View Remediation Requests
Review the audit trail of Zero-Touch Remediation events—successful remediations, skipped attempts, and per-candidate version scoring.
The Remediation Requests page is the audit trail for resolution-time remediation. Each entry records what package was requested, whether Xray remediated or skipped it, which decision logic applied, and how candidate versions scored.
AppSec teams use this view to confirm that Zero-Touch Remediation is active, verify that the right patched versions were served, and investigate cases where no compliant fix was available.
To view Remediation Requests:
-
Log in to the JFrog Platform.
-
Navigate to Remediation > Zero-Touch > Audit.
-
Review the requests table. Each row includes:
| Column | Description |
|---|---|
| Package | Package name and ecosystem |
| Version requested | The coordinate the developer or CI originally requested |
| CVEs | Count and IDs of vulnerabilities on the requested version |
| Severity | Highest severity among matched CVEs |
| Status | healed, skipped, or pending |
| Healed to | Patched version served (for healed events) |
| Decision logic | Least Vulnerable |
| Requested by | User or service that triggered the download |
| Time | Timestamp of the remediation evaluation |
-
Click a row to open the detail pane. The right pane shows:
- Event ID — unique identifier for the remediation event.
- Version evaluations — each candidate rebuild Xray considered, with per-version CVE counts (Critical, High, Medium, Low) and whether it was selected or rejected, with a reason.
- For a local patch selection, candidate vendor is
Local. The patched registry URL uses theartifactory://<local-repository>form, and the evaluation identifies the member local repository that held the artifact.
-
Filter the list:
- By status:
healed,skipped, orall. - By search term: package name, ecosystem, or CVE ID.
- By status:
-
To clear the audit log (admin only), use the Clear all action.
Event Statuses
| Status | Meaning |
|---|---|
| Healed | Xray selected a patched rebuild and Artifactory served it. |
| Skipped | No candidate reduced CVE exposure, no Catalog data was available, or Self-Heal was disabled for the repository. |
| Pending | Remediation is in progress. |
Event Grouping
Remediation events fall into three outcome groups:
- Patched — a vulnerable package was replaced with a patched version.
- Not healed — a violation was detected but no compliant patched version was found.
- Not required — the request did not match an active remediation automation.
Related Topics
Updated about 5 hours ago