How to Use One-Click Remediation

Overview

Interno does not have a one-click remediation feature. It does not run commands on your servers, cloud accounts, endpoints or security tools, and ZIN Advisor does not apply fixes for you. Interno collects and analyses data from your tools; the fix itself is made in the tool that owns the asset.

Earlier versions of this guide described Remediate and Snooze buttons and a proposed review card with Apply accepted inside ZIN Advisor. Those cards are not produced in Interno conversations, so you will not see them.

What Interno does give you is a fast route from a finding to a fix that you carry out and can then prove:

Ask ZIN Advisor what the finding means and how to fix it.
Make the fix in the source tool.
Use a widget or an alert to watch the finding disappear from the data.
Record the work in the Risk Register where it warrants one.

This guide walks through those four steps.

ZIN Advisor is shown on the Zeron cloud (SaaS) platform only. On an on-premises deployment, skip Step 1 and start from Step 2.

Prerequisites

At least one integration connected with data collected, so there are findings to work from
For Step 1: an Interno account on the Zeron cloud platform
For Step 3: defence:widget:create to build a widget, or defence:query:create to build an alert
For Step 4: the Risk Register permissions described in How to Use the Risk Register

Step 1: Ask ZIN Advisor for Fix Guidance

Navigation: Sidebar → ZIN Advisor

Click ZIN Advisor in the sidebar.
Describe the finding you want dealt with. Name the tool, the asset or group of assets, and the problem, for example Which endpoints are missing critical patches, and what should we do first?
Read the answer. ZIN looks up the data Interno holds and replies with text and, where useful, a table or chart.
Ask follow-up questions in the same conversation, for example to narrow the list to one business unit or to ask for the steps in order of priority. The conversation keeps its context.

Treat the answer as guidance. ZIN's replies are generated and can be inaccurate or out of date, so confirm the steps against your own change process and the vendor's documentation before acting.

For everything the chat can do, see How to Use the ZIN AI Copilot.

Step 2: Make the Fix in the Source Tool

Carry out the change in the tool that owns the asset, for example your endpoint manager, identity provider, cloud console or vulnerability scanner, following your organisation's change process.

Interno has no screen for pushing a change to a connected tool. The dashboards, widgets, alerts and ZIN Advisor described here all work on the data Interno has collected.

Step 3: Confirm the Fix in Interno

Interno shows the fix once the integration has collected fresh data. A finding that has been fixed drops out of the latest data once that integration has completed a scan after your change.

Check once

Go to Sidebar → Admin → Integrations and confirm that the integration has completed a scan since you made the fix. See How to Configure Connectors/Integrations.
Ask ZIN Advisor the same question again in a new chat, or open the widget or dashboard that showed the finding, and check that the asset is no longer listed.

Keep watching with a widget

Build a widget that lists or counts the affected assets and put it on a dashboard. As fixes land and scans complete, the number falls.

Navigation: Sidebar → Dashboard → Create → Widget

See How to Build Custom Widgets and Dashboards for the steps. You can also ask ZIN Advisor to create the widget for you: see How to Create Widgets and Dashboards from ZIN Advisor Chat.

Be emailed the outstanding list

Build an alert on the same query. Interno runs it every set number of days and emails the remaining rows to the people you choose, so the owners see what is still open without logging in.

Navigation: Sidebar → Assets → Query Library → Alert tab → Create Alert

See How to Set Up Alerts and Evidence Queries for the steps. The alert emails on every run, including when nothing is left; an empty table means the work is done.

Step 4: Record the Work in the Risk Register

Where a finding is significant enough to track formally, raise it as a risk and work it through to closure, attaching evidence of the fix.

Navigation: Sidebar → Risk Register

See How to Use the Risk Register for the steps.

Good Practice

Practice	Why
Verify guidance before acting	ZIN's answers are generated and can be wrong. The decision and the change are yours
Fix in the source tool, never around it	Interno shows what your tools report. A fix the tool does not know about will still be reported at the next scan
Wait for a completed scan before declaring success	Interno shows what was collected at the last scan, not the live state of the asset
Track with a widget or an alert	A falling count is evidence that the remediation is working
Record significant items as risks	The Risk Register keeps the decision, the owner and the evidence together

Troubleshooting

I cannot find the Remediate or Snooze buttons → Interno does not have them. Follow the four steps above.

ZIN Advisor is not in my sidebar → It is shown on the Zeron cloud platform only, not on on-premises deployments.

ZIN Advisor gave only general advice → Name the tool, the assets and the exact problem. General questions get general answers.

I fixed the issue but Interno still shows it → Interno shows data as of the integration's last completed scan. Check the scan information under Admin → Integrations and look again once a scan has finished after your fix.

The finding came back → The fix did not hold in the source tool, or it was applied somewhere the tool does not manage. Check the asset in the source tool.

My tracking widget shows no data → Either everything is fixed, or the query is filtering too tightly. Open the widget in the Query Builder and check the query.

Need more help? Contact support@zeron.one