Skip to main content
Remediation policies define the conditions for applying remediation to a finding when an upgrade is available that fixes the finding.

​
Manage remediation policies

You can view, enable, clone, disable, edit, or delete your Endor Labs remediation policies.
  1. Select User menu > Policies & Rules from the left sidebar.
  2. Select Remediation Policies.
  3. Use the search bar to search for a policy or click Create Remediation Policy.
  4. Enable or disable a policy using the toggle.
  5. To delete a policy, click the vertical three dots and select Delete Policy.
  6. To edit a policy, click on the vertical three dots and select Edit Policy.
  7. To clone a policy, click on the vertical three dots and select Clone Policy.

​
View policy details

  1. Select User menu > Policies & Rules from the left sidebar.
  2. Select Remediation Policies to view the list of remediation policies.
  3. Select a policy you want to review and click View Details. You can see the policy’s description, scope, and metadata. You can review the severity, finding categories, explanatory details, remediation steps and the Rego rules that implement the policy logic. View remediation policy details

​
Create a remediation policy from a template

You can create a remediation policy in Endor Labs to address a finding when specific conditions are met.
  1. Select User menu > Policies & Rules from the left sidebar.
  2. Click on the Remediation Policies tab.
  3. Click Create Remediation Policy to create a new remediation policy.
  4. Select a policy template. Currently, you can choose Recommended Version Upgrades For Vulnerabilities.
  5. Next, choose the template parameters. An upgrade matches only when the findings it fixes meet every parameter that you set. Each finding must match all the parameters on its own.
    • Upgrade Risk: The acceptable level of risk that a breaking change might occur with the upgrade.
    • Severity: Match upgrades that would fix findings with a particular severity.
    • Exclude Test: Select Yes to exclude version upgrade recommendations for fixing findings in test dependencies.
    • Dependency Reachability: Match upgrades that address findings with the following level of dependency reachability.
      • Reachable dependency
      • Unreachable dependency
      • Potentially reachable dependency
    • Function Reachability: Match upgrades that address findings with the following level of function reachability.
      • Reachable function
      • Unreachable function
      • Potentially reachable function
    • Exploited: Select Yes to match only upgrades that fix at least one vulnerability listed in the Known Exploited Vulnerabilities (KEV) catalog.
    • EPSS Percentile Threshold: Match only upgrades that fix at least one vulnerability with an EPSS percentile at or above this value, from 0.00 to 100.00. EPSS is the Exploit Prediction Scoring System.
    • EPSS Probability Threshold: Match only upgrades that fix at least one vulnerability with an EPSS probability at or above this value, from 0.00 to 1.00.
    • Minimum Number of Findings Fixed: Match only upgrades that fix at least this many findings, where each finding matches all the other parameters. The default is 1.
  6. In Select notification targets, select the notification integrations for the remediation policy. Select a PR Remediation integration to open Remediation PRs, or a Jira integration to create Jira issues.
  7. You can Assign Scope to the remediation policy by specifying what projects the policy has to scan.
    • In Inclusions, enter the projects and the tags of the projects that you want to scan.
    • In Exclusions, enter the projects and the tags of the projects that you do not want to scan. Exclusions take precedence over the inclusions, in case of a conflict. If you leave Inclusions and Exclusions empty, the remediation policy applies to all projects in the namespace, including projects added later. Review the projects that the remediation policy applies to before you save it.
    • Click Add project tag to these projects and enter a tag for the selected projects. Click Save Tags to apply it or Reset Tags to discard changes.
    • You can set custom tags for your projects from Projects > Settings > Custom Tags. See Tagging projects for more information about creating project tags.
  8. Finally, you must Name Your Remediation Policy.
    • Enter a human-readable Name for your remediation policy.
    • Enter a Description for your remediation policy that explains its function.
    • Enter any Policy Tags that you want to associate with your policy. Tags can have a maximum of 255 characters and can contain letters, numbers, and characters = @ _ -.
  9. Advanced: When you define a policy, it applies to the current namespace and all its child namespaces. To prevent the policy from being applied to any child namespace, click Advanced and deselect Propagate this policy to all child namespaces.
  10. Click Create Remediation Policy. The policy is enabled by default.
Rescan the project to apply the newly created remediation policy and update the findings.