CyberFOCUS remediation flow

The CyberFOCUS Remediation Flow streamlines the process of addressing the most urgent security vulnerabilities (CVEs) quickly and efficiently.

From the CyberFOCUS dashboard, to initiate a remediation, complete the following steps.

1. Accessing the Remediate widget from CyberFOCUS dashboard

  1. From either the CISA KEV or MITRE APT tabs available in CyberFOCUS, select one or more CVEs. You can select CVEs either from the table or from the charts themselves. Once a CVE is selected the Remediate button becomes active.
    CyberFOCUS Remediation flow
  2. Click the Remediate button to open the Remediate widget.
    CyberFOCUS Remediate Wdiget

2. Congifure the remediation

To configure a remediation from CyberFOCUS, complete the following steps:

  1. Fixlets: The selected CVEs are auto filtered to fetch relevant Fixlets. You can modify the filter further as needed. For information on how to modify the filter, refer to Setting up remediation flow.

  2. Actions: You can review and update the actions for the set of Fixlets with default action and without default action.

  3. Devices: Relevant devices are automatically filtered. You can modify the filtering using a query and enable or disable dynamic targeting. Alternatively, you can select devices from the group or list to adjust the filtering.


    CyberFOCUS Remediation Flow
  4. Behavior: You can configure deployment options for the remediation from here.
    Remediate Flow Sequence

    • Start downloading immediately: Select this option to instruct the targeted BigFix Agents to download deployment files immediately regardless of the start time schedule. You can save time when working with large files or a tight maintenance window by completing this part of the job first.

    • Before running message: To display a message on target computers before the deployment runs, select this option and enter your message.

    • While running message: Select this option to display the message on targeted computers while the deployment is running.

    • Reboot/Restart devices on completion of deployment: Select this option to restart the computer after the action is run.

    • On failure, retry: Select this option to configure when to retry deployment on failure.

    • Reapply: Select this option to reapply the action. By default, whenever it becomes relevant again, you can reapply with 1-hour wait between attempts, up to 3 times. You can configure the wait time and the number of attempts as needed.

  5. Schedule: Configure start date and end date.

  6. Summary: Shows all the configured remediation flow settings. Provide a unique Deployment Name.

    Review the configurations and click Deploy to submit the action.

Result: A remediation deployment is created.

What to do next: Go to Deployment Managerand you can see the remediate deployment that was created. It also displays all the configured deployment settings. It shows the devices on which the deployment is being done, and the Fixlets that are deployed.