Remediating vulnerabilities in BMC Helix Automation Console

By integrating BMC Helix Automation Console (SaaS deployment only) with BMC Helix Intelligent Automation, you can now remediate vulnerabilities. The vulnerabilities are remediated by using automation platforms other than TrueSight Server Automation, such as Ansible.

Scenario

The Acme company needs to remediate vulnerabilities; however, due to the organization's security policy, vulnerabilities cannot be remediated by using TrueSight Server Automation (TSSA). Therefore, they decided to integrate with BMC Helix Intelligent Automation which supports the Ansible Automation Platform.

Workflow for remediating vulnerabilities in BMC Helix Automation Console by using Ansible Automation Platform

The following table lists the tasks that you need to perform to integrate BMC Helix Automation Console with BMC Helix Intelligent Automation and remediate vulnerabilities by using Ansible Automation Platform:

Task	Action	Product	User role	Description	Reference
1.	Create the inventory in Ansible Automation Platform.	Ansible Automation Platform	Automation engineer	Add the inventory (a collection of hosts) managed by the Ansible Platform application.	Create a new Inventory
2.	Create the credentials in Ansible Automation Platform.	Ansible Automation Platform	Automation engineer	Create the username and password required to access the Ansible Platform application.	Create a Credential
3.	Create an Ansible job template to remediate vulnerabilities	Ansible Automation Platform	Automation engineer	Install the vulnerability remediation script in Ansible Automation Platform. Click here to view a sample YAML script for Linux Sample YAML script for Linux --- - name: Update packages based on CVEs hosts: "{{node}}" become: yes vars: cve_list: "{{ cveid \| default([]) }}" tasks: - name: Debug CVE list ansible.builtin.debug: msg: "CVE List: {{ cve_list }}" - name: Update packages for each CVE ansible.builtin.shell: "sudo dnf update --cve={{ item }} -y" loop: "{{ cve_list }}"	Set up a Project Create a new Job Template
2.	Configure the Ansible Automation Platform connector	BMC Helix Intelligent Automation	Automation engineer	Configure the cloud connector to establish a connection between BMC Helix Intelligent Automation and Ansible Automation Platform (formerly called Ansible Tower).	Configuring-the-Ansible-Automation-Platform-cloud-connector
5.	Integrate BMC Helix Automation Console with BMC Helix Intelligent Automation	BMC Helix Automation Console	Administrator	Enable Intelligent Automation integration from the BMC Helix Automation Console UI	Integrating with BMC Helix Intelligent Automation for vulnerability remediation
4.	Create an automation policy	BMC Helix Intelligent Automation	Operator	Create an automation policy that will remediate vulnerabilities identified by BMC Helix Automation Console. This policy is triggered when a vulnerability remediation operation is executed in BMC Helix Automation Console.	To create a policy for remediating vulnerabilities by using Ansible Automation Platform
6.	Create a vulnerability remediation operation	BMC Helix Automation Console	Operator	Create a vulnerability remediation operation that will trigger the automation policy when you execute it.	Creating a vulnerability remediation operation to trigger an automation policy in BMC Helix Intelligent Automation
7.	View automation policy run history	BMC Helix Intelligent Automation	Automation Engineer	View the History page to view the status of the automation policy run.	Viewing-automation-policy-runs-history

To create a policy for remediating vulnerabilities by using Ansible Automation Platform

Click Policies and then click Create Automation Policy.
In the Policy Information section, enter a unique name and an optional description for the policy.
Select Automatic to execute the policy automatically based on the incoming events.
In the Trigger section, on the Paste Event JSON tab, enter the event in the JSON format, and click Done.

Click here to view the sample event JSON

Sample event JSON
{
"_tenant_id": "979915927",
"severity": "5",
"os_vendor": "QUALYS",
"os": "Linux",
"violation_name": "Missing Package Version",
"os_version": "Linux RHEL-9",
"last_observed_date": "1570879232000",
"cve_ids": [
   "CVE-2024-0725"
  ],
"cvssv2": null,
"detection_date": "2019-10-12 11:20:32",
"_identifier": "15db61f3-ea77-437e-919a-5b139d627c1c:1180b917-0d15-4697-a12c-db1ed41094c5",
"exploit_available": null,
"asset_name": "vl-xxx-xxxxx",
"cvssv3": null,
"tag": "TSAC"
  }
}

The Trigger Condition is generated based on the selected event. Remove the source hostname and continue with the next steps.
Click anywhere in the Trigger Condition box to start building the expression for a trigger condition, and use the suggested parameters, values, and operators to complete the expression.
For sample expressions, see Trigger condition expression.
To add action to the policy, click Select Action and perform the following steps by using the action wizard:
1. From the Pick an automation tool section, click the Ansible Automation Platform connector name.
  Only configured connectors are displayed here. The wizard takes you to the next step to select an action.
2. Click Sync Actions.
  All job template and workflow template actions in your Ansible Automation Platform instance appear.
3. (Optional) Use the Search Online option to dynamically search for actions in the Ansible Automation Platform application.
4. Click Select against the required action.
  
  The wizard takes you to the next step to configure an action.
5. Provide the following information:
  1. Enter the action name and description.
  2. In Request body, enter the extra variables that you might have used in Ansible Automation Platform:
    Sample request body for stopping an AWS EC2 instance
    {
    "extra_vars": {
    "node": "$.event.asset_name",
    "cve_list": [
    "$.event.cve_ids"
    ]
    }
    }
6. Click Done.
  The added action appears in the Action Configuration section on the Create Automation Policies page.
Select Publish Policy and click Save to publish the policy.

Where to go from here

After you create the automation policy, you can create a vulnerability remediation operation in BMC Helix Automation Console. See Create a vulnerability remediation operation.

When you execute the vulnerability remediation operation, the created automation policy is triggered in BMC Helix Intelligent Automation and the selected vulnerabilities are remediated by using the Ansible automation platform. To view the status or other details of the policy run, go to the History page. For more information, see View automation policy run history.