Remediation Path Rules - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

The Cortex Xpanse Active Response module automates ASM alert investigation and resolution. You can use Remediation Path Rules to customize Active Response to automatically respond to alerts with actions that meet your specific business requirements and context.

A Remediation Path Rule is associated with a set of conditions (an attack surface rule and alert criteria) and with a remediation action. When a new alert matches the remediation path rule conditions, the Active Response playbook performs the remediation action with no additional input required from an analyst.

When you create a remediation path rule, you will choose the attack surface rule the remediation path rule will apply to, define the specific alert criteria that must be met, and select a remediation action. The remediation actions that available to choose from will depend on the attack surface rule, the alert criteria, and the automation integrations in your system. See the Automated Remediation Capabilities Matrix for details about when fully automated remediation can be used.

For alerts that do not match a Remediation Path Rule, the Active Response playbook will prompt the analyst to +Provide Input about the remediation action.

You can view, create, and delete remediation path rules on the Policies and Rules → Remediation Path Rules page in Expander. You cannot edit existing remediation path rules. To delete a remediation path rule, right-click on the rule in the list view.