InsightVM

Remediation Projects

Remediation projects allow teams to coordinate on the progress of remediation initiatives. It provides visibility into the responsibilities of security and IT teams so that they can easily track and measure the progress of remediation work.

Benefits of Remediation Projects

Remediation projects make it simpler to prioritize, drive, and track remediation progress by showing you the true state of the remediation. Project metrics are automatically updated as vulnerabilities are found not to exist any more, so that you can fully visualize the achievements of your remediation teams.

With remediation projects, you can:

  • Communicate relevant context and prioritizations to the right people.
  • Track the progress of remediation projects.
  • Identify the remediation work that teams are working on at a glance.
  • Automatically identify, assign, and monitor remediation progress.

Remediation Project Concepts

  • Remediation project - A remediation project is a group of solutions for vulnerabilities that need to be remediated on a specific set of assets within a certain time frame. When you create a remediation project, the Security Console applies an algorithm to identify solutions and aggregates the risk by solution to determine the remediation actions that will reduce the most risk.
  • Project owner - A project owner has the ability to create a project, identify the assets and/or vulnerabilities that are contained in the project, and assign the project to other users.
  • Project assignee - A project assignee is typically a remediation team member. Assignees review the solution steps and execute remediation for the specified assets and update the status of the solutions.

Create a Remediation Project

Open the Projects tab in your navigation menu. On the “Remediation Projects” screen, click Create a Project to start the project creation wizard.

TIP

You can also start the project creation wizard from the expanded view of applicable cards. See Cards to learn more.

  1. Provide your project with some basic information.
    • Ensure that your project name and description is purposeful and clear for your intended assignees.
  2. Specify the project scope.
    • Determine whether your project will be Static or Dynamic.
    • Use the Query Builder to define the project solution scope by loading an existing query or creating a new one.
    • Preview the included asset and vulnerability records by clicking under the "Project Scope" field.

What are the differences between static and dynamic projects?

Static projects lock asset and solution membership after you initially create them. Their scope cannot change unless you delete asset members from the Security Console. However, the solutions in a static project can add applicable assets as long as those assets were already project members. Static projects are commonly used for addressing specific asset and vulnerability groups.

Dynamic projects automatically add solutions as conditions change in your network. Unlike static projects, you can also modify the scope of a dynamic project after you create it. To help you visualize your progress, dynamic projects do not remove solutions as you remediate, but they will remove solutions if you elect to change the scope. Like static projects, dynamic project scope will also be affected if you delete asset members from the Security Console. Dynamic projects are commonly used for ongoing maintenance, such as the remediation of any assets that surpass a certain level of risk.

  1. Assign the project to members of your security team.
    • Expand the assignment dropdown to select one or more InsightVM users that will work on this project.
    • If desired, check the permission box to allow users without InsightVM credentials to access the project via email.
    • Determine what level of access your assignee(s) will have to the project details.
  2. Set a due date for the project.

Automated ticketing configuration

The following step will only appear in your project creation wizard if you have a configured ticketing integration already available for use.

See Ticketing Integration for Remediation Projects to learn how to configure a new ticketing integration.

  1. Review your project details.

Save and Complete the wizard when finished.

Viewing a Remediation Project

Click the Projects tab in the left navigation bar to access a list of remediation projects. You also have the option to view a list of projects immediately after creating a new project.

Each row represents an individual remediation project. Click on a project row to view expanded summary, solution, asset, and vulnerability information.

Click any project name to open it. The “Solutions” view will show overview details such as owner information, remediation steps, assets affected, and assignee information. Individual solutions can also be expanded to show additional details.

Only Global Administrators can create, edit, and close projects. Users in all other roles can only view projects to which they are assigned except for those user roles configured with the "Manage Sites" global permission or the "all sites" site access permission. Non-admin users with either of these permissions can view all projects.

Export Project and Solution data to CSV

Column data in both the Projects and Solutions pages can be exported to a CSV file.

To run an export:

  1. Select all desired projects (A) or solutions (B) by enabling their respective checkboxes.
  2. Click Export to CSV to download a CSV file.

Asset and vulnerability data can also be exported from the solution drawer:

  1. Click the desired solution row to open the drawer.
  2. Select the Vulnerability or Asset tab.
  3. Enable the checkbox of each desired row.
  4. Click Export to CSV to download a CSV file.

Assets listed in the solution drawer can be filtered by the following statuses:

  • All
  • Remediated
  • Unresolved

Remediation statuses

Here's an overview of the Remediation Projects workflow:

Automated ticketing for Remediation Projects

You can make your remediation projects more effective by automatically assigning work items to the team members responsible for mitigating exposures. For more information, see Ticketing Integration for Remediation Projects.

Updated 2 months ago


Remediation Projects


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.