Build a Remediation Plan with Agent Sara Chat Now
Use Chat Now to turn your prioritized findings into a remediation plan in a few clicks. You do not type anything. At each step, you choose from the options that Agent Sara shows. Agent Sara groups the work into remediation waves and creates the plans your IT Operations team needs to start remediation.
Navigate to: Cyber Risk Agent > My Agents > Agent Sara > Chat Now
Prerequisites
- Chat Now is available on request and needs a TruRisk Eliminate subscription. To turn it on, contact Qualys Support or your Technical Account Manager (TAM).
- Agent Sara is hired from the Marketplace. For steps, refer to Getting Started with Agent Sara.
ETM finds and prioritizes your findings. TruRisk Eliminate runs the patch and mitigation jobs.
Chat Now and Assign Task
Agent Sara gives you two ways to work:
| Option | What it does | Use it when |
|---|---|---|
| Chat Now | Guides you through a fixed set of steps. At each step, you select from the options that Agent Sara shows. You do not type questions or search queries. | You want a remediation plan now, for a ready-made set of findings such as this month's Patch Tuesday vulnerabilities. |
| Assign Task | Creates a task that you configure and schedule yourself. The task runs on demand, weekly, or monthly. | You want Agent Sara to run again and again on the same scope and track progress over time. |
Assign Task does not change. Chat Now is an additional way to work with Agent Sara.
Start Chat Now
You can start the Chat Now workflow from three places:
- Agent tile: Click Chat Now next to Assign Task.
- Agent Details page: Click Explore with Sara.
- Home page: Click Explore with Agent Sara in the Patch Tuesday pop-up. The workflow starts with the Patch Tuesday template already selected.
Patch Tuesday Pop-Up on the Home Page
When your account has Patch Tuesday vulnerabilities, Agent Sara shows a pop-up on the ETM Home page. The pop-up shows:
- How much of your backlog comes from Patch Tuesday vulnerabilities.
- How much of it you can close with highly reliable patches.
- Your current mean time to remediate (MTTR).
Click Explore with Agent Sara to start the Chat Now workflow for Patch Tuesday.
Build a Remediation Plan
To build a remediation plan with Chat Now, follow these steps:
- Start Chat Now. For the options, refer to Start Chat Now.
- Select a template. The template decides which findings Agent Sara works with. For details, refer to Predefined Templates.
- Select the scope. Select a business entity. Agent Sara lists your top 10 business entities by the number of impacted findings. Start with the entity that has the most exposure.
- Review the remediation waves. Agent Sara groups the findings into waves based on operational impact and patch availability. Click a wave to see its sub-waves. For details, refer to Remediation Waves.
- Create the plans. Select the remediation owner, and then create the plans with one click.
Agent Sara creates two plans in a single action:
- A prioritization plan in Risk Management > Risk Workbench.
- A risk elimination plan in TruRisk Eliminate.
The remediation owner is usually a person on your IT Operations team. Select the person who applies the patches and mitigations.
Predefined Templates
A template is a ready-made set of search criteria. It saves you from building the search yourself.
Template availability depends on the data in your account, so you might not see every template. For example, you see the Patch Tuesday template only when your account has Patch Tuesday vulnerabilities.
The same templates are also available in Risk Management > Risk Workbench. You can use them to create a prioritization plan without starting a chat. For details, refer to Prioritization Workflow With TruRisk Eliminate.
| Template | What it finds |
|---|---|
| Patch Tuesday | Patch Tuesday vulnerabilities that affect your environment. Microsoft releases Patch Tuesday updates on the second Tuesday of every month. |
| TruConfirm Exploit Validated | Vulnerabilities that TruConfirm confirms as exploitable on your assets. |
The Patch Tuesday template uses the finding.patchTuesdayDate and finding.isPatchTuesdayApplicable search tokens. You can also use these tokens yourself on the Findings tab. For details, refer to Search Tokens for Findings.
Remediation Waves
A remediation wave is a deployment stage. It tells you what to deploy, in which stage, and what business impact to expect. Start with the changes that are least likely to disrupt the business.
Agent Sara uses patch reliability, operational impact, and asset criticality to group the fixes into waves. Waves 1 and 2 group fixes that have a patch, by operational impact. Wave 3 groups findings that have no patch.
For example, if a template matches 1,000 findings, Agent Sara might put 300 in Wave 1, 500 in Wave 2, and the other 200 in Wave 3. Your teams can then plan the work in stages.
| Wave | What it contains |
|---|---|
| Wave 1 – Low operational impact | Fixes that you can roll out with little risk to your business operations. |
| Wave 2 – High operational impact | Fixes that need more planning, such as a change window, because they can affect business operations. |
| Wave 3 – Mitigation | Findings that have no patch. These findings need a mitigation, such as a compensating control, instead of a patch. |
Each wave has sub-waves, such as 1.1, 1.2, and 1.3. Sub-waves group the findings by asset type, operating system, and application category. The finding counts of all the sub-waves add up to the finding count of the wave.
Agent Sara shows only the waves that have findings for your template and scope. For example, if none of your findings fall into Wave 2, you see only Wave 1 and Wave 3.
Understand the Finding Counts
The finding counts that Agent Sara shows, for example, 58K, include only vulnerabilities that have an available patch or mitigation. They are not the total number of vulnerabilities in your account. The same applies to the percentages in the Patch Tuesday pop-up on the Home page.
After You Create the Plans
Your remediation owner opens the risk elimination plan in TruRisk Eliminate and creates the patch or mitigation jobs from there.
In ETM, you track the plan in Risk Management > Risk Workbench, like any other prioritization plan. For details, refer to Prioritization Workflow With TruRisk Eliminate.
Agent Sara never patches systems on its own. A person on your team reviews and runs every remediation job.
Who Should Use Chat Now
- Vulnerability Management and Security Operations teams who turn prioritized findings into remediation plans.
- IT Operations teams who carry out the plans.