DataBee Remediation Actions

Introduction

DataBee Remediation Actions is a feature designed to empower organizations by automating their response workflow and IT operations challenges. This feature enhances response efficiency by allowing users to create automated actions based on specifically crafted data queries within the DataBee platform. These actions can generate ServiceNow tickets tailored to predefined criteria, reducing manual effort and speeding up resolution times.

The queries driving these remediation actions can be executed against various data tables, such as a CDP (Core Data Product), OCSF or CCM (Continuous Controls Monitoring) table, offering flexibility in how organizations leverage their data to trigger automated responses.

Key Features

• Automated Response Actions: Automatically generate ServiceNow tickets based on custom data queries.

• ServiceNow Integration: Seamlessly connect with ServiceNow ITSM to create and manage tickets.

• Scheduling Capabilities: Define specific days and times for remediation actions to run automatically.

• Action Management: Gain a comprehensive view of all configured actions, including their connection details, schedules, severity levels, and statuses.

How It Works

The DataBee platform processes data from multiple sources, normalizes it, and transforms it into actionable outcomes. The data flow pipeline consists of the following steps:

1. Data Collection:

   1. Sources: Data is gathered from systems like Quali's vulnerability scanner (security vulnerability data), ServiceNow CMDB (asset and application management), and Workday (user and organizational data).

2. Real-Time Processing:

   1. Collected data is processed in real time and normalized into a unified schema.

3. Remediation Action Configuration:

   1. Create a Remediation Action based upon a DataBee query. Records that match the query, will be sent to the output.

4. Outputs:

   1. Ticket Creation: Automated generation of ServiceNow tickets for incidents or IT operations requiring attention.

This automated workflow minimizes manual processes, accelerates response times, and strengthens organizational security and operational efficiency.

Setup Instructions

Follow these steps to configure a remediation action in DataBee:

Example Use Case

Imagine you need to automatically notify a team member, Mike, about vulnerabilities requiring remediation. Here’s how DataBee Remediation Actions can help:

• Scenario: Create a ServiceNow ticket for vulnerabilities with a compliance_status = false and assigned to Mike.

• Setup:

  • Query: Define a query like compliance_status = false AND owner = 'Mike'.

  • Ticket Details:

    • Incident Title: "Vulnerability Remediation Required"

    • Incident Description: "Vulnerability Category, Affected Asset: [Asset Types]"

  • Schedule: Run daily at 9:00 AM.

• Outcome: Mike receives a ServiceNow ticket each day listing vulnerabilities he owns that need attention, streamlining the remediation process.

Managing Remediation Actions

Once actions are configured, you can monitor and manage them within the DataBee console:

• Action Overview:

  • Navigate to the Actions page for a holistic view of all remediation actions.

  • Review details such as the assigned connection, schedule, severity, and current status.

  

• Action History:

  • Click the History button for any action to access a detailed history table.

  • View information including:

    • ServiceNow ticket numbers generated.

    • Number of records attached to each ticket.

    • Error details (if any) from previous runs.

  • Use filtering and search options to analyze specific actions or runs.

  

This visibility ensures you can track the performance and effectiveness of your automated responses.

Conclusion

DataBee Remediation Actions offers a robust solution for automating response and IT operations tasks. By integrating with ServiceNow and utilizing data-driven queries, it reduces manual workloads, enhances efficiency, and helps organizations maintain a proactive stance on security and operational management. We hope this documentation equips you to fully leverage this feature for your organization’s needs.