Prioritize and act on remediations

Remediation Hub provides a central location for recommended remediation actions on risks and vulnerabilities across your hybrid environment, so you can focus and prioritize your efforts on the most impactful changes and improve your overall security posture.

Requirements

To access Remediation Hub, you must have at least one of the following roles:

  • Vulnerability Management - any role

  • Attack Surface Management - Admin

If you also have a Cloud Security Domain Admin or Domain Viewer role, you can also see Cloud Security remediations.

Remediation Hub is scoped to your permissions

You can only see remediations for the assets you can access. For example, if you only have a Vulnerability Management role, you only see Vulnerability Management remediations.

To populate Remediation Hub with data, you must have already set up at least one of the following modules:

Third-party vulnerability and remediation support

Remediation Hub can report vulnerabilities and remediations from third-party sources when the corresponding Attack Surface Management connector is installed. Supported connectors include:

  • Amazon Inspector

  • Claroty xDome

  • Dragos Vulnerability

  • ManageEngine Endpoint

  • Orca

  • Qualys Vulnerability Management Detection & Response (VMDR)

  • Red Hat Insights

  • SentinelOne

  • Tenable (Tenable.io)

  • Tenable Security Center (SC)

  • Wiz

Review emergent threats

Rapid7’s security research team actively monitors and researches emergent threats. Rapid7’s Emergent Threat Response delivers fast expert analysis and first-rate security content for the highest priority security threats to help you understand your exposures and act quickly to protect your assets from exploitation. When an emergent threat is active, Remediation Hub displays a banner at the top of the page.

This banner:

  • Indicates that Rapid7 teams are actively responding to the threat

  • Links to a Rapid7 blog post with ongoing updates

  • Provides visibility into associated CVEs and impacted assets as more data becomes available

Emergent threats are displayed for 14 days. If no emergent threat is active, the banner is not shown.

Explore remediations

You can monitor the potential impact of the top 25 remediations using the key metrics, including:

Metric Description
Vulnerability Findings Remediated The number of vulnerability findings expected to be remediated if the top 25 remediations are implemented.
Assets Updated The number of assets that would be updated if the top 25 remediations are implemented.

Each risk or vulnerability in your environment is paired with a suggested action for remediation in the Remediations table, which is initially sorted by risk score. You can use filters to narrow your view of the results shown in the table.

To filter the Remediations table:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Optionally adjust the columns or row density:

    1. Select Columns, then search and select columns to display in the table.

    2. Select Density and then a type to control how large the results table rows are.

  3. Select Filters.

  4. Select a Criteria to filter on, then select an Operator and Value.
    Note: Some criteria are for filtering remediations specific to Vulnerability Management or Cloud Security.

  5. Select Add Filter to add another filter.

  6. Select Apply.

Special filters

Some filters, such as Reboot Required (Patch Management) or Patch Management, are based on asset-level conditions. As a result, the Remediations table may not visibly change, even when a filter is applied. To confirm how a filter affects results, open a remediation and go to the Impacted Assets tab.

If you have endpoint protection or patch management software connected to Attack Surface Management, you can filter on either of these to quickly find remediations that rely on your existing mitigation controls. Review Assess endpoint protection and patch management coverage for more information.

Investigate remediation details

The remediation details panel hosts an AI summary for the remediation, the assets impacted by the remediation, the specific vulnerabilities mitigated by the remediation, access to Automation remediation action capabilities, and more.

To open remediation details:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Select a remediation from the table to open the details panel.

Rapid7 offers an AI-generated summary of a remediation to help you assess remediation impact and risk. The AI overview:

  • Summarizes criticality, exploitability, and potential impact of the CVEs detected in the environment

  • Highlights risks of not applying the remediation

  • Incorporates business context, such as asset tags and affected systems, to help your security teams understand the operational complexity involved

  • Provides actionable recommendations and next steps for effective implementation

Use the icons at the bottom of the AI Overview panel to send Rapid7 feedback about this feature. This helps Rapid7 monitor quality and improve the feature over time.

Rapid7's data protection policy

The Remediation AI Overview is generated from data already available in Remediation Hub and Rapid7's vulnerability intelligence. Rapid7 does not use any customer data for training or fine-tuning our large language models (LLMs). We also don't share your data with any third-party LLMs for their training purposes. If you would prefer to opt out of AI usage, contact Rapid7 Customer Success or Support.

Each remediation has impacted assets and associated vulnerabilities. Asset and vulnerability information comes directly from Cloud Security and Vulnerability Management.

Asset counts may vary

Due to data synchronization timing, asset counts may vary between Remediation Hub, Cloud Security, and Vulnerability Management.

To explore impacted assets:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Select a remediation from the table to view its details.

  3. From the remediation details panel, select the Impacted Assets tab.

  4. Optionally, adjust the results table:

    1. Select Columns, then search and select columns to display in the table.

    2. Select Filters, then adjust the Criteria, Operator, and Value to narrow the results.

    3. Select Density and then a type to control how large the table rows are.

  5. Select Proof for an asset to reveal additional details.

  6. If the asset is available in Attack Surface Management, Cloud Security, or Vulnerability Management, select Actions and choose one of the following:

    • View Asset - Opens the asset in Vulnerability Management or Cloud Security (depending on if it's an On-Prem or Cloud remediation).

    • View Attack Surface - Opens the asset in Attack Surface Management.

To explore vulnerabilities:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Select a remediation from the table to view its details.

  3. From the remediation details panel, select the Vulnerabilities tab.

  4. Optionally, adjust the results table:

    1. Select Density and then a type to control how large the results table rows are.

  5. Optionally, select Actions and View Vulnerability to open Vulnerability Management.

If you have mitigation controls, like endpoint protection or patch management tools, connected to Attack Surface Management, Remediation Hub displays their status next to your impacted assets.

To assess endpoint protection and patch management coverage for an asset:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Select a remediation from the table to view its details.

  3. From the remediation details panel, select the Impacted Assets tab.

  4. Optionally, adjust the results table:

    1. Select Columns, then search and select columns to display in the table.

    2. Select Filters, then adjust the Criteria, Operator, and Value to narrow the results.

    3. Select Density and then a type to control how large the table rows are.

  5. Review the Endpoint Protection and Patch Management columns. These columns use the following statuses to indicate whether the control is detected for the asset:

Status Description
Available

A supported Attack Surface Management connector confirms the mitigating control for the asset.

Endpoint Protection: An endpoint protection connector reports MITRE ATT&CK mitigation M1040 or M1049 for the impacted asset. You can also hover over the status to see any available MITRE ATT&CK framework mitigation details.

Patch Management: A patch management connector is available for the asset.
None

The asset exists in Attack Surface Management but no connector reports the mitigating control.

Endpoint Protection: No connector reports MITRE ATT&CK mitigations M1040 or M1049 for the asset.

Patch Management: No patch management connector is associated with the asset.
Unknown

The asset was not found in Attack Surface Management, so the Command Platform cannot determine whether patch management or endpoint protection controls are available. This may occur when Attack Surface Management is not enabled or the asset exists in another source (for example, Vulnerability Management) but has not been discovered by or synced into Attack Surface Management yet.
Reboot Required

Patch Management only. The asset requires a reboot before the Command Platform can retrieve the latest control status.

You can act on a remediation directly by running an Automation workflow to drive faster, more consistent remediation, such as creating a Jira ticket or ServiceNow incident, across your assets.

To run an automated remediation action:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Add filters as needed.
    Note: Automated remediation actions currently support up to 10,000 assets. If the selected remediation contains more than 10,000 assets, you need to add filters before you can run the workflow.

  3. Select a remediation from the table to view its details.

  4. Select Send to Workflow to open a panel containing Automation workflows.

    Want more workflows?

    You can download more workflows from the Extension Library (select Open Extension Library) or you can create them in Automation. Workflows can only be used in Remediation Hub if they have the Remediation Hub trigger. To learn more about creating and managing workflows, review Workflows.

  5. Select a workflow with the Remediation Hub trigger.

  6. Select Run.

To view automation log, artifact, and output history:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Add filters as needed.

  3. Select a remediation from the table to view its details.

  4. Select the Automations value to open a list of automations that have run for this remediation.

  5. Find a workflow you want to review.

  6. Select View Details next to the workflow to review information, logs, artifacts, and outputs for that workflow.

Export and report on remediations

You can export or report on remediations to share clear, actionable remediation guidance with asset owners in your organization. There are a couple different ways to share your remediations and impacted assets outside of Remediation Hub:

  • As a CSV file

  • As a scheduled report, which can be an HTML, CSV, or PDF report

One report in Remediation Hub can convey your full attack surface without having to return to Vulnerability Management, Cloud Security, and Attack Surface Management to generate similar results.

To export the top 25 remediations as a CSV:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Add filters as needed.

  3. Select Export to download the top 25 remediations in the current view.

To export impacted assets:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Add filters as needed.

  3. Select a remediation from the table to view its details.

  4. Select Export > CSV.

To create a scheduled top 25 remediations report:

  1. From Command Home, go to Risk > Remediation Hub.

  2. Add filters as needed.

  3. Select Create Report.

  4. Choose a report type and select Open:

    • Top Remediations Summary - See the top 25 remediation actions from your current filters that reduce the most risk. Use this report to prioritize fixes based on their overall impact.

    • Top Remediations Summary with Assets - See the top 25 remediation actions from your current filters that reduce the most risk, including the affected assets for each action. Use this report to identify where to apply each fix.

  5. Optionally, adjust the report name and description.

  6. Select at least one format: HTML, PDF, or CSV.

  7. Optionally, update the Scheduling:

    • To generate a report now, turn on Trigger report on save.

    • To generate the report on a recurring schedule, select Add Schedule.

      1. Select the new schedule entry.

      2. Select a start date for the report.

      3. Enter a repeat timeframe. For example, repeat every 3 days.

      4. Enter a time to generate the report.

      5. Configure when the report should end (never or a select date).

      6. Select users or email addresses that you want to share the reports with.

    • Optionally, select Add Another Schedule to add a separate schedule.

  8. Select Create.