VulnWhisperer will download reports from the tool of your choice (currently nessus or qualys) using their API. Once the report is downloaded the data is read, normalized and written to disk. There are logstash files created for each file format that consume the new file, which can be setup to tag your critical assets, compliance data (HIPAA, PCI, etc).
Since VulnWhisperer downloads all historical scans, you can track when assets had critical vulnerabilities and when they were remediated using the swimlane in the middle. Users can also track risk over time.
So while it doesn't allow for a user to input their own remediation time, it does organically show you when an assets risk score changed from a 10 to a 5. That transition is an indicator the vulnerability has been mitigated. The challenging part is it will only show you when the last scan ran and not the time a patch was applied.
Check out VulnWhisper at Github here - https://github.com/austin-taylor/VulnWhisperer
