# Remediation

> Automated CIS remediation in SecureBaseline Cloud - AI-generated Ansible fix scripts, approval workflow, rollback, and execution tracking

Source: https://opennix.org/en/docs/haas/remediation/


## Overview

Remediation generates Ansible scripts to fix specific compliance failures found during scanning. Unlike Hardening (which applies a full CIS profile), Remediation targets individual failed rules with approval workflow.

### Remediation vs Quick Fix vs Hardening

| Feature | Remediation | Quick Fix | Hardening |
|---------|-------------|-----------|-----------|
| Scope | Selected failed rules | Single rule | Full CIS profile |
| Approval | Required before execution | Immediate | Immediate |
| Script review | Yes (download/view before apply) | No | No |
| Blacklist support | Yes (exclude rules) | No | No |
| Best for | Production servers | Quick one-off fixes | Initial hardening |

## Generating Remediation

1. Run a compliance scan on a host
2. Navigate to **Remediation**
3. Select the scan result to remediate
4. Review the list of failed rules
5. Exclude rules using the blacklist if needed
6. Click **Generate Remediation**

The system generates Ansible playbook scripts for each fixable rule.

## Approval Workflow

Generated remediation scripts require approval before execution:

1. **Review** - examine generated scripts (view or download YAML)
2. **Approve** - mark the remediation for execution
3. **Execute** - apply approved scripts to the target host
4. **Verify** - re-scan to confirm fixes applied

To reject a remediation, click **Cancel** instead of Approve.

## Blacklist Management

Blacklist rules you want to exclude from remediation:

1. Navigate to **Remediation** or **Settings > Known Issues**
2. Add rule IDs or patterns to the blacklist
3. Blacklisted rules are skipped during remediation generation

Use blacklists for:
- Rules incompatible with your application (e.g., disabling USB on a desktop)
- Accepted risks documented in your security policy
- False positives specific to your environment

## Downloading Scripts

Before approving, you can download the generated Ansible scripts:

1. Click **Download Script** on any remediation job
2. Review the YAML content
3. Optionally run in check mode on a test server before approving

## Remediation Statistics

The Remediation page displays:
- Total remediations generated
- Approval rate
- Success rate after execution
- Rules most frequently remediated

## Best Practices

- Always review generated scripts before approving
- Test on a staging server first
- Use blacklists for rules that conflict with application requirements
- Re-scan after remediation to verify compliance improvement
- Document accepted risks in Known Issues

## See Also

- [CIS Benchmark security hardening](/en/docs/haas/hardening/) - apply a full CIS profile when bulk hardening is needed instead of targeted fixes
- [Vulnerability scanning for Linux servers](/en/docs/haas/vulnerabilities/) - detect CVEs in packages to prioritize remediation efforts
- [AI-powered Ansible task generator](/en/docs/haas/task-generator/) - automatically create Ansible playbooks from CIS rule descriptions