View Remediation Requests

Review Zero-Touch Remediation audit events to confirm healed packages, skipped attempts, and candidate scoring in the audit trail.

The Remediation Requests page is the audit trail for resolution-time remediation. Each entry records what package was requested, whether Xray remediated or skipped it, which decision logic applied, and how candidate versions scored.

You use this view to confirm that Zero-Touch Remediation is active, verify that the right patched versions were served, and investigate cases where no compliant fix was available.

How to View Remediation Requests

Open the Zero-Touch audit trail to inspect healed, skipped, and pending events.

Log in to the JFrog Platform. The JFrog Platform home page is displayed.
Navigate to Remediation > Zero-Touch > Audit. The Remediation Requests table is displayed.
Review the requests table. Each row includes the following columns.

Column	Description
Package	Package name and ecosystem
Version requested	The coordinate the developer or CI originally requested
CVEs	Count and IDs of vulnerabilities on the requested version
Severity	Highest severity among matched CVEs
Status	`healed`, `skipped`, or `pending`
Healed to	Patched version served (for healed events)
Decision logic	`Least Vulnerable`
Requested by	User or service that triggered the download
Time	Timestamp of the remediation evaluation

The table lists remediation evaluations for your platform.

Click a row to open the detail pane. The detail pane shows:
- Event ID: Unique identifier for the remediation event.
- Version evaluations: Each candidate rebuild Xray considered, with per-version CVE counts (Critical, High, Medium, Low) and whether it was selected or rejected, with a reason.
- For a local patch selection, candidate vendor is Local. The patched registry URL uses the following form, and the evaluation identifies the member local repository that held the artifact.
```
artifactory://<LOCAL_REPOSITORY>
```
  Where:
  - <LOCAL_REPOSITORY>: The key of the member local repository that held the patched artifact
  For example:
```
artifactory://patches-local
```
The detail pane displays the selected event.
Filter the list:
- By status: healed, skipped, or all.
- By search term: package name, ecosystem, or CVE ID.
The table shows the matching requests.

Administrators can optionally clear the audit log with the Clear all action.

Event Statuses

The following statuses appear in the requests table.

Status	Meaning
Healed	Xray selected a patched rebuild and Artifactory served it.
Skipped	No candidate reduced CVE exposure, no Catalog data was available, or Self-Healing was disabled for the repository.
Pending	Remediation is in progress.

Event Grouping

Remediation events fall into the following outcome groups:

Patched: A vulnerable package was replaced with a patched version.
Not healed: A violation was detected but no compliant patched version was found.
Not required: The request did not match an active remediation automation.

Frequently Asked Questions

This section provides answers to frequently asked questions.

plusFAQs

Q: How do I view Zero-Touch Remediation audit events?

A: In the JFrog Platform, go to Remediation > Zero-Touch > Audit and review the requests table. For more information, see Event Statuses.

Q: What happens if no patched candidate reduces CVE exposure?

A: The event is Skipped. Xray records that no candidate reduced CVE exposure, Catalog data was unavailable, or Self-Healing was disabled for the repository. For more information, see Event Statuses.

Q: What is the difference between Healed, Skipped, and Not required?

A: Healed means a patched version was served. Skipped means a violation existed but no compliant patch was selected. Not required means no active automation matched the request. For more information, see Event Grouping.

Q: What do I need before I can review Remediation Requests?

A: You need access to the JFrog Platform and at least one Zero-Touch Remediation evaluation so the table has events to inspect. For more information, see How to View Remediation Requests.

Q: Can I filter the audit list by CVE ID?

A: Yes. You can filter by status or search by package name, ecosystem, or CVE ID. For more information, see Event Statuses.