Remediation target notification. Summary email?

[Lorenzo8]

Dear community, 

From the doc I can read that "A summary email, per remediation target rule, is sent when one or more vulnerable items are either approaching its remediation target date or the remediation target date has passed."

What does it mean exactly that a 'summary email' is sent? One of my concern is that users will receive 1 email for each VIT approaching the date. As we am implementing this for a large organization, users might be flooded with emails if this is the case. Does anyone have direct experience with this?

[andy_ojha · Accepted solution]

Hey there,

This is a good observation!

Can confirm, that the Notifications for VR Remediation Target Rules (in London, Madrid, and New York) -> are NOT sent to Remediation Users.  

Meaning, when Vulnerable Items and Vulnerability Groups -> are assigned to Remediation Teams and the Remediation Target Date is approaching a "breach" ... The Remediation Teams will not receive a Notification.

When you setup a Remediation Target Rule -> and configure the Notification Tab

- You are setting the explicit recipients of the notification, to a SN User, or members of a SN Group

- The Notification capability here, does not extend into sending Notifications about Remediation Target Dates breaching, to the users who are assigned either a Vulnerable Item or Vulnerability Group

As you've already pointed out, the amount of Notifications would be overwhelming.  There are some native Reports in the VR product that are more well suited for Remediation Users to see how they are tracking.

You can also build on your Reports for these users to see where they stand on Vulnerable Items and Vulnerability Groups - e.g. Show me my Critical Vulnerable Items, that are Approaching a Target Date "breach" or have already "breached" their Target Date.

---------------------------------

For the "Summary email" -> it essentially is one Notification, per Target Rule that you have configured with the Notification recipients filled out (i.e. not empty).  The Email contains a URL Link, that will take the user to a list of Vulnerable Items -> which have breached their Target Remediation Date -> for a particular Target Remediation Rule...

---------------------------------

You can look at configuring the "Notify (Days before due)" - while leaving the `Users` and `Groups` fields on the [Notifications] tab empty.   

- Based on the number you enter in, for "Notify (Days before due)" -> that will determine when the system updates the "Remediation Status" on a Vulnerable Item, from {In-Flight} --> {Approaching} 

- This will support Reports, and context for the Remediation Users (i.e. they can see when a Vulnerable Item is approaching a breach of the Remediation Target Date )

- This will not send any Notifications

---------------------------------

Reference - Email Preview "Remediation Target Date Approaching"

-----------------------------

Reference - Configuring Notifications on Remediation Target Rule:

[Lorenzo8]

Wonderful! That explains much better how this works! Thank you Andy!

[Victor Colon]

Lorenzo, 

To answer your question, yes, a notification will be sent out for each VIT as they approach or breach a remediation target rule. If you navigate to Vulnerability Response > Administration > Remediation Target Rules you can configure these rules (i.e., 7 days to remediate a High Risk vulnerability) and set when notifications will be sent out (i.e., one day before); see image.

A way to restrict the amount of notifications sent out, is by navigating to Vulnerability Response > Administration > Notifications and setting a condition to the Remediation Target Rule notification, this way notifications are only sent out to a minimal number of VITs.