Keystone workflows
8 workflows in the public catalog. Customers sign in to download them.
8 workflows
- Collect Linux baseline facts Collect every online Linux agent's security settings (keystone/linux-agent collect_facts) into the host-facts table. Evaluation is automatic: the write marks the compliance checks over host-facts due, and they are read on the next tick.
- File a table into a class Files a module's results table into objects of a class, so several modules can each fill their own attributes of the same objects. Start it with variables table (the table's path), object_class (the class key) and folder (where new objects go), or edit them in.
- Find known exploited packages Checks every installed package against OSV.dev, then each of its CVEs against CISA's Known Exploited Vulnerabilities catalogue, and files what is known to be exploited in a tracked table — so a newly listed one is a change the kev-package-found alert rule raises.
- Find vulnerable packages Check every installed package against OSV.dev and file the vulnerable ones in a tracked table, so a newly disclosed vulnerability is a change an alert rule can watch.
- Patch all Linux agents Patch every online Linux agent in this organization — or those in the given connection categories, such as a rollout ring's — with all available updates, confirm each patch run finished, and reboot only the hosts whose OS says a reboot is needed.
- Patch all Windows agents Patch every online Windows agent in this organization through the Windows Update Agent — from Microsoft Update, or the organization's WSUS server with only what is approved there — confirm each patch run finished, and restart only the hosts Windows says need it.
- Renew expiring certificates Renew every certificate a TLS scan found expiring within 30 days. Start it with the variable inventory set to the scan's data object, e.g. /TLS Network Discovery/agents.
- Restart down services (from an alert) Started by a trigger on alert.raised, bound to the metric object process_metrics files into (/Monitoring/process_metrics): runs restart-service-one once for each series the alert names, at once.
No workflows match . Show all workflows