This is my first time where I have deployed/integrate the IVR Feature with Tenable IO and need assistance for auto remediation. The Vulnerability list is auto-populated in Web UI Console and also I am able to remediate those by creating a task from it.
My client is having below requirement from BigFix
- Tenable Vulnerabilities should get auto updated in the Patch Baseline.
- The created baseline should automatically run and remediated the desktop/laptop.
- Server related vulnerability should have some approval method before proceeding with deployment. ( Can it be achieved via Server Automation Feature)
No manual intervention is required to auto create/update the baseline for Tenable Vulnerability.
I am not able to figure out how this can achieved through BigFix. I had also reach out to support but they informed me that this requirement is not possible via BigFix.
Below is the revert from support team
It would be helpful if someone can guide me.
I'm not very familiar with the Tenable integration itself, so I can't comment on the vulnerability import process.
However, regarding the automatic creation and execution of remediation, there are a few options.
For workstation remediation, I'd recommend looking at the WebUI Patch Policy feature. It provides automated patch deployment for both internal and external content, and I believe the Tenable-mapped remediation Fixlets should also be available through it. Therefore, I don't think it's worth building custom automation just to create and execute baselines.
For servers, the process is usually different because most organizations require testing/validation, change management and approvals before deployment. If you're comfortable with the BigFix REST API, you can build an end-to-end automation that updates content, creates deployments, and integrates with email or ITSM approval workflows.
If you don't want to build your own automation using the REST API, another option is BigFix AEX. Although it's a separate product, it's sold as part of the BigFix portfolio. AEX provides agent-based workflow automation and can integrate with ServiceNow, allowing you to automate the full process, including approvals, deployment, and ticket closure.
Based on your requirements, I wouldn't focus on automatically updating baselines. Instead, I'd consider using Patch Policy or an orchestration solution such as REST API automation or AEX, depending on your organization's approval process.
Thankyou for reverting.
I configured and tested Patch Policy with Tenable-mapped remediation content. The policy successfully deployed the patches that were identified and included at the time the policy was created. However, it does not automatically incorporate newly discovered vulnerabilities into the existing Patch Policy/Baseline.
For example:
-
28 July: Tenable scan identified 200 vulnerabilities.
-
A Patch Policy/Baseline was created and executed to remediate those findings.
-
29 July: A subsequent scan identified 82 additional vulnerabilities.
-
These newly discovered vulnerabilities were not automatically added to the existing Patch Policy/Baseline.
My requirement is to have the existing remediation process dynamically include these newly identified vulnerabilities and execute them without having to manually update or recreate the Patch Policy/Baseline each time new findings are detected.
Based on this behavior, I'm trying to understand whether:
- There is a way to automatically update an existing Patch Policy/Baseline with newly discovered Tenable remediation Fixlets.
That's controlled by the Auto Refresh setting you've selected. You have three refresh options: Daily, Weekly, and Monthly. Choose the frequency that best fits your requirements, and the patch policy will automatically add new content based on that refresh schedule.
You'll also need to update the patch policy action schedule so that any newly added content is deployed through the new action as well.
1 Like
This is the current configuration and deployment status of my deployment. So the new content (including previous content) will automatically be applicable in next frequency cycle for the respective machine.
1 Like
