Remediation
Atomic transaction-safe remediation for security teams that cannot accept uncontrolled change execution.
Most audit platforms identify what is wrong and stop there. When they do offer remediation, it is script execution without safety nets, no backup, no rollback, and no confirmation that the change worked. A failed fix applied to a production server at 2am is a worse outcome than the original finding.
1. START TRANSACTION
Create rollback point with configurable timeout (default: 5 min)
2. BACKUP
Original files backed up with SHA256 checksums in manifest.json
3. APPLY
Configuration changes applied. Services restarted if required.
4. VALIDATE
Success -> COMMIT (backups retained for manual rollback)
Failure -> AUTO-ROLLBACK (original files restored automatically)
Every remediation transaction has a timeout. If post-execution confirmation is not received within the configured window, the transaction automatically rolls back. Weekend emergencies from bad patches are prevented by design, not by process.
Not all findings should be remediated immediately. AuditToolkit provides multiple prioritisation lenses to guide remediation workflows:
Critical findings auto-prioritised; lower severity batched for regular maintenance windows. Prevents alert fatigue and focuses ops effort on actual risk.
Group findings by control family (Authentication, Encryption, Access Control, Logging). Remediate entire control families in themed maintenance windows.
Fix all findings for a single host in one remediation session, reducing operational touch-points and improving auditability of changes per asset.
Apply remediation to a small canary group first, validate compliance improvement, then roll out to the entire estate for safer large-scale fixes.
Schedule remediation for specific maintenance windows. Automatic tickets created in ITSM system (ServiceNow, Jira) with pre-filled change details.
Prioritise findings that show rapid spread across multiple hosts or control families, indicating emerging configuration drift or compliance regression.
Remediation happens in controlled workflows with clear ownership and audit trail:
Move remediation from manual execution to scheduled automation while maintaining safety and auditability:
Schedule recurring remediation for specific fix categories (e.g., "Run permission hardening every Sunday at 2am"). Automatic rollback on failure; results emailed to ops team.
Configuration audit findings can block pipeline merges. Integrate with GitHub Actions to run remediation workflows in lower environments before production deployment.
Automatically trigger remediation for specific fix categories immediately after audit runs. Configurable delay and manual override available for caution scenarios.
External systems can trigger remediation via webhook when specific conditions are met (e.g., "Run this fix when CVE CVSS is above 8.0").
Chain multiple fix scripts into runbooks. One control can trigger sequential changes across multiple systems with validation between steps.
CI/CD pipelines can require evidence of remediation before allowing code deployment (e.g., "SSL certificates renewed" before app push).
| Feature | This toolkit | OpenVAS | Nessus | Qualys |
|---|---|---|---|---|
| Atomic rollback | Yes | No | No | No |
| Auto-backup before change | Yes | No | No | Limited |
| Transaction timeout | Yes | No | No | No |
| Self-hosted deployment | Yes | Yes | No | No |
| Air-gap capable | Yes | Limited | No | No |
| Script-level audit trail | Yes | No | No | No |