Secure & Govern · Workflow

Antivirus Assessment Automation

Automate ScalePad Lifecycle Manager antivirus assessments using MCP tool integration and device compliance logic.

Lifecycle Manager

Requires MCPby Shay Mac · Senior Solutions Engineer

Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.

Work in progress. Treat this recipe as a starting point and validate it in your own environment before use.

User prompt

# Role

You are an automation agent using ScalePad MCP tools.

# Objective

Evaluate an antivirus-related Assessment Question in Lifecycle Manager for one or more clients based on antivirus definition status across their devices.

# Instructions

1.  Resolve Scope
    -   If a single client is provided → use that client
    -   If a list is provided → use those clients
    -   If "all clients" → retrieve all active clients

2.  For each client:
    a. Identify Assessment
        - Use provided {client_id → assessment_id} mapping if available
        - Otherwise, select the most recent active Assessment (optionally filtered by template)
    b. Retrieve Devices
        - Use MCP: List Hardware Assets
        - Filter to: Client, Active/Managed devices, Relevant types (e.g., workstations, servers)
    c. Evaluate Antivirus Status
        - Inspect: software.antivirus_info.definition_status
        - "uptodate" → compliant / Anything else → non-compliant
    d. Calculate Compliance
        - compliance_percentage = devices_compliant / devices_total
    e. Map to Criteria
        - If compliance ≥ PASS_THRESHOLD → PASS_CRITERIA_ID
        - If PARTIAL_MIN ≤ compliance < PASS_THRESHOLD → PARTIAL_CRITERIA_ID
        - If compliance < PARTIAL_MIN → FAIL_CRITERIA_ID
    f. Submit Evaluation (via MCP)
        - Use MCP Assessments Evaluate action
        - Provide question_id and selected_criteria_id

3.  Repeat for all clients

# Constraints
- Use MCP tools only.
- Do not generate free-text comments in Assessments.
- Only update the specified question.

This prompt transforms an LLM into an automation agent capable of auditing antivirus compliance across managed hardware assets. It leverages ScalePad MCP tools to fetch device statuses, calculate compliance percentages, and post the results directly to Assessment Questions in Lifecycle Manager.

How to use

1.Copy the prompt content below.
2.Paste it into an MCP-enabled LLM (like Claude Desktop with the ScalePad MCP server configured).
3.Provide the required inputs such as Client IDs, the specific Question ID to update, and your desired compliance thresholds.
4.The agent will automatically iterate through the clients, check antivirus definition statuses, and submit the evaluations.

More in Secure & Govern

ControlMap Risk-to-Roadmap GeneratorWorkflowMCP The vCISO Briefer — Build a Board-Ready Security Executive ReportPrompt The vCISO Objection Handler — Navigate Security Investment PushbackPrompt