Remediation review process

The remediation review add-on provides a full remediation process for tickets created by right (including SharedFolders) and account reviews.

It gathers all the pending remediation orders, group them by repository and launch sub-processes to enforce their termination.

The remediation review process can be configured to be launched on a regular basis (daily, weekly, …).

A validation step can be activated, to allow a compliance officer to check all pending remediations and cancel some of them if necessary.

Remediation campaigns can be manual or automatic. For manual remediations, request are sent to the repository technical owners.
The automatic remediation down to ServiceNow is provided by the bw_servicenow add-on.
This add-on can also be used as an example to implement automatic remediation in other third-party services.

In any case, management interfaces are provided and compliance reports are automatically generated.

Once the add-on installed, a full documentation is available in the sub-directory librarycontribsbw_remediationreview in your Brainwave GRC project.

Version 3.0

IAS 1.5+ certified version

This version leverages embedded IAP ServiceNow capabilities

Version 2.0

IAS certified version

Version 1.7

Functional changes

• Add remediation “hall of fame/shame” in campaign status page
• Add remediation type (account/right) in the compliance officer double-check page and manual remediation page
• Labels and icons improvements in the compliance officer double-check page and manual remediation page
• Change of the behavior of the cancel remediation campaign button in the compliance officer double-ckeck page to be Consistent with the button description
• Improvements in the “remediations to date” table in campaign status page
• Remove the remediation report from the final mail sent to the campaign owner
• Add dependency to ServiceNow 1.8 add-on

Fixes

• When remediation is launched both on rights and accounts, action to date tab in campaign status page shows only rights
• The subject of the mail sent to the compliance officer are incorrect
• The “actions to date” tab in the remediation status page shows duplicates
• The “actions to date” tab in the remediation status page does not filter on the current remediation campaign
• Remediation report is not generated on the campaign timesolt (Ader only)
• Only tickets with “revoke”, “update” and “approve-until” actions was gathered in remediation process
• Custom actions are displayed as “to do” instead of the real action
• The progress indicator in campaign status is incorrect
• ITSM ticket number and remediation type is missing in the compliance reports
• When remediation is launched both on rights and accounts, compliance reports only show one of the two elements
• Cancelled actions are not displayed in campaign status page
• Inconsistencies between rights list among pages
• Manual remediation: status of mitigated tickets are not updated in inspect content page
• Potential issue when using remediation facet and IAS reviews

Version 1.6

Functional changes

• Nationalize remediation notifications
• Manage of “Actions to date” tab in function of ITSM or manual remediation type
• Change bigdonut chart to liquiGaugeIndicator widget

Fixes

• Duplication information in “Actions to date” tab
• Remediation review reports do not include cancelled actions
• Missing parameter in remediation review notifications
• Each right is displayed twice in remediation synthesis
• fix log error “cannot parse date”

Version 1.5

Fixes

• In campaign configuration page, filter on the table does not work
• Remediation is limited to 2100 repositories with SQL Server

Version 1.4

Functional changes

• Recovery of remediation tickets from unsuccessful campaigns when starting a new one
  (while filtering remediation tickets already in an active remediation campaign)
• ByPass of the remediation process when all pre-check tickets are in cancel status
• Remediation information now in an attachment of the ServiceNow ticket and not in the body of the ticket
• Segregation of manual mode and auto mode for remediation (manual = I declare in iGRC what I have remediated, auto = tickets go to ServiceNow)
• Add OAuth config in the JS and in the technical conf
• Add Proxy config in the JS and in the technical conf
• Add cancel status in the pre-check
• Addition of a remediation report at the end of the remediation campaign
• Addition of SharedFolders rights to the remediation perimeter

Cleaning/Optimization

• NLS Keys (completeness and separate file)
• Add fragments

Fixes

• Error handling in some JS
• Remediation campaign start button disabled if no repo selected
• Bug on total progress of remediation tasks

Version 1.3

Compatible with 2017R3

Version 1.2

Initial version