Add then Confirm creates the discovery setting. Probe credentials live on Probe & Credentials. When Show email DNS findings is on in Settings, Run Company Review also checks SPF, DMARC, and DKIM for mapped domains.
- Start client review
- Main workflow: download if you need a fresh set, or use existing reports already in the output folder, then Start review session.
- Bulk review
- Same as Start client review for many clients at once - one client at a time, All Vulnerabilities first, then External. Sessions start as each client is ready. After the job: open each session from Review sessions (or Open review in the job table), curate findings, then Export and Deliverables per client. Prep each client when you want a current scan.
- Ad-hoc report downloader
- Extra ConnectSecure catalog or global pulls when the Start client review download is not enough. Then start the session from the output folder.
- Review sessions
- Resume, archive, or delete saved quarterly client reviews.
- News
- Sidebar footer. Recent changes for this browser. Got it or Mark all read hides them until a newer entry ships.
- Backup & restore
- Export or import review sessions, settings, rules, templates, and maps as a ZIP. On import, choose Merge (add backup sessions, keep existing), Replace, or Skip for session databases. Restart after import.
- Patching & suppressions
- One company picker for application patches, Windows OS updates, and ConnectSecure suppressions. Switch tabs after Load company. Suppress by remediation item or CVE problem id.
- Probe & credentials
- ConnectSecure prep: probe mappings, credential assignments, and Valid / failure status. Queue a scan on the probe that owns those credentials and networks. Firewall scans need a firewall credential and mapped networks. SNMP scan queues a Network Scan on this probe's mapped subnets and needs SNMP credentials. Check job status for Queued, In progress, Finished, or Did not run.
- Email DNS security
- Standalone SPF, DMARC, and DKIM page. Look up one domain for an existing client, or fill in a company name and scan a domain that is not mapped. Bulk scan still covers mapped companies.
- Remediation status
- After delivery, Refresh compares the export set to ConnectSecure and saves a check. The page shows the All Vulnerabilities report date: Refresh reuses that file, Hard refresh downloads a new one. Reopen any check later - findings on the left, one row per machine when you select one, including hosts unchecked on Review. Installed uses live inventory, then the All Vulnerabilities Software Version column when inventory is empty. OS Installed is the Windows build, not Yes/No for the KB. Target shows KBxxxxxxx for OS updates; application rows ignore a Windows KB that ConnectSecure glued onto Apply the latest patch. Version check uses the oldest matching build when a host has more than one copy, and ignores unrelated version families (Adobe 26.x is not compared to 5.1.x). Teams 1.5.x is labeled Classic leftover for the RMM cleanup script; 26198-style builds are New Teams. If the installed build is at target, that host is Cleared even when All Vulnerabilities still lists it. OS findings are the target KB. CS status uses live agent last ping from ConnectSecure Agents (online within about an hour); it falls back to the rem list flag only when no agent matches. Refresh batches host inventory instead of one ConnectSecure call per machine. On Open or Partial items, set Owner (Client, River Run, or Other) and an optional note; that is saved on the session and included on Download Excel. Excel lands in the quarter folder (not Misc). If a status workbook is already there, choose Replace or Add additional. Both sheets have a color key: Complete green, Client gold, River Run / Other quieter, Partial yellow, Open orange. Times on the page and in Excel use the configured local zone (America/Chicago). Apply to session writes Remediated and live vuln counts on Complete or Suppressed items only. It does not rewrite Revised remediation or still-open findings.
- Host counts
- Optional per-host totals from the full report file. Open from Review or as a PDF/XLSX on Export.
- Application / OS patching
- On Patching & suppressions. Schedule ConnectSecure patches from the web UI.
Glossary
- Export set / Top N
- Findings included in the quarterly client report. Default count comes from Settings (Top 10, 20, etc.).
- RMIT+ vs RMIT/CMIT
- RMIT+ clients get agreement-coverage wording and ticket defaults; hourly clients require explicit approval before remediation.
- EPSS
- Exploit Prediction Scoring System - likelihood of exploitation in the next 30 days (0-1).
- VScanMagic executive score
- Company letter (A-F) from the mix of Critical, High, Medium, and Low counts in All Vulnerabilities. All-Critical is 100. Actionable is the leftover share of that same mix (default: leftover Critical/High with EPSS above the threshold) and cannot score higher than Full. Clean hosts come from active ConnectSecure inventory. Keep selected severities includes checked bands even when EPSS is at or under the cutoff.
- All Vulnerabilities XLSX
- Required source file from ConnectSecure. Top Ten Data alone does not contain enough detail for review.
- Reports Base Path
- Local synced root containing client folders - not the same as a SharePoint share URL.
- Extra contacts
- Permanent additional email recipients on Client mappings, any number per ConnectSecure company. ConnectSecure ID opens a filterable, scrollable company list. Shown on Deliverables for Outlook paste with the Manage primary To address.
- Email DNS findings
- Optional SPF, DMARC, and DKIM checks per domain. Map each ConnectSecure company to a Liongard environment and run Sync from Liongard to cache domain-inspector and Microsoft 365 verified domains; assessments use live public DNS lookups against that cached list (plus any manual entries). If no domains are configured, the Manage primary contact email domain is used. Extra Liongard-only clients are expected. Enable in Settings, then Configuration → Liongard map.
Tips
- Look for icons throughout the app for field-level help.
- Shift-click severity or report checkboxes to toggle a range.
- ConnectSecure suppress in review requires loading options first, then selecting the CVE problem or remediation item.
- NVD enrichment fetches CVE descriptions when you open a session or use Fetch NVD on a finding.
- Email DNS: turn on in Settings, add domains under Configuration → Liongard map, then run Company Review or use Refresh email DNS on a review session. If no domains are configured, the Manage primary contact email domain is used. Exclude domains that are not used for mail - the remaining names still go on the review finding and ticket. Ticket notes on Deliverables include a summary when enabled.
- News in the sidebar footer lists recent changes for this browser. Got it or Mark all read hides them until a newer entry ships.
- See About for config file locations and version info.
What technicians are saying
Completely fictional endorsements. VScanMagic has not been evaluated by the FDA, the Vatican, or any volcano safety board.
“Before VScanMagic I was adrift. After my first Top Ten export I found purpose, paid off my house, and was asked to be godparent to a child I’d never met. The baptism was EPSS-themed-they sprinkled holy water ranked by exploit probability.”
“I was copy-pasting ticket notes manually when a kid wandered too close to an active volcano. I hit Suppress in ConnectSecure, the lava paused, and the child waved. My manager said it was ‘probably unrelated.’ I know the truth.”
“The Deliverables email tab alone saved my marriage. I pasted the OneDrive link, my spouse pasted the TimeZest link, and we met in the middle at a quarterly review. CVE couples therapy is real.”
“I used to dream in Excel #REF! errors. Now I dream in ranked findings with tasteful remediation prose. The Add to export tab promoted my inner network finding to CTO.”
“Company review flagged an offline agent. I fixed it. That agent later became sentient, passed the bar exam, and represents me in probe-mapping disputes. We still use VScanMagic for holidays.”
“Shift-click changed my life. One gesture toggled an entire severity range, a flock of doves appeared, and the Nobel committee called about ‘contributions to checkbox ergonomics.’ I forwarded them to Start client review → Export set (Top N).”
“VScanMagic didn’t just streamline quarterly delivery-it rewrote my biography. I’m listed as ‘Father’ on two birth certificates, ‘Emergency Contact’ on a third, and ‘Preferred SharePoint Link Provider’ on a fourth. The volcano kid sends a Christmas card every year. It always says CVE-2017-2619 in the envelope. We don’t ask why.”