Dashboard guide
Plans, mitigations, exceptions
Every change on a host goes through a plan. A plan holds one or more jobs (one per host), and goes through the same steps every time: dry run, approval, signed job, execution, verification. The flow is explained in Remediation flow; this page describes the screens.
Plans is under Remediation in the sidebar, for operators, approvers, admins and owners.
Create a plan
Most plans are created from elsewhere: Fix on a finding, Fix selected on Findings, Fix all on Hardening, or a breaker on an attack path. You can also create one by hand with New plan (Overview or Plans) or Create plan… on a host:
| Field | Meaning |
|---|---|
| Host | The target. |
| Action | package.upgrade, service.restart or service.stop. |
| Package, Target version | For an upgrade; latest-security takes the newest security update of the distribution. |
| Unit | For a service action. |
| Title | Free text, shown in lists and the audit log. |
| Submit for approval right after the dry run | Saves a click when the dry run succeeds. |
Create plan & dry run… creates the plan and starts the dry run on the host. Operators, admins and owners can create plans; approvers cannot (they approve).
States
| Plan state | Means |
|---|---|
| draft | Created, not yet submitted. |
| dry run | The hosts are checking what would happen. Nothing changes. |
| awaiting approval | Waiting for a second person. |
| approved | Approved; waits for the maintenance window or the next wave. |
| running | Jobs are being carried out. |
| paused | Stopped by a failure, the kill switch, or by hand. |
| completed, failed, cancelled, rejected | Final states. |
| Job result | Means |
|---|---|
| dry_run_ok | The dry run found that the change is possible. |
| succeeded | Done and verified. |
| failed | Not done, or verification failed. |
| rolled_back | Failed, and the agent restored the previous state. |
| rollback_failed | Failed, and the previous state could not be restored automatically. Check the host. |
| rejected | The agent refused the job, with the reason (for example a local policy rule). |
| expired, cancelled | Not executed. |
The plan detail
Panels:
- Plan: dry-run counts, the maintenance window, the rollout (waves, canary, stop on failure percentage), the rollback choice and the plan hash: a fingerprint of exactly what is approved. If the plan changes, earlier approvals no longer count.
- Approvals: who approved, when, and how (with a security key, or otherwise when the environment allows that).
- Targets, Waves, Jobs.
Buttons (depending on state and role):
| Button | Does |
|---|---|
| Submit for approval | Sends the plan to the approvers. |
| Approve with security key… | For approvers, admins and owners who did not request the plan. |
| Reject… | Rejects, with a reason. |
| Approve own plan (single-admin hold)… | Only in environments with a single approver; the plan then waits for the hold time (15 minutes by default), which can be cancelled. |
| Start wave N… | Starts the next group of hosts. Also used to resume a paused plan. |
| Re-run dry run | A new dry run; approvals given so far lapse. |
| Cancel | Cancels the plan. |
| Cancel job… | Sends a signed cancel to one host. It only works before the job's first change; a package installation that has started is never interrupted halfway. |
Rollback
Chosen when the plan is created:
- automatic: if verification fails, the agent restores the previous state where it kept it (for example the old package version, or the previous value of a temporary fix);
- manual: the agent reports, and you decide.
What can and cannot be rolled back: Remediation flow.
Mitigations and isolation
Mitigations lists the temporary fixes and isolations that are active: firewall restrictions, kernel parameters, blocked kernel modules, configuration snippets, network isolation. Revert creates a plan that undoes one (operator, admin, owner). The finding it covered opens again.
Exceptions
Exceptions lists accepted risks: findings an admin or owner accepted with Accept risk…, with the risk owner, the reason and the expiry date. An expired exception opens its findings again automatically.