CyberFOCUS remediation flow

• All selected Fixlets are listed in a table with the columns Name, ID, Relevant Devices, Release Date, and CVE(s).
• To narrow the list to specific vulnerabilities, set Property to CVE and Operator to In, then enter the CVE identifiers. Each one appears as a chip under Selected Values, which you can remove individually.
• You can apply filters using Single condition or Multiple condition (Criteria: AND/OR) options to refine the Fixlet list. You can click on Reset Filters to clear filters. For more information, see Filter by query.

• Fixlet Table – Review the list of Fixlets.

• Select Fixlets – Use checkboxes to choose one or more Fixlets for remediation. A counter shows how many are selected.

• Next/Cancel – Click Next to continue to Actions, or Cancel to exit.

Actions - Review or update Fixlet actions. In this tab, confirm the actions you want the Fixlets you have selected to perform. This is important because not every Fixlet has a single, default action. It is also possible to remove Fixlets that do not have any actions that can be performed on the devices selected in the prior tab.

• The Actions step lists all selected Fixlets, with a status line above them such as 2 selected, 0 require attention.
• Action filter drop-down – Allows you to refine which Fixlets are shown in the list. Each option shows a count in parentheses. Available filter options:
  • All Fixlets – Displays all Fixlets in the remediation set.
  • Fixlets that are not actionable – Displays Fixlets that cannot be acted upon.
  • Fixlets with non-default action – Shows Fixlets that do not have a predefined default action.
  • Action required – Filters Fixlets that require immediate attention.

• Under Select actions, choose the appropriate radio button for the remediation:

  • Action 1: To apply the original updates.

  • Action 2: To apply the latest updates.

• Review the Fixlet attributes provided in the details pane to confirm accuracy. The attributes are Category, CVE(s), Download size, Release date, Severity, Source, and Source ID.
• A Fixlet for which you have not yet chosen an action shows a No action selected badge. Select an action for it before you continue.
• Each Fixlet has a toggle switch to enable or disable its deployment.
• Ensure the toggle switch next to the Fixlet is set to On.
• You can use Disable All or Reset All options as needed.
• Verify the deployment summary link at the bottom right, which reads Deploy 2 Fixlets to 2 applicable Device(s) once actions are selected.

Once this information is provided, click Next to proceed to the Devices tab.

Devices - This step allows you to confirm the devices for the deployment. Choose to deploy to all applicable devices or utilize various filters to narrow down the deployment size. Since filtering is optional, it is possible to skip this step by clicking Next. you select which devices will be included in the deployment. You have three main approaches:

1. Filter by Query
   1. You can apply filters using Single condition or Multiple condition (Criteria: AND/OR) options to refine the Fixlet list. You can click on Reset Filters to clear filters. For more information, see Filter by query.
   2. By default, the device table displays all devices that match the query, with the columns Device Name, ID, DNS Name, IP Address, and Last Report Time.
   3. Dynamic Targeting device Option:
      • Within this approach, you can enable the Dynamic Targeting Device toggle.
      • Dynamic filters define a matching criteria for devices to evaluate continuously until the deployment ends. Any device that matches this filter after the deployment has been created, will have this deployment applied.

      • New devices that match the criteria are automatically added.

      • A Preview of dynamically applicable targeted devices is shown to confirm eligibility.
2. Filter by Device group- Select a pre-defined device group to target.

   

   1. Locate and select your target groups:

      • Search: Use the search bar to type and quickly find specific groups by name.

      • Select: Check the box next to one or more groups under the Add new groups list.

      • Reset: Click Reset if you need to clear your current selections within the menu.

      • Click Apply within the dropdown menu to confirm your group selection.
3. Filter by Device List - This option allows to input a fixed list of devices where the deployment will be applied. Devices can be identified using their name, DNS, and IP address.

   

   1. Regardless of how they are identified, each device must be in a separate row.
   2. A maximum of 1,000 devices can be added in a single device list. If you intend to target more than 1,000 devices using device lists for filtering, create separate deployments.
   3. Use Verify List to confirm the entries before proceeding.
   4. The Preview area shows the final static list that will be targeted.
   5. Once the appropriate filters have been selected, or if no filter is needed, click Next.

Behavior - Some deployments can affect many devices simultaneously. The sequence tab provides you with control over deployment timing, display of alerts indicating Fixlet deployment availability for devices, and actions upon deployment completion. Note that selecting any of the provided options is not mandatory.

Offer to user: Enable this toggle to deploy the action as a BigFix "Offer".

When you enable this toggle, set the following options:

• Notify device owner of offer availability - Select this checkbox to alert the device owner when the offer becomes available.
• Title - Enter the title that identifies the offer to the user.
• Category - Enter the category that groups the offer in the self-service application.
• Description - Enter the text that explains what the offer does.

Under Order of Events (from top to bottom), the behavior tab presents the following controls in the order in which they take effect:

1. Start downloading immediately - Some Fixlets can contain large files. This option allows users to control whether all applicable devices should begin downloading the Fixlet as soon as the deployment is created.

2. Before running message - As a device may become unresponsive while a Fixlet is being deployed, this gives users the option to display a warning for an amount of time before the Fixlet is applied. This may also be useful if a restart is required, so end users can save work.

   Enable the toggle and set the following options:

   • Enter the message text to display to the user before the action runs.
   • In Notify user for, select how long the message is displayed (for example, 10 minutes), and in and then, select what happens when that time ends (for example, Run action immediately).
   • Allow user to save work - Select this checkbox to let the user save open work before the action runs.
   • Allow user to cancel - Select this checkbox to let the user cancel the action.
   • Show confirmation message before running action - Select this checkbox to prompt the user to confirm before the action runs. In Confirmation message, keep the default text or enter your own (for example, Are you sure you want to run this action now?).
3. While running message - As a device may be unresponsive while a Fixlet is being deployed, this allows users to write a message that will be displayed on the screen until the deployment is complete. Enable the toggle, and then enter the message text to display to the user.

4. Post deployment behavior - Enable this toggle to control what happens on the device after the action completes. Select one of the following options:

   • Do nothing after action completes - The device stays in its current state.
   • Restart computer after action completes - The device restarts when the action finishes.
   • Shutdown computer after action completes - The device shuts down when the action finishes.

   If you select Restart computer after action completes or Shutdown computer after action completes, configure the message shown to the user:

   • Message title (required) - Enter a short title (for example, Shutdown now).
   • Message text (required) - Enter the message body that asks the user to save any unsaved work.
   • In Notify user for, select how long the message is displayed (for example, 10 minutes), and in and then, select what happens when that time ends (for example, Shutdown automatically or Restart automatically).
   • Allow user to cancel shutdown or Allow user to cancel restart - Select this checkbox to let the user cancel the shutdown or restart.

5. On failure, retry - Occasionally, deployments fail to complete successfully on a device. Should this occur, this allows users to determine if they would like BigFix to automatically try the deployment again. Enable the toggle, enter the number of retries, and then select one of the following options:

   • and wait - Select this option and set the interval (for example, 1 hour) that BigFix waits between attempts.
   • Wait until computer has rebooted - Select this option to retry the action only after the device restarts.

6. Reapply whenever it becomes relevant again - This option automatically reapplies a Fixlet if it becomes relevant again after the initial deployment. Enable the toggle, and then set the following options:

   • with a - Select this checkbox and set the interval (for example, 1 hour) that BigFix waits between attempts.
   • up to - Select this checkbox and enter the maximum number of times (for example, 3) that BigFix reapplies the Fixlet.

After selecting the desired sequence, click Next to proceed to the schedule tab.

Schedule - not required. Determining a deployment’s start and end time gives BigFix users a tool to control their deployments. Typically, deployments do not happen immediately. Some devices may be powered down, or disconnected from the Internet, or otherwise unable to have the Fixlet applied. Scheduling allows to control how long BigFix will attempt this particular deployment.

There may be other reasons to control the end time. For example, an organization may wish to ensure that all deployments run overnight to minimize business impact.

• Time zone: Select Client to use the time zone where each device is located, or UTC.
• Start: Turn on this toggle and select the Start Date and Start Time when BigFix begins attempting to apply the deployment.
• End: Turn on this toggle and select the End Date and End Time when BigFix stops attempting to apply the deployment.
• If no start time is set, BigFix begins the deployment immediately.
• Reset changes returns the schedule to its default state.

Under Device schedule, select one of the following:

• Run on all devices respecting the maintenance windows if set - Runs on all targeted devices. Devices without a maintenance window run at the deployment start time.
• Run only on devices with a set maintenance window - Only devices that have a maintenance window set are eligible for deployment.
• Custom - Overrides the maintenance window and runs on the schedule you define below.

Selecting Custom enables these constraints:

• Time constraints: Specify the Start time and End time range when the deployment is allowed to run, for example 05:04 PM to 06:04 PM.
• Day constraints: Optionally, choose one or more days of the week to further limit deployment, for example only weekends or weekdays.

After selecting the desired schedule, click Next to proceed to the summary tab.

Summary - The summary tab shows all of the choices made related to the deployment created. This allows to review all of the things the deployment will do in one location.

• Add deployment name (mandatory): Enter a name for the deployment. This field is required.
• Assign tags: Optionally, search for a tag and select Add to assign it to the deployment. See Managing Tags.

Below these fields, the summary lists the start and end times, the number of Fixlets included, the number of devices targeted, and the download, retry, and behavior settings you chose.

After reviewing your selections, click Deploy.