Methods and apparatus for remediation workflow

• US 9,304,850 B1
• Filed: 08/25/2014
• Issued: 04/05/2016
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark
• Primary Examiner(s): Kudirka, Joseph
• Application Number:
  US14/468,231
• Time in Patent Office: 589 Days
• Field of Search: 714/33, 709/223, 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/26 Functional testing
• CPC Class Codes: G06Q 10/0631 Resource planning, allocation, distributing or scheduling for enterprises or organisations

Abstract

Disclosed herein are methods, systems, and articles associated with remediation workflow. A method may include determining one or more test failures related to a policy test within a computer network, and reviewing the one or more test failures. The method may further include, based upon a result of the reviewing, creating a remediation work order that includes at least one of the one or more test failures. Each test failure within the remediation work order may be approved or denied. For each test failure that is approved for remediation, a remediation process may be executed.

Claims

1. A method comprising:

analyzing or facilitating analyzing, by a computing device, one or more test failures related to one or more policy tests within a computer network;

based upon a result of the analyzing of the one or more test failures, creating or facilitating creating, by the computing device, a remediation work order that specifies at least one of the one or more test failures;

reviewing or facilitating reviewing, by the computing device, each test failure specified within the remediation work order to approve or deny remediation for the test failure; and

executing or facilitating execution, by the computing device, for each test failure that is approved for remediation, a remediation process that corresponds to the particular test failure that is approved for remediation,

wherein the reviewing or facilitating reviewing comprises denying remediation for at least one of the test failures specified within the remediation work order and associated with a target host because the remediation would disable one or more security applications or needed business applications on the target host.

2. The method of claim 1, wherein the remediation process comprises one or more remediation scripts.

3. The method of claim 1, further comprising:

excluding or facilitating excluding, by the computing device, a test failure from the remediation work order.

4. The method of claim 1, further comprising:

upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

5. The method of claim 4, further comprising:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing, by the computing device, the remediation work order.

6. The method of claim 1, further comprising:

upon approving or denying each test failure within the remediation work order, deferring or facilitating deferring, by the computing device, to be remediated later, at least one test failure that is approved for remediation,

wherein upon completion of all remediation processes within a work order, transitioning or facilitating transitioning, by the computing device, the remediation work order to a complete state.

7. The method of claim 1, wherein the reviewing or facilitating reviewing comprises assigning one of the following available states to a respective test failure specified within the remediation work order:

(a) denied for remediation, (b) approved for remediation but deferred, or (c) approved for remediation.

8. The method of claim 1, wherein the reviewing or facilitating reviewing comprises assigning at least one of the test failures specified within the remediation work order and associated with a target host to a state of being approved for remediation but deferred, thereby facilitating accrual of multiple remediations for the target host and allowing the remediations for the target host to be performed together.

9. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the computer readable storage medium and configured to enable one or more computing devices, in response to execution of the programming instruction, to perform operations including;

obtaining or facilitating obtaining, one or more test failures related to one or more policy tests within a computer network;

creating or facilitating creating, a remediation work order that includes at least one of the one or more test failures;

approving or facilitating approving, at least one of the one or more test failure failures of the remediation order, for remediation; and

executing or facilitating executing, for each test failure that is approved for remediation, a remediation process that corresponds to a particular test failure that is approved for remediation,

wherein the reviewing or facilitating reviewing comprises denying remediation for at least one of the test failures specified within the remediation work order and associated with a target host because the remediation would disable one or more security applications or needed business applications on the target host.

10. The article of manufacture of claim 9, wherein the remediation process comprises one or more remediation scripts.

11. The article of manufacture of claim 9, wherein the operations further comprise:

excluding or facilitating excluding a test failure from the remediation work order.

12. The article of manufacture of claim 9, wherein the operations further comprise:

upon completion of all the remediation processes within a work order, transitioning or facilitating transitioning the remediation work order to a complete state.

13. The article of manufacture of claim 12, wherein the operations further comprise:

based upon transitioning the remediation work order to a complete state, closing or facilitating closing the remediation work order.

14. The article of manufacture of claim 9, wherein the reviewing or facilitating reviewing comprises assigning one of the following available states to a respective test failure specified within the remediation work order:

(a) denied for remediation, (b) approved for remediation but deferred, and (c) approved for remediation.

15. The article of manufacture of claim 9, wherein the reviewing or facilitating reviewing comprises assigning at least one of the test failures specified within the remediation work order and associated with a target host to a state of being approved for remediation but deferred, thereby facilitating accrual of multiple remediations for the target host and allowing the remediations for the target host to be performed together.

16. An article of manufacture, comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the computer-readable storage medium and configured to enable one or more computing devices, in response to execution of the programming instructions, to perform operations comprising;

in response to one or more policy test failures, generating a remediation work order specifying the one or more policy test failures;

for each of the one or more policy test failures specified within the remediation work order, approving or denying remediation of the test failure based on an application type for an application associated with the test failure; and

executing a remediation process for each of the one or more policy test failures that is approved for remediation,

wherein the approving or denying comprises denying remediation of a respective test failure because it is associated with an application being upgraded.