Configure Zero-Touch Remediation Automations

Zero-Touch Remediation automations tell Xray which virtual repositories to cover and how to prioritize supported clearing-house vendors when more than one provides an equally secure candidate. Registered Maven local patches in a member local repository are also candidates; they are not a row in the vendor priority list.

Prerequisites

• Platform administrator access.
• At least one Maven or npm virtual repository that includes the public registry and the remote repositories of the vendors you want to use.
• Remote repositories behind the virtual repository indexed in Xray.
• JFrog Catalog access.
• For npm, a project with package-lock.json and a JFrog CLI version that supports npm lockfile healing. A standard npm install does not invoke healing. Maven remediation does not require JFrog CLI.
• For local patches, an Xray-indexed Maven local repository that is a member of a covered virtual repository. Registration is a REST API request; see Register local patches.

To configure a Zero-Touch Remediation automation:

1. Log in to the JFrog Platform as an administrator.

2. Navigate to Remediation > Zero-Touch.

3. Click Create Automation.

4. Enter a descriptive automation name.

5. Under Scope, select one or more Maven or npm virtual repositories. Only virtual repositories are supported.

   For Maven local patches, include the Xray-indexed local repository that holds the rebuilt artifacts as a member of the selected virtual repository. There is no separate local-patch toggle on this step. See Register local patches.

6. Under Healing trigger, confirm Fix all CVEs. Configuring a CVSS threshold is not supported.

7. Under Patch Selection Strategy, use Least Vulnerable. This is the only supported strategy.

8. Under Priority set, enable the vendors you want to use and drag them into the preferred order. Vendor priority breaks a tie when vendor candidates have the same vulnerability score. Registered local patches are not listed here. When a local patch and a vendor rebuild have the same score, the local patch is selected.

   Vendor	Maven	npm
   Chainguard	Supported	Not supported
   Echo	Supported	Supported
   TuxCare	Supported	Supported
   Seal Security	Supported	Supported

   Chainguard provides Maven fixes only, so an npm automation remediates through Echo, TuxCare, or Seal Security. Local patches are Maven only and are not used by npm lockfile healing.

9. Click Save Automation. New automations are active when saved.

For npm projects, run installation through a JFrog CLI version that supports lockfile healing. The CLI sends package-lock.json to Xray, writes the healed lockfile returned by Xray, and then installs the packages from the npm virtual repository. Continue to use the original package name and version in package.json.

Related Topics

• Zero-Touch Remediation Overview
• Register local patches
• View Remediation Requests