Overview
Cloud Autofix helps users identify and remediate supported cloud security findings directly from Zero-X Cloud. Instead of manually opening the cloud provider console and changing the configuration, Cloud Autofix provides a guided workflow to review the finding, simulate the proposed change, execute the remediation, and monitor the result. The typical workflow is:How to Use Cloud Autofix
Step 1: Open Cloud Autofix
- Sign in to Zero-X Cloud.
- Open the Cloud Autofix module.
- The Fix Available Findings tab is displayed.
- Review the available findings.
Step 2: Locate the Finding
Use the available filters to find the security issue you want to remediate. Available filters may include:- Filter by Date
- Categories
- Accounts
- Cloud Resource
- Severity
- Resource Types
- Compliance
- Region
- Search to find a specific finding or resource.
- Columns to customize the displayed columns.
- Saved Views to save frequently used filter configurations.
- Grouping to organize findings.
Step 3: Review the Finding
Before executing any remediation:- Review the finding description.
- Verify the affected resource.
- Check the cloud provider.
- Check the resource type.
- Review the risk score.
- Review the severity.
- Confirm that the finding is appropriate for remediation.
Step 4: Open AutoFix
- Locate the required finding.
- Click AutoFix.
Remediate Finding
The Remediate Finding screen contains three main sections:Target Resource
This section identifies the resource that will be affected. It can display:- Resource ID or resource name
- Finding description
- Severity
- Cloud provider
- Resource type
- Severity: High
- Cloud Provider: AWS
- Resource Type: EBS Volume
Always verify the target resource before executing a remediation.
Available Actions
Depending on the finding, Cloud Autofix may provide the following actions:- Run Dry Run
- Execute Remediation
- Execute Rollback
Run Dry Run
What is a Dry Run?
A Dry Run simulates the remediation without applying the change to the live cloud resource. It allows you to review the expected action before making an actual change.Steps
- Open the required finding.
- Click AutoFix.
- Review the Remediate Finding page.
- Click Run Dry Run.
- Wait for the simulation to complete.
- Review the Dry Run result.
- Verify that the proposed change is expected.
Important
A successful Dry Run indicates that the remediation can be simulated successfully. It does not mean that the live resource has already been changed.Execute Remediation
What is Execute Remediation?
Execute Remediation applies the supported security fix directly to the target cloud resource. This action can make a live change.Before executing
Verify:- Correct finding
- Correct target resource
- Correct cloud account
- Correct region
- Correct resource type
- Expected remediation action
- Dry Run result, where available
Steps
- Open the required finding.
- Click AutoFix.
- Review the target resource.
- Run the Dry Run when available.
- Review the Dry Run result.
- Select Execute Remediation.
- Review the confirmation information.
- Confirm the remediation.
- Wait for the execution result.
- Review the execution logs.
Warning: Execute Remediation can modify a live cloud resource. Make sure the proposed change is approved before execution.
Execute Rollback
What is Rollback?
Execute Rollback is used to reverse a supported infrastructure change created by a previous remediation. Rollback availability depends on the remediation type.Steps
- Open the relevant remediation workflow.
- Select Execute Rollback.
- Review the rollback information.
- Confirm the rollback.
- Wait for the rollback execution to complete.
- Review the execution logs.
- Verify the resource and finding status.
Note: Not every remediation supports rollback.
Remediation Execution Logs
The Remediation Execution Logs tab provides a history of remediation operations. Use the logs to review:- Remediation action
- Target resource
- Execution status
- Execution time
- Execution result
- Error information
- Rollback activity
- Previous remediation attempts
Troubleshooting a Failed Remediation
If a remediation fails:- Open Remediation Execution Logs.
- Locate the failed execution.
- Review the error details.
- Verify the cloud account connection.
- Verify the required permissions.
- Confirm that the resource still exists.
- Run a Dry Run again, if available.
- Retry the remediation after resolving the underlying issue.
Finding Details
The Details option provides additional information about the finding and affected resource. Review the details before executing a remediation, especially for:- Critical findings
- Production resources
- Network-related findings
- Encryption findings
- Shared cloud resources
- Resources with dependencies
Playbook
The Playbook option provides remediation guidance associated with the finding. Use the Playbook to understand:- Why the finding was generated
- What security configuration needs to be changed
- What remediation action is proposed
- What impact the change may have
Remediation Process
- Open Cloud Autofix.
- Go to Fix Available Findings.
- Locate the EBS encryption finding.
- Click AutoFix.
- Verify the target resource.
- Click Run Dry Run.
- Review the simulation result.
- If the proposed change is acceptable, click Execute Remediation.
- Confirm the action.
- Monitor the execution.
- Open Remediation Execution Logs.
- Verify that the finding is resolved.
- Open the remediation workflow.
- Click Execute Rollback.
- Confirm the rollback.
- Review the execution logs.
- Verify the resource state.
Finding Status After Remediation
After remediation, the finding may move through different states depending on the execution and verification process.Dry Run Fails
Check the following:- Cloud account connectivity.
- Required permissions.
- Target resource availability.
- Cloud region.
- Remediation execution logs.
Remediation Fails
Follow these steps:- Open Remediation Execution Logs.
- Review the error message.
- Verify cloud permissions.
- Verify that the target resource still exists.
- Check the cloud account connection.
- Run the Dry Run again.
- Retry the remediation after resolving the issue.
Finding Is Still Visible After Remediation
A finding may remain visible until Zero-X verifies the updated cloud configuration. Check:- Remediation execution status.
- Finding details.
- Latest scan result.
- Remediation execution logs.
During Remediation
- Execute remediation only on the intended resource.
- Review the confirmation information.
- Monitor execution status.
- Keep track of important remediation operations.
After Remediation
- Verify the remediation result.
- Review execution logs.
- Verify the finding status.
- Check the cloud resource configuration when necessary.
- Confirm the finding does not reappear after the next scan.
Security Considerations
Cloud Autofix can make changes to connected cloud environments. Before executing a remediation:- Confirm the target resource.
- Understand the expected change.
- Review the Dry Run result.
- Verify the required cloud permissions.
- Follow your organization’s change-management process.
- Use additional caution for production resources.