Skip to main content

​
Overview

An auto-remediation fact associates a condition with a remediation playbook. The condition compares case attributes, supported playbook inputs, or both. For example: disposition_label = "Malicious" AND confidence.score > 85 This expression matches a case when:
  • The disposition is Malicious.
  • The confidence score is greater than 85.
The condition evaluates whether the action meets the rule. The selected playbook performs the configured work.
A matching condition does not guarantee successful execution. The playbook must also be able to start and receive its required inputs.
Use this guide to:
  • Configure an auto-remediation fact in the AirMDR UI.
  • Select supported fields and operators.
  • Write and combine conditions.
  • Reference inputs from the selected remediation playbook.
  • Verify matching and nonmatching outcomes.
  • Reproduce the supplied service API test using your own identifiers.
Before configuring an auto-remediation fact:
  • Sign in to the AirMDR organization where the fact will apply.
  • Ensure your account can access and manage Facts.
  • Identify the remediation playbook and its required inputs.
  • Identify the exact field values you want the condition to compare.
  • Prepare a test case and an appropriate test playbook.
If you cannot edit a fact or select the required playbook, contact your AirMDR administrator or support contact to verify your access.
  1. Sign in to AirMDR.
  2. Select the appropriate organization.
  3. In the left navigation, open Knowledge Management and navigate to Facts.
  4. Locate the required fact using Search facts.
  5. Use the available filters to narrow the results.
The Facts list displays the following information:Select an existing fact to open Edit Fact.
If a fact is missing, check the selected organization, filters, search text, and Exclude expired setting.

​
📧 Step-by-Step: Configure an Auto-Remediation Fact

1

Create or open a fact

On the Facts page:
  • Select + Add Fact to create a fact.
  • Select an existing fact to edit its configuration.
2

Describe the intended behavior

In Content, describe what the fact should allow.For example:
Automatically run the selected remediation playbook for malicious cases with a confidence score greater than 85.
Keep the description clear enough for another user to understand the intended behavior.
Enter the executable expression in Condition. Use Content to describe its purpose.
3

Add the auto-remediation tag

In Tags, add: auto-remediationThe supplied API reference and recorded auto-remediation fact use this tag.
4

Configure the scope and dates

Review the following fields:
For a temporary test rule, configure an expiry date.
After saving, also check the fact’s status and any applicable approval requirements.
5

Select the remediation playbook

In the Auto-remediation section, select the required Remediation Playbook.Review its inputs before writing a condition that references them. The available playbook input fields depend on the playbook selected for the fact.
6

Enter the condition

In Condition, enter an expression using supported fields and operators.For example: disposition_label = "Malicious" AND confidence.score > 85This condition requires both comparisons to match.
7

Review and save

  1. Check that Content accurately describes the expression.
  2. Verify the selected playbook.
  3. Review the scope, start date, and expiry date.
  4. Check field names, operators, quotation marks, and grouping.
  5. Select Save.
  6. Locate the saved fact in the Facts list.
  7. Review Status, Start Date, and Expires On.
If the fact is Pending, follow your organization’s fact approval process before relying on it for automation.
8

Verify the Outcome in the UI

After configuring a fact:
  1. Confirm that it is saved with the intended condition and remediation playbook.
  2. Review its status, scope, start date, and expiration date.
  3. Use a test case with known field values.
  4. Ensure the relevant approval action refers to the intended playbook.
  5. Check that required playbook inputs are available.
  6. Open Investigations and inspect the relevant action in All Actions.
  7. Review the action status and any execution or failure details.
  8. Where available, inspect the AUTO REMEDIATED group.
  9. Verify the playbook execution outcome.
  10. Repeat using a case that does not satisfy the condition.
The supplied test showed the following outcomes:An open action alone does not establish why automation did not occur. Check the condition, fact eligibility, selected playbook, required inputs, and execution details.Recommended verification: Test a matching case, a nonmatching case, a threshold boundary, and a missing-value case where relevant.

​
Condition Syntax

A comparison generally consists of a field, an operator, and a value: field operator value For example: severity_label = "High"
Use AND, OR, NOT, and parentheses to combine comparisons.
Use the exact field paths listed in this guide. For example:
  • Use severity_label for the severity label.
  • Use disposition_label for the disposition label.
  • Use confidence.score for numeric confidence.
Conditions are evaluated in this order:
  1. NOT
  2. AND
  3. OR
Use parentheses when combining AND and OR.For example:
This expression requires a malicious disposition and either high or medium severity.
The supplied expression reference does not support:
For an integer confidence score, express “at least 85” as: confidence.score > 84This replacement depends on the value being an integer; it does not provide a general greater-than-or-equal comparison for fractional values.Express “severity is not Low” as: NOT severity_label = "Low"
Enter Facts expressions directly in Condition using the syntax shown here.

​
Supported Fields and Operators

These fields support: =, in, contains, starts_with, ends_with, matches, existsExample:
These fields support: =, >, <, in, existsExample: confidence.score > 85
The catalog identifies priority and type as numeric fields. Use their stored numeric values rather than substituting UI display labels.
These fields support: =, existsExample: archived = falseUse lowercase true or false without quotation marks.
These fields support: =, >, <, existsExample: created_at > 1759276800
Enter timestamps in epoch seconds, rather than milliseconds or formatted date strings.
If a case does not contain a field, a comparison against that field evaluates to false.For example: confidence.score > 85A case without confidence.score does not satisfy this comparison.A condition that does not reference confidence can still match that case:
Take care with negated comparisons because NOT reverses the comparison result. Where a rule must positively establish an attribute, use an explicit positive comparison.
A field under a list matches when any element satisfies the comparison.Examples of supported paths under lists include:
Do not assume that comparisons on different list fields must refer to the same list element unless that behavior has been confirmed.

​
Use Playbook Inputs in Conditions

Conditions can reference supported inputs from the remediation playbook associated with the fact. Use this format: playbook.<normalized_input_name>
The supplied reference specifies the following normalization:
  1. Convert the input name to lowercase.
  2. Replace each run of spaces and punctuation with one underscore.
  3. Add the playbook. prefix.
For example:The field must correspond to an input from the selected playbook.
Conditions cannot reference:The supplied reference states that a condition naming an unsupported input is rejected when the fact is saved.
For a playbook containing a supported text input named Domain name:
Combine the input with case attributes:
This requires:
  • A malicious disposition.
  • Confidence greater than 85.
  • The playbook input to match example.com.
Referencing an input in a condition does not supply its value. The required input must still be available to the playbook.

​
🛡️ Sample Tested Condition (For Reference)

The comparison is strictly greater than 85. A score of exactly 85 is excluded.
Confidence does not affect this expression because it is not referenced.
Both listed dispositions are accepted when the confidence requirement is satisfied.
The parentheses ensure that the disposition and confidence requirements apply to both allowed severities.

​
Additional Information

  • Start with a narrow condition and verify it against known case values.
  • Test matching and nonmatching cases.
  • Include threshold boundaries and missing values in testing.
  • Use parentheses when combining AND and OR.
  • Keep the fact description aligned with its executable condition.
  • Review playbook inputs whenever you change the selected playbook.
  • Configure expiration for temporary rules.
  • Remove test facts after testing.
  • Review execution outcomes when validating automation.
  • 📧 Contact AirMDR Support through your designated support channel.
When requesting help, provide: