AssurIQ

Remediation Playbook Library

Each playbook documents the trigger, the risk, the recommended fix, how the fix is validated, how to recover, and the evidence AssurIQ generates. Playbooks with an engine key can be launched as Fix Center jobs from the in-product library.

Critical KEV Vulnerability on Internet-Facing AssetRunnable

A vulnerability listed in CISA's Known Exploited Vulnerabilities catalogue is present on an internet-facing asset, such as the SSL-VPN service on Summit Ridge Auto Group's sr-ford-fw01 FortiGate.

Trigger: A finding matches a CVE present in the CISA KEV catalogue and the affected asset has an internet-facing interface or service.
Privileged Account Without MFARunnable

A privileged directory role (Global Administrator or equivalent) is assigned to an account that has not registered a strong MFA method, as seen with a BrightPath Dental privileged Microsoft 365 account.

Trigger: Identity evidence from Microsoft 365/Entra ID or Active Directory shows a privileged role assignment with no registered MFA method, or MFA satisfied only by a weak method such as SMS where policy requires phishing-resistant methods.
Unsupported Windows EndpointRunnable

An endpoint is running a Windows version that has reached end of support, as with BrightPath Dental's OAK-FRONTDESK-03 workstation.

Trigger: Asset inventory evidence shows an installed OS version past its vendor end-of-support date.
Exposed Management InterfaceRunnable

A firewall, switch or server management interface (SSH, HTTPS admin, RDP, WinRM) is reachable directly from the internet.

Trigger: Attack surface scanning finds a management protocol port open and reachable from an external vantage point.
IoT Device on Corporate VLANRunnable

A non-corporate or IoT device, such as the Summit Ridge showroom TV, was moved onto the corporate VLAN through a switch configuration change on sr-acc02 port Gi1/0/14.

Trigger: Configuration diff or device classification shows a device without corporate management (no domain join, no EDR) attached to a VLAN designated for corporate assets.
Collector Offline

A site's collector, such as the Lakeside clinic collector, has stopped sending heartbeats, pausing discovery, scanning and evidence collection for that site.

Trigger: No heartbeat received from a collector within the expected interval (AIQ-COL-001).
Collector Enrollment Failed

A newly installed collector did not complete enrollment: the token was rejected, expired or revoked, or the host could not reach the AssurIQ control plane.

Trigger: A collector stays in Enrollment Pending past the token expiry, or the installer reports AIQ-ENR-001 through AIQ-ENR-004.
Vendor Assessment Overdue

A third-party vendor's risk assessment or attestation has passed its scheduled review date without renewal.

Trigger: A vendor record's next-review date has elapsed without an updated assessment or attestation on file.
Evidence Gap on a Control

A control has no current evidence within its required cadence, so it is reported as EVIDENCE GAP rather than PASS, PARTIAL or FAIL.

Trigger: A control's most recent evidence is missing or older than its defined cadence.
Failed Validation After Remediation

A remediation job completed its steps, but the post-fix validation check did not confirm the vulnerability or misconfiguration was actually resolved.

Trigger: A remediation job's validation step returns a failure after the job's action steps reported success (AIQ-RMD-005).
Lost, Stolen or Compromised Mobile DeviceRunnable

A business-owned phone or tablet with corporate accounts is lost, stolen or shows a failed integrity check — like the clinician iPhone reported lost with an active Microsoft 365 session.

Trigger: User report, provider lost-mode flag, or a failed Play Integrity / jailbreak signal on a device with corporate access.
In-product library: open Remediation → Playbooks to customize steps per partner or customer and run them against live findings.