Automated Workflows: Overview

Summary: How to create and maintain a workflow that automatically maps any finding that matches specific filters

To create a workflow, you ordinarily select findings to associate to a workflow from the Host Findings or Application Findings pages. The Ivanti Neurons platform also allows you to associate a Risk Acceptance or False Positive workflow with a filter. As the system ingests new findings, it will automatically map any findings that match the filter to a workflow.

Using this feature, you can automatically assign findings to workflows that meet specific criteria. For example, say that you know that your scanner will find future instances of a particular plugin on similar assets. However, your team considers this plugin a false positive. As scanning continues on your network, the system will continue to populate these false positives as new open findings for the next several weeks. You would rather close them with an automated workflow.

The system will also map existing findings to an automated workflow based on any filter criteria: the value for a scanner-specific field, a tag name, a custom attribute, etc. Consequently, automated workflows can target either new ingested findings or existing findings.

Automated workflows have the same properties as corresponding manual workflows of the same types. To understand how an automated workflow operates, you need three additional pieces of information:

Once you request the workflow, the system will start to map the findings to the workflow. The system will update the workflow after ingestion of new matching findings.

The system also regularly schedules workflow automation jobs every 24 hours. If an existing finding changes state and now matches the workflow filters, the system will add the finding to the workflow within the next 24 hours.

In this example, assume that you want to do a Risk Acceptance of Info findings on a small group of assets called "Test Environment".

Go to the Host Findings page. Apply the appropriate filters to identify all Info findings in the group Test Environment. Uncheck any selected findings.

Then go to the Workflow menu and select Create an Automated Workflow from Filter.

In the first step, choose to create a Risk Acceptance workflow. You should review the total number of findings that currently match the filters on the left. Once you create the workflow, you (and any other user) will have no way to change the workflow filters.

In step 2, provide a Name, Reason, and Description for this workflow.

In step 3, choose the expiration date and the automation stop date for the workflow. The automation stop date can be up to 180 days in the future or match the expiration date, whichever comes first.

In the last step, you can review your workflow request before submitting. You must enter the number of findings associated with the filters (the findings impacted) before you can submit.

While the workflow remains in a Requested or Reworked state, you can modify any of its properties other than the filters or the workflow type.

To update an automated workflow, go to the Workflows page. Select Update from the Options menu on the workflow card to update it.

On the first page, you can review the workflow type, the number of findings currently associated with the workflow, and the filters.

To update workflow properties such as the name, description, or attachments, go to step 2.

On step 3, you can change the expiration date or the automation stop date.

On step 4, review your changes. To submit, enter the number of findings associated with the workflow (shown at the upper left) in the yellow box at the bottom.

The system automatically stops mapping findings on the automation stop date for any workflow in the Requested, Reworked, or Approved states. It also stops if the workflow is rejected, expires, or becomes too large. The system can add up to 100,000 findings to an automated workflow.

For workflows in the Requested or Reworked states, you must set a valid automation stop date before you can update the workflow. Once someone approves the workflow, you can manually stop automation without re-opening any of the findings already associated with it.

For an approved workflow, the Workflows page explicitly lets you modify the automation stop date. Open up the Options menu on the workflow card. Then click Update Automation Stop Date to open up the dialogue.

Once you open up this dialogue, you can either change the automation stop date or stop automation. If you stop automation, the system sets the workflow to yesterday’s date.

The system may prevent you from creating an automated workflow for a couple of reasons:

The system can only add findings to a workflow. Once this mapping happens, the findings remain in the workflow regardless of whether they continue to match the workflow filters.

Yes.

Yes.