Configure Zero-Touch Remediation Automations

Zero-Touch Remediation automations tell Xray which virtual repositories to cover and how to prioritize supported clearing-house vendors when more than one provides an equally secure candidate. Registered Maven local patches in a member local repository are also candidates. They are not a row in the vendor priority list.

Prerequisites

• Platform administrator access.
• At least one Maven or npm virtual repository that includes the public registry and the remote repositories of the vendors you want to use.
• Remote repositories behind the virtual repository indexed in Xray.
• JFrog Catalog access.
• For npm, a project with package-lock.json and a JFrog CLI version that supports npm lockfile healing. A standard npm install does not invoke healing. Maven remediation does not require JFrog CLI.
• For local patches, an Xray-indexed Maven local repository that is a member of a covered virtual repository. Registration is a REST API request.

Configure a Zero-Touch Remediation Automation

Create an automation to set repository scope, keep Fix all CVEs, and order vendors for the Least Vulnerable strategy.

1. Log in to the JFrog Platform as an administrator. The JFrog Platform home page is displayed.

2. Navigate to Remediation > Zero-Touch. The Zero-Touch page is displayed.

3. Click Create Automation. The create automation form is displayed.

4. Enter a descriptive automation name. The name field shows the value you entered.

5. Under Scope, select one or more Maven or npm virtual repositories. Only virtual repositories are supported. The selected repositories appear in the scope list.

   For Maven local patches, include the Xray-indexed local repository that holds the rebuilt artifacts as a member of the selected virtual repository. There is no separate local-patch toggle on this step.

6. Under Healing trigger, confirm Fix all CVEs. Configuring a CVSS threshold is not supported. Fix all CVEs remains selected.

7. Under Patch Selection Strategy, use Least Vulnerable. This is the only supported strategy. Least Vulnerable remains selected.

8. Under Priority set, enable the vendors you want to use and drag them into the preferred order. Vendor priority breaks a tie when vendor candidates have the same vulnerability score. Registered local patches are not listed here. When a local patch and a vendor rebuild have the same score, the local patch is selected. The enabled vendors appear in the order you set.

   The following table shows vendor coverage by package type.

   Vendor	Maven	npm
   Chainguard	Supported	Not supported
   Echo	Supported	Supported
   TuxCare	Supported	Supported
   Seal Security	Supported	Supported

   Chainguard provides Maven fixes only, so an npm automation remediates through Echo, TuxCare, or Seal Security. Local patches are Maven only and are not used by npm lockfile healing.

   An existing automation whose priority list doesn't already include TuxCare receives TuxCare at the end of the list, enabled. The order and enabled state of the vendors already in the list stay as you saved them. You don't need to edit the automation for this change to take effect. If TuxCare is already in the list and disabled, it stays disabled.

9. Click Save Automation. The new automation is saved and active.

You can install npm packages through a JFrog CLI version that supports lockfile healing. For more information, see Zero-Touch Remediation Overview.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Zero-Touch Remediation Overview
• Register Local Patches
• View Remediation Requests
• Interpreting Remediation in Scan Results