Generating AI-powered remediation guidance

Edit online

Generate AI-powered remediation guidance for a CVE to understand the recommended fix, affected package, and remediation approach for each finding. You can use the generated guidance to plan remediation work before opening a ticket or updating the assessment state.

For example, a DevOps engineer supporting a public-facing healthcare application might need to respond to a high-priority CVE that affects an open source package in a deployed container image. Before assigning remediation work, the engineer can use AI-generated guidance to understand the recommended mitigation strategy, identify the affected package and fixed version, and ask follow-up questions about upgrade impact, workarounds, or dependencies. This guidance helps the team move from vulnerability identification to remediation planning with clearer technical context.

About this task

Draft comment:
Hey @Seymone - Is there any specific pre-reqs for executing this task for the user? If yes, can you please let me know
Concert uses AI to generate remediation guidance for vulnerability findings. The generated guidance can help you understand:
  • The recommended mitigation strategy for the selected finding
  • The affected package and package path
  • The fixed version, when available
  • The digest and scan source associated with the finding
  • The exploit or remediation context available for the CVE

You can review AI-generated information from the CVE details page and from the expanded finding details. Review the generated guidance before you use it to make remediation decisions.

Procedure

  1. From the navigation menu, go to Protect > Dimensions > Vulnerability
  2. Click the CVE ID for which you want to generate remediation guidance.
  3. On the CVE details page, review the Overview tab.
  4. Review the AI-generated insight sections. The CVE overview can include:
    • Detailed attack vector explanation
    • Active exploit and remediation
  5. If guidance is not generated yet, click Generate with watsonx. If guidance is already generated, click Regenerate with watsonx to refresh the response.
  6. Optional: Click the AI icon in the global header to open the AI chat panel and ask specific questions about the CVE.

    You can ask questions such as:

    • “How can this CVE be exploited?”
    • “What is the safest fix?”
    • “What packages need to be updated?”
    • “Are there any workarounds available?”
    • “What is the recommended version to upgrade to?”
  7. Review the AI-generated response. The response can provide:
    • Step-by-step remediation instructions for the CVE
    • Package update recommendations
    • Recommended fixed versions
    • Configuration changes, if applicable
    • Additional context about exploitation potential and remediation impact
  8. Optional: Ask follow-up questions to clarify the remediation guidance.

    For example:

    • “What are the risks of applying this fix?”
    • “Will this fix require a system restart?”
    • “Are there any dependencies I need to consider?”
  9. Click the Blast radius tab to understand how the CVE is connected across affected packages, build artifacts, applications, and environments.
  10. To review finding-level remediation guidance, go to Inventory > Applications, select an Application, select the Version, and click CVE findings.
  11. Locate the CVE finding that you want to review. You can use Find or the table filters to narrow the results.
  12. Expand the finding to review the recommended mitigation strategy.
  13. For each finding, you can review information such as:
    • Package
    • Fixed in
    • Age (days)
    • Priority
    • Risk score
    • Environmental factor
    • Scan sources
    • Scan type
    • Assessment state
    • Ticket

    Use this information to understand the suggested remediation approach for the selected finding before you create a ticket or update the assessment state.

Results

You now have AI-generated remediation guidance for the CVE and its associated findings. This guidance helps you:
  • Understand the recommended remediation approach for the selected CVE.
  • Identify the affected package and package path.
  • Review fixed version information when it is available.
  • Capture remediation context before creating a ticket.
  • Decide whether to update the assessment state or assign remediation work
  • Review finding-level mitigation guidance from the application version CVE findings table.

What to do next

After reviewing the remediation guidance, you can:
  • Create a ticket in your external issue tracking system.
  • Update the assessment state for the finding.
  • Share the remediation guidance with the application or development team.
  • Track remediation progress and verify that the vulnerability is resolved after the fix is applied.