Driving remediation with ticketing software
Create tickets for team members working outside Autobahn - so they can still play a key role in fixing vulnerabilities.
Assigned Workouts can be exported directly to ticketing systems like Jira, ServiceNow, Serviceware, or sent via email as a standard message. Each export includes the Workout’s remediation steps, along with detailed asset and issue information. You can tailor the scope of the export by choosing to include either the full set of affected items or a filtered selection based on tags. This is where tagging becomes especially valuable, helping you target the right teams with the right fixes.
Table of contents
- Integrate your ticketing system
- Manage your assets
- Review your issues
- Remediate with Workouts
- Next steps
1. Integrate your ticketing system
Autobahn offers the possibility of integrating a variety of ticketing systems: Jira, ServiceNow and Serviceware. Creating tickets from workouts will help you efficiently manage and address vulnerabilities identified via scans.
To learn how to do it for Jira, refer to this article.
2. Manage your assets
Tagging your assets is useful to manage them more efficiently. By doing so, you will be able to filter your Workouts easier, create custom dashboards, and also select which assets and issues are sent to ticketing systems. There are different tagging schemes you can use, for example:
- Location
- Team
- OS
- Network
What matters is that you use a tag (or multiple tags) that ultimately help you in the long run. You can also start with one type of tag, and expand it afterwards.
You can tag your assets from the Asset detail page or in bulk from the Assets page.
If you are using integrations from third-party tools, your tags will be carried over.
3. Review your issues
If you don't typically have asset owners in your organization - although we recommend having owners for assets because what gets owned, gets done - you can also tag and assign issues.
In the case of assigning an issue instead of an asset, the user will only be assigned to that specific issue on that specific asset and be able to see the Workout only for them.
Refer to this article to learn how to assign and tag issues.
What we often see is people assigning issues of a specific type (for example, all issues related to web browsers) to a specific team. In this case, we would recommend assigning but also tagging them - since that will make it easier to filter your Workouts.
4. Remediate with Workouts
Cyber Fitness Workouts are step-by-step guides which remediate the root cause of vulnerabilities, thereby closing multiple issues in one go. You can either access them from your Dashboard, or from the Workouts page.
In both the Dashboard and Workouts page, Workouts are sorted by the impact they have on your security posture (as measured by the Hackability Impact).
You can read more about the Workouts page in this article.
Clicking on a Workout opens a page with the workout's content (step-by-step instructions) as well as the list of affected assets which can be expanded to view the hosts' details as well as the detailed information about the findings (issues).
Tagging your issues and assets comes in handy when managing Workouts: you can filter your Workouts page based on tags, as well as the Setup tab, and it will allow you to select which assets to send to Jira.
You can send a Workout to e.g. Jira from the Workout list or the Workout detail page, by clicking on Send to Jira. You will be able to send either all assets, or only a selection of them. The fields displayed when creating a ticket follow the fields selected in your Jira projects.
The Workout PDF as well as the list of affected assets and open issues will be attached to the ticket. If you’ve customized the asset selection, only the selected assets will be included.
After finishing a Workout, there are multiple ways of labeling an issue as remediated:
- By labeling the issues from the Individual issues page
- By labeling the asset in the Workout details view
- By running a re-scan. If the asset and port are still reachable but the issue isn't found, it will be automatically be labelled as Remediated by the platform
5. Next steps
By now you should have:
✔️ Run at least one scan
✔️ Reviewed the results in your dashboard
✔️ Created a custom dashboard
✔️ Set up the integration with a ticketing system
✔️ Sent a Workout to a ticketing system to be picked up by the team
So what comes next? Repeating the steps again. It's important to run scans regularly to make sure that your issues are being properly remediated, and to keep an eye out for new issues.
Some tips and tricks
- Create custom dashboards for different teams - this way you can track remediation for each of them, compare their progress and see which one might need support;
- Make use of the "Risk Accepted" button. Not all issues are fixable, at least not with an unreasonable investment. If you can't fix something but are aware that it's there, make sure to quarantine your asset, report it, and then label the finding as Risk Accepted (learn how to apply the Issue Review feature to make sure someone always needs to accept risks).