Auto-remediation using Concert Workflows

Edit online

Concert's auto-remediation feature helps you automatically detect and fix security vulnerabilities across operating systems, web servers, and container images. It identifies applicable fixes, creates remediation actions, and triggers patching workflows after the required approvals are received.

By using auto-remediation, you can proactively manage vulnerabilities, reducing the risk of security breaches and improving the overall security posture. Concert displays new vulnerabilities from loaded scan files and their potential impacts.

Concert also assists you with mitigation plans based on the available information about the newly discovered vulnerabilities, by using generative AI powered by IBM® watsonx.ai.

How auto-remediation works

After you upload a scan report, for example, from a Red Hat Enterprise Linux (RHEL) virtual machine, Concert analyzes the scan results and creates recommended remediation actions, such as installing specific OS patches. These actions are automatically submitted for approval through a GitHub pull request or a ServiceNow incident, depending on the action type. Once approved, Concert triggers the appropriate Concert Workflows to apply the patch and updates the action status in the UI. If a remediation action fails, you can retry the same action directly from the Concert UI without re-ingesting scan data or regenerating the action.

This end-to-end remediation process is managed by three Concert workflows:

  • Create_Change_Request_For_Remediation_Action generates approval requests (pull requests or incidents).
  • Monitor_Remediation_Action_Status polls the external tool, tracks approval status, and schedules patch execution.
  • Remediation_Master applies patches or performs upgrades on target systems (Linux, Windows, Tomcat, container images).

Concert provides a unified dashboard (Dimensions > Vulnerability) where you can monitor vulnerabilities, review remediation actions, and track progress across environments.