Build an end-to-end vulnerability monitoring and response pipeline for a security team. The goal: automatically watch for newly exploited/reported vulnerabilities, enrich and triage each CVE with AI, open a tracking incident with a consistent SOP, and let operators review everything and trigger approval-gated remediation from a dashboard. Triggers (three ingestion sources, all feeding one shared enrichment path): A daily scheduled step that monitors the CISA Known Exploited Vulnerabilities (KEV) catalog and diffs the feed to detect newly added CVEs. An inbound webhook that receives forwarded vulnerability report emails (weekly/monthly digests) and extracts the CVEs from them. A daily scheduled step that polls a mailbox folder for vulnerability report emails — use Microsoft 365 / Microsoft Graph, or your team's email/mailbox provider. Have it degrade gracefully (simulation/stub) until the mail connector is wired up. Each source should normalize its findings into a common shape (a source label plus a list of CVE IDs) so the rest of the pipeline is source-agnostic. Core flow: An enrichment and triage step that, for each CVE, pulls severity data from the NVD (CVSS) and calls an LLM — use Anthropic Claude, or your preferred model provider — to produce a plain-language summary, a recommendation, an "auto-remediable" flag, a derived priority, and a consistently formatted remediation SOP. A step that opens/updates a tracking incident — use ServiceNow, or your team's ticketing/ITSM tool — deduping so each CVE gets one ticket, and flagging auto-remediable CVEs for approval. Let it run in simulation mode until the ticketing connector is connected. A remediation endpoint that executes (or, until a real automation target is wired in, simulates and logs) the fix once approved. State and UI: Persist all CVEs, their enrichment, ticket links, and remediation status in shared persistent storage (e.g. a SQLite volume) so state survives across runs and sources. Expose a data endpoint that serves this state, and build an operator dashboard (a web page) where the team can review triaged CVEs, see incidents, and trigger remediation for approved items. Keep routes private/authenticated by default; the report-email webhook can use an unguessable external ID. Make sure the whole pipeline and dashboard work end to end even before ServiceNow and the mailbox provider are connected, by stubbing those integrations. Tools used: CISA KEV catalog, NVD (NIST) CVE/CVSS API, Anthropic Claude, ServiceNow, Microsoft 365 / Microsoft Graph, SQLite