Chapter 3. Creating and managing remediation playbooks in Insights

Procedure

1. Navigate to Security > Vulnerability > CVEs.

2. Set filters if needed (for example, filter to see CVEs with security rules to focus on issues that have elevated risk associated with them). Or, click the CVEs with security rules tile on the dashbar. Both options show in the example image.

   

3. Click a CVE in the list.

4. Scroll to view affected systems, and select systems you want to include in a remediation playbook by clicking the box to the left of the system ID on the Review systems page. (Selecting one or more systems activates the Remediate button.)

   Note

   Recommended: Include systems of the same RHEL major or minor version by filtering the list of affected systems.

5. Click Remediate.

6. Decide whether to add the remediations to an existing or new playbook by taking one of the following actions:

   • Choose Add to existing playbook and select the desired playbook from the dropdown list, OR
   • Choose Create new playbook, and add a playbook name. For this example, HCCDOC-392.
7. Click Next. A list of systems shows on the screen.
8. Review the systems to include in the playbook (deselect any systems that you do not want to include).

9. Click Next to see the Review and edit actions page, which shows you options to remediate the CVE. The number of items to remediate can vary. You will also see additional information (that you can expand and collapse) about the CVE, such as:

   • Action: Shows the CVE ID.
   • Resolution: Displays the recommended resolution for the CVE. Shows if you have alternate resolution options.
   • Reboot required: Shows whether you must reboot your systems.
   • Systems: Shows the number of systems you are remediating.

10. On the Review and edit actions page, choose one of two options to finish creating your playbook:

    • Option 1: To review all of the recommended and alternative remediation options available (and choose one of those options):

      1. Select Review and/or change the resolution steps for this 1 action or similar based on your actual options.

1. Click Next.

2. On the Choose action: <CVE information> page, click a tile to select your preferred remediation option. The bottom edge of the tile highlights when you select it. The recommended solution is highlighted by default.

   

3. Click Next.

   • Option 2: To accept all recommended remediations:

     • Choose Accept all recommended resolutions steps for all actions.

   

   1. Review information about your selections and change options for autoreboot of systems on the Remediations review page. The page shows you the:

      • Issues you are adding to your playbook.
      • Options for changing system autoreboot requirements.

      • Summary about CVEs and resolution options to fix them.

         +
        image:img-remedy-remediation-review-summary.png[summary of remediation actions]

   2. Optional. Change autoreboot options on the Remediation review page, if needed. (Autoreboot is enabled by default, but your settings might vary based on your remediation options.)
   3. Click Submit. A notification displays that shows the number of remediation actions added to your playbook, and other information about your playbook.

Verification step

1. Navigate to Automation Toolkit > Remediations.
2. Search for your playbook.
3. To run (execute) your playbook, see Executing remediation playbooks from Insights for Red Hat Enterprise Linux.

Procedure

1. Navigate to Automation Toolkit > Remediations.
2. Locate the playbook you want to manage and click on the name of the playbook. The playbook details are visible.
3. Click the Download playbook button to download the playbook YAML file to your local drive.

Procedure

1. Navigate to Automation Toolkit > Remediations.
2. Locate the playbook you want to archive.
3. Click on the options icon (⋮) and select Archive playbook. The playbook is archived.

Procedure

1. Navigate to Automation Toolkit > Remediations.
2. Click the More options icon that is to the right of the Download playbook button and select Show archived playbooks.

Procedure

1. Navigate to Automation Toolkit > Remediations.
2. Locate and click on the name of the playbook you want to delete.
3. On the playbook details page, click the More options icon and select Delete.

Procedure

1. Navigate to Automation Toolkit > Remediations. The page displays a list of remediation playbooks.
2. Click on the name of a playbook.
3. From the Actions tab, click any item in the Status column to view a pop-up box with the status of the resolution.