Reachability-Gated Vulnerability Triage with Aikido and Kestra

id: aikido-reachability-gated-triage
namespace: company.security

inputs:
  - id: issue_group_id
    type: STRING
    defaults: "5001"
    description: Aikido issue group to triage. The trigger overrides this on every
      automated run.

  - id: auto_snooze_days
    type: INT
    defaults: 30
    description: How long an unreachable finding stays snoozed before Aikido
      surfaces it again.

  - id: escalation_score
    type: INT
    defaults: 80
    description: Aikido severity_score at or above which a reachable finding pages
      the on-call engineer.

variables:
  api_base: https://app.aikido.dev
  token_url: https://app.aikido.dev/api/oauth/token

tasks:
  - id: authenticate
    type: io.kestra.plugin.core.http.Request
    description: Exchange the Aikido client credentials for a short-lived bearer
      token used by the reachability calls.
    uri: "{{ vars.token_url }}"
    method: POST
    contentType: application/json
    body: '{"grant_type": "client_credentials"}'
    options:
      auth:
        type: BASIC
        username: "{{ secret('AIKIDO_CLIENT_ID') }}"
        password: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
      timeout:
        connectTimeout: PT10S
        readIdleTimeout: PT30S
    retry:
      type: constant
      interval: PT5S
      maxAttempts: 3

  - id: issue_detail
    type: io.kestra.plugin.core.http.Request
    description: Read the full issue so the gate can see reachability_status,
      exploitability, and Aikido's re-scored severity.
    uri: "{{ vars.api_base }}/api/public/v1/issues/{{ inputs.issue_group_id }}"
    method: GET
    headers:
      Authorization: "Bearer {{ fromJson(outputs.authenticate.body).access_token }}"
    options:
      timeout:
        connectTimeout: PT10S
        readIdleTimeout: PT30S
    retry:
      type: constant
      interval: PT5S
      maxAttempts: 3

  - id: reachability
    type: io.kestra.plugin.core.http.Request
    description: Fetch the call chains Aikido traced from application code into the
      vulnerable package.
    uri: "{{ vars.api_base }}/api/public/v1/issues/{{ inputs.issue_group_id
      }}/reachability"
    method: GET
    headers:
      Authorization: "Bearer {{ fromJson(outputs.authenticate.body).access_token }}"
    options:
      allowFailed: true
      timeout:
        connectTimeout: PT10S
        readIdleTimeout: PT30S

  - id: classify
    type: io.kestra.plugin.core.debug.Return
    description: Collapse reachability, exploitability, and the CVSS re-scoring
      delta into a single routing verdict.
    format: |
      {{
        {
          "status": fromJson(outputs.issue_detail.body).reachability_status ?? 'unknown',
          "exploitability": fromJson(outputs.issue_detail.body).exploitability ?? 'no_known_exploit',
          "score": fromJson(outputs.issue_detail.body).severity_score ?? 0,
          "cvss": fromJson(outputs.issue_detail.body).original_cvss_severity_score ?? 0,
          "chains": (outputs.reachability.code == 200) ? (fromJson(outputs.reachability.body).chains | length) : 0,
          "repo": fromJson(outputs.issue_detail.body).code_repo_name ?? 'unknown',
          "verdict": (
            (fromJson(outputs.issue_detail.body).reachability_status ?? 'unknown') == 'not_reachable'
            and (fromJson(outputs.issue_detail.body).exploitability ?? 'no_known_exploit') == 'no_known_exploit'
          ) ? 'suppress' : (
            (
              (fromJson(outputs.issue_detail.body).reachability_status ?? 'unknown') == 'reachable'
              or (fromJson(outputs.issue_detail.body).exploitability ?? 'no_known_exploit') == 'actively_exploited'
            ) ? 'escalate' : 'review'
          )
        } | toJson
      }}

  - id: route
    type: io.kestra.plugin.core.flow.Switch
    description: Unreachable findings are suppressed with an audit trail, reachable
      ones escalate, everything else waits for a human.
    value: "{{ fromJson(outputs.classify.value).verdict }}"
    cases:
      suppress:
        - id: snooze_unreachable
          type: io.kestra.plugin.aikido.issues.Snooze
          clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
          clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
          issueGroupId: "{{ inputs.issue_group_id }}"
          until: "{{ now() | dateAdd(inputs.auto_snooze_days, 'DAYS') }}"
          reason: "Auto-snoozed by Kestra: Aikido reachability analysis found no call
            chain from application code, and no known exploit exists.
            Re-surfaces in {{ inputs.auto_snooze_days }} days."

        - id: record_suppression
          type: io.kestra.plugin.core.log.Log
          message: "SUPPRESSED issue {{ inputs.issue_group_id }} in {{
            fromJson(outputs.classify.value).repo }}: not reachable, no known
            exploit, {{ outputs.snooze_unreachable.snoozedSingleIssuesAmount }}
            single issues snoozed."

      escalate:
        - id: page_on_call
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {
              "text": ":rotating_light: Reachable vulnerability in {{ fromJson(outputs.classify.value).repo }}",
              "blocks": [
                {"type": "header", "text": {"type": "plain_text", "text": "Reachable vulnerability confirmed"}},
                {"type": "section", "fields": [
                  {"type": "mrkdwn", "text": "*Repository*\n{{ fromJson(outputs.classify.value).repo }}"},
                  {"type": "mrkdwn", "text": "*Aikido score*\n{{ fromJson(outputs.classify.value).score }} (CVSS {{ fromJson(outputs.classify.value).cvss }})"},
                  {"type": "mrkdwn", "text": "*Reachability*\n{{ fromJson(outputs.classify.value).status }} via {{ fromJson(outputs.classify.value).chains }} call chain(s)"},
                  {"type": "mrkdwn", "text": "*Exploitability*\n{{ fromJson(outputs.classify.value).exploitability }}"}
                ]},
                {"type": "section", "text": {"type": "mrkdwn", "text": "*Issue group* {{ inputs.issue_group_id }} | *Execution* {{ execution.id }}"}}
              ]
            }

        - id: log_escalation
          type: io.kestra.plugin.core.log.Log
          message: "ESCALATED issue {{ inputs.issue_group_id }}: score {{
            fromJson(outputs.classify.value).score }}, {{
            fromJson(outputs.classify.value).chains }} reachable call chain(s)."

      review:
        - id: queue_for_review
          type: io.kestra.plugin.core.log.Log
          message: "REVIEW issue {{ inputs.issue_group_id }} in {{
            fromJson(outputs.classify.value).repo }}: reachability is {{
            fromJson(outputs.classify.value).status }}, needs a human decision."

  - id: triage_summary
    type: io.kestra.plugin.core.log.Log
    message: "Triage complete for issue group {{ inputs.issue_group_id }}:
      verdict={{ outputs.route.value }}, reachability={{
      fromJson(outputs.classify.value).status }}, score={{
      fromJson(outputs.classify.value).score }}."

triggers:
  - id: on_new_high_severity_issue
    type: io.kestra.plugin.aikido.issues.Trigger
    description: Fires once per newly detected Aikido issue group at or above the
      escalation score.
    clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
    clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
    severityThreshold: 80
    interval: PT10M

errors:
  - id: triage_failed
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":warning: Aikido reachability triage failed for issue group {{ inputs.issue_group_id }}. The finding was neither suppressed nor escalated, so it needs manual review. Execution {{ execution.id }}."
      }

outputs:
  - id: verdict
    type: STRING
    value: "{{ outputs.route.value }}"

  - id: reachability_status
    type: STRING
    value: "{{ fromJson(outputs.classify.value).status }}"

Most vulnerability backlogs are noise. A scanner flags every CVE in every transitive dependency, and an engineer spends the week proving that ninety percent of them are never actually executed. Aikido already answers that question with reachability analysis, tracing whether application code can reach the vulnerable function at all. This blueprint turns that answer into an automated decision: findings with no call chain and no known exploit are snoozed with a written justification, findings that are reachable or actively exploited page the on-call engineer, and anything ambiguous is queued for a human. The suppression is recorded in Aikido itself, so the audit trail survives long after the execution log rolls off.

How it works

The on_new_high_severity_issue trigger (io.kestra.plugin.aikido.issues.Trigger) polls Aikido every ten minutes and fires one execution per newly detected issue group scoring 80 or above. On first activation it records a baseline instead of flooding you with the existing backlog.
The authenticate task (io.kestra.plugin.core.http.Request) performs the OAuth2 client-credentials exchange against /api/oauth/token using basic auth, returning a short-lived bearer token.
The issue_detail task reads /api/public/v1/issues/{id}, which carries the three fields the gate depends on: reachability_status, exploitability, and severity_score alongside original_cvss_severity_score.
The reachability task calls /api/public/v1/issues/{id}/reachability for the traced call chains. It runs with options.allowFailed: true so a workspace without the reachability engine degrades to the unknown path instead of failing the flow.
The classify task (io.kestra.plugin.core.debug.Return) collapses those signals into one JSON verdict object, including how many call chains were returned and the delta between Aikido's re-scored severity and the raw CVSS score.
The route task (io.kestra.plugin.core.flow.Switch) branches three ways. suppress calls io.kestra.plugin.aikido.issues.Snooze with a written reason and a dated expiry. escalate posts a structured Slack block with the call chain count. review logs the finding for a human.
The errors block guarantees a failed triage is announced rather than silently dropping a finding on the floor.

What you get

Automatic, justified suppression of unreachable findings, with the reason stored in Aikido rather than in a spreadsheet.
Paging that fires on exploitability and reachability, not on raw CVSS, so the on-call rotation stops being trained to ignore alerts.
A visible comparison of Aikido's contextual score against the original CVSS score on every escalation.
A dated snooze that re-surfaces the finding instead of burying it forever.
Flow-level outputs (verdict, reachability_status) that a parent flow or a reporting job can consume.

Who it's for

Application security teams drowning in dependency findings that are never executed at runtime.
Platform teams who own the vulnerability SLA but do not own the application code.
On-call engineers who want a page to mean something.

Why orchestrate this with Kestra

Reachability data is only useful if something acts on it. Aikido exposes the analysis over its API, but deciding what to do with it is a workflow problem: authenticate, correlate several endpoints, branch on the result, write a suppression back with an expiry, and notify the right channel. Kestra gives that logic a declarative home with retries on the token exchange, a graceful degradation path when reachability is unavailable, branch-level task isolation through Switch, and an execution record that shows exactly why a given CVE was suppressed six months ago. Doing the same in a scheduled script means reimplementing OAuth refresh, partial-failure handling, and an audit trail that auditors will actually accept.

Prerequisites

An Aikido workspace with API credentials created under Settings, Integrations, Aikido REST API. The credentials need the issues:read and issues:write scopes.
Reachability analysis enabled on the workspace. Without it the flow still runs, but every finding resolves to the review branch.
A Slack incoming webhook for the escalation channel.
Aikido rate-limits the public API to 20 calls per minute per workspace, which the ten minute trigger interval stays comfortably under.

Secrets

AIKIDO_CLIENT_ID, AIKIDO_CLIENT_SECRET: OAuth2 client credentials for the Aikido public API.
SLACK_WEBHOOK: incoming webhook URL used for escalations and failure notices.

Quick start

Add the secrets above to your Kestra namespace.
Set vars.api_base and vars.token_url to your Aikido region if you are not on the EU instance. The US, AU, and ME regions use app.us.aikido.dev, app.au.aikido.dev, and app.me.aikido.dev.
Run the flow manually with the default issue_group_id to confirm authentication and routing before enabling the trigger.
Tune escalation_score and the trigger's severityThreshold to your own paging appetite.
Enable the trigger and let the first poll seed its baseline.

How to extend

Replace the review branch with io.kestra.plugin.core.flow.Pause so a human resumes the execution with an explicit snooze or escalate decision.
Open a Jira issue on the escalate branch with io.kestra.plugin.jira.issues.Create and store the ticket key back on the Aikido issue group as a note.
Feed the call chain from the reachability response into an AI agent to draft the fix, then attach the suggestion to the Slack message.
Widen the suppress branch to also require sla_remediate_by to be more than thirty days out, so nothing close to an SLA breach is ever auto-snoozed.
Add a weekly companion flow that lists snoozed issues about to expire so the backlog is reviewed on purpose rather than by surprise.
Swap the Slack escalation for io.kestra.plugin.pagerduty.alerts.Create when the finding is both reachable and actively exploited.

Triage Aikido Vulnerabilities by Reachability, Auto-Snooze Unreachable Findings and Page Only on Real Risk

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Triage Aikido Vulnerabilities by Reachability, Auto-Snooze Unreachable Findings and Page Only on Real Risk

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

IIS Site Provisioning with SSL Binding and Health Check

Security & Compliance, Detect and Alert on Infrastructure Configuration Drift with Ansible

Govern Security Exception Requests End to End, from Developer Request to an Auditable Aikido Snooze

IDM User Provisioning Request via Webhook with Retries

Patch an Actively Exploited CVE Across the Fleet with Ansible, Gated by Human Approval and Verified by Aikido

Ansible Scalability, Deploy Configuration Files to Multiple Servers at Scale

More AI Blueprints

AI Annual Report Finder and Data Strategy Summary

Generate and Send a Personalized AI-Powered Daily Digest Email Every Morning

Summarize Text with an AI Agent, Generate Multilingual Summaries in Short, Medium, or Long Format

Draft GDPR Breach Notifications for Supervisory Authorities and Data Subjects

AI Document Data Extraction: Parse PDFs and Web Pages into Structured JSON with OpenAI

Decide When to Take Action Using AI, Check Real-Time Weather and Trigger Automations

New to Kestra?