Remediation

Controlled remediation. Automatic rollback. Full audit trail.

Atomic transaction-safe remediation for security teams that cannot accept uncontrolled change execution.

The problem with most remediation tools

Most audit platforms identify what is wrong and stop there. When they do offer remediation, it is script execution without safety nets, no backup, no rollback, and no confirmation that the change worked. A failed fix applied to a production server at 2am is a worse outcome than the original finding.

How atomic remediation works

1. START TRANSACTION
   Create rollback point with configurable timeout (default: 5 min)

2. BACKUP
   Original files backed up with SHA256 checksums in manifest.json

3. APPLY
   Configuration changes applied. Services restarted if required.

4. VALIDATE
   Success -> COMMIT (backups retained for manual rollback)
   Failure -> AUTO-ROLLBACK (original files restored automatically)

Dead man's switch

Every remediation transaction has a timeout. If post-execution confirmation is not received within the configured window, the transaction automatically rolls back. Weekend emergencies from bad patches are prevented by design, not by process.

Access controls

✓SuperAdmin role required for remediation endpoints
✓Secondary auth token required for every remediation session
✓Remediation must be explicitly enabled in platform settings
✓Preview and dry-run mode before execution

Operator workflow

Verify host connectivity (SSH or WinRM test built into platform)
Unlock remediation with secondary auth token
Select fix from eligible fix catalogue
Run dry-run preview and review expected changes
Execute against selected host or canary group
Review execution history
Apply rollback if outcome is not compliant

API surface

✓POST /api/remediation/auth/unlock
✓POST /api/remediation/preview
✓POST /api/remediation/execute
✓GET /api/remediation/history
✓POST /api/remediation/rollback/<execution_id>
✓GET /api/remediation/fixes
✓GET /api/remediation/settings

What this toolkit has that most alternatives do not

Feature	This toolkit	OpenVAS	Nessus	Qualys
Atomic rollback	Yes	No	No	No
Auto-backup before change	Yes	No	No	Limited
Transaction timeout	Yes	No	No	No
Self-hosted deployment	Yes	Yes	No	No
Air-gap capable	Yes	Limited	No	No
Script-level audit trail	Yes	No	No	No

View Audit Admin Toolkit Arrange Evaluation