Automation
Working with remediation rules
Encoding a known fix so it applies consistently — and being clear about where the ceiling is.
Last updated
A remediation rule maps a detected condition to a corrective action. The point is consistency: the fix your best technician applies is the fix that gets applied, every time, whether or not that person is on shift.
Rules draw on a fixed action set. This is the most important thing to understand about automation in AegisOne today, and getting it wrong leads to disappointment later. There is no script library, no versioned author-your-own automation, no approval workflow around custom code and no scheduler. If your intended automation requires arbitrary PowerShell, Bash or Python, that is not something the product does, and no amount of configuration will make it.
What the fixed action set does well is the long tail of repetitive, low-judgement work — the fixes that are individually trivial and collectively expensive, and that get done inconsistently precisely because they are beneath anyone's attention.
Every triggered action is dispatched to the target endpoint and written to the agent action log, with the same attribution as a manual operation. This matters for two reasons. It means an automated change is as reconstructable as a human one during an incident review. And it means you can audit whether a rule is doing what you believed it was doing, which is not the same as whether it is enabled.
Review your rules periodically. Automation rots quietly: the condition that justified a rule gets fixed at source, the estate changes, and a rule that was sensible in March is doing something mildly wrong by October with nobody watching. A rule that has not triggered in six months is a candidate for removal; a rule that triggers constantly is usually pointing at an underlying problem that deserves fixing properly rather than papering over daily.
Where a rule fires repeatedly on the same endpoint, treat that as a signal rather than a success. Recurring-issue detection and the problem-record workflow exist for exactly that case — the point is to escalate a persistent symptom into a tracked cause, not to keep suppressing it efficiently.