DataBee Remediation Actions

Introduction

DataBee Remediation Actions is a feature designed to empower organizations by automating their response workflow and IT operations challenges. This feature enhances response efficiency by allowing users to create automated actions based on specifically crafted data queries within the DataBee platform. These actions can generate ServiceNow tickets tailored to predefined criteria, reducing manual effort and speeding up resolution times.

The queries driving these remediation actions can be executed against various data tables, such as a CDP (Core Data Product), OCSF or CCM (Continuous Controls Monitoring) table, offering flexibility in how organizations leverage their data to trigger automated responses.

Key Features

Automated Response Actions: Automatically generate ServiceNow tickets based on custom data queries.
ServiceNow Integration: Seamlessly connect with ServiceNow ITSM to create and manage tickets.
Scheduling Capabilities: Define specific days and times for remediation actions to run automatically.
Action Management: Gain a comprehensive view of all configured actions, including their connection details, schedules, severity levels, and statuses.

How It Works

The DataBee platform processes data from multiple sources, normalizes it, and transforms it into actionable outcomes. The data flow pipeline consists of the following steps:

Data Collection:
1. Sources: Data is gathered from systems like Qualys vulnerability scanner (security vulnerability data), ServiceNow CMDB (asset and application management), and Workday (user and organizational data).
Real-Time Processing:
1. Collected data is processed in real time and normalized into a unified schema.
Remediation Action Configuration:
1. Create a Remediation Action based upon a DataBee query. Records that match the query, will be sent to the output.
Outputs:
1. Ticket Creation: Automated generation of ServiceNow tickets for incidents or IT operations requiring attention.

This automated workflow minimizes manual processes, accelerates response times, and strengthens organizational security and operational efficiency.

Setup Instructions

Follow these steps to configure a remediation action in DataBee:

Setting Up ServiceNow Integration

To integrate ServiceNow with DataBee, follow these steps:

Log In: Access the DataBee console.
Access Settings: Click the gearbox icon (configuration settings) in the top right corner.
Navigate to Integrations: In the System settings, select the Integrations tab on the left.
Select ServiceNow: Click the ServiceNow ITSM integration card.
Configure OAuth: Enter the OAuth configuration details for your ServiceNow instance.
Test Connection: Click Test connection to verify the setup.
Save: If successful, click Submit to save the configuration.

Creating a Remediation Action

To create a new remediation action, follow these steps:

Navigate: Go to the Compliance menu and select the Remediation Actions tab under Workflows.
Create New Workflow: Click the Add Workflow button.
Choose Workflow type: click on Choose Remediation Action Workflow.
Note:
You can also access the “Create Workflow” page by navigating to Data > Data Quality Alerts > Add Workflow.
Create New Remediation Action Workflow: Fill in the fields with suitable data.
- Name: provide a suitable name for the workflow.
- Description: provide a description for the workflow.
- Severity: select the severity ranking for the workflow from the drop-down list.
- Schema: select the source schema of query from the drop-down list.
- Table: select the source table of query from the drop-down list.
- Query: configure the query by adding suitable parameters and selecting the appropriate filters. Click Reset to revert the parameters to their default state.
- Query: Alternatively, use a saved query that was previously configured.
- Schedule: There are two ways to define the schedule for the workflow to run - Daily or Monthly. The Daily scheduling allow “day of the week” scheduling. The Monthly scheduling provides flexibility to schedule on several dates of every month.
- Output: select the ServiceNow integration from the drop-down. Provide an Incident Title, Description. Add additional fields by appending it to the Additional Fields text box. For example, assignment_group, impact, urgency
  { "table": "incident", "assignment_group": "Application Development", "impact": "1", "urgency": "2"}
- Separate Tickets: Choose this option if a new ticket id should be created each time the event is triggered.

Save: Click Save to activate the remediation action workflow.

Example Use Case

Imagine you need to automatically notify a team member, Mike, about vulnerabilities requiring remediation. Here’s how DataBee Remediation Actions can help:

Scenario: Create a ServiceNow ticket for vulnerabilities with a compliance_status = false and assigned to Mike.
Setup:
- Query: Define a query like compliance_status = false AND owner = 'Mike'.
- Ticket Details:
  - Incident Title: "Vulnerability Remediation Required"
  - Incident Description: "Vulnerability Category, Affected Asset: [Asset Types]"
- Schedule: Run daily at 9:00 AM.
Outcome: Mike receives a ServiceNow ticket each day listing vulnerabilities he owns that need attention, streamlining the remediation process.

Managing Remediation Actions

Once the workflows are configured, you can monitor and manage them within the DataBee console:

Workflows Overview:
- Navigate to the “Manage Workflows” page for a holistic view of all remediation actions workflows.
- Review details such as the output, last run time and current status.
History:
- Click the History button for any action to access a detailed history table.
- View information including the source, output, and current status.
- Use filtering and search options to analyze specific workflows.
This visibility ensures you can track the performance and effectiveness of your automated responses.

Conclusion

DataBee Remediation Actions offers a robust solution for automating response and IT operations tasks. By integrating with ServiceNow and utilizing data-driven queries, it reduces manual workloads, enhances efficiency, and helps organizations maintain a proactive stance on security and operational management. We hope this documentation equips you to fully leverage this feature for your organization’s needs.