diff --git a/articles/remediating-the-xz-vulnerability-with-fleet.md b/articles/remediating-the-xz-vulnerability-with-fleet.md
index 861b4dd548..495e2f93bd 100644
--- a/articles/remediating-the-xz-vulnerability-with-fleet.md
+++ b/articles/remediating-the-xz-vulnerability-with-fleet.md
@@ -2,24 +2,23 @@
-Detecting and remediating software vulnerabilities is more crucial than ever.
+Detecting and remediating software vulnerabilities is more critical than ever.
-`CVE-2024-3094` recently exposed a critical vulnerability in the `xz` libraries. This vulnerability, which can open backdoors on systems with `xz` installed starting from version 5.6.0, particularly affects `sshd` authentication.
+`CVE-2024-3094` exposed a vulnerability in the `xz` libraries. This vulnerability, which can open backdoors on systems with `xz` installed starting from version 5.6.0, particularly affects `sshd` authentication.
Fleet is known for its ability to provide real-time insights and manage devices across platforms.
Because of this, we wanted to test using Fleet to build an end-to-end remediation workflow for `CVE-2024-3094`. The following case study looks at Fleet’s strengths and some areas where improvements could be made when using Fleet for this type of remediation.
-
## Discovery
The initial step involved leveraging Fleet's quick search capability, known as _live query_, to locate `xz` on Fleet’s computers.
-This underscored Fleet's strength in identifying vulnerable software. It also revealed a limitation: out-of-the-box software search capabilities in the Fleet UI only gathered information about `xz`via the [homebrew_packages](https://fleetdm.com/tables/homebrew_packages) osquery table.
-
+This highlights Fleet's strength in identifying vulnerable software. It also revealed a limitation: out-of-the-box software search capabilities in the Fleet UI only gathered information about `xz` via the [homebrew_packages](https://fleetdm.com/tables/homebrew_packages) osquery table.
By adding saved queries like the ones below, Fleet can be customized to search for software like `xz` in more places across multiple computer platforms:
+
**This query checks for libraries related to xz on a Linux system:**
@@ -31,9 +30,9 @@ UNION ALL
SELECT * FROM programs WHERE name LIKE '%xz%';
```
-
> Running queries with wildcards may greatly impact Fleet Host performance.
+
**This query checks for xz installations on a Linux system:**
@@ -77,15 +76,12 @@ SELECT * FROM syslog WHERE message LIKE '%xz%';
SELECT * FROM file_events WHERE target_path LIKE '%/xz';
```
-
> Enabling File Integrity Monitoring requires modification of the Fleet configuration. For more information, see [file integrity monitoring (FIM)](https://fleetdm.com/guides/osquery-evented-tables-overview?utm_source=fleetdm.com&utm_content=table-yara_events#file-integrity-monitoring-fim) in the Fleet documentation for more information.
For more information on gathering data from Fleet Hosts, see the [Fleet osquery table schema documentation.](https://fleetdm.com/tables/account_policy_data)
-
## Remediation
-
### Policy logic
Fleet’s Policy feature allows admins to craft custom SQL queries that run on Hosts enrolled in Fleet. A Policy is effectively a pass/fail test based on a query result.
@@ -96,26 +92,19 @@ In some use cases, SQL query logic is not always well-suited for returning pass
The Policy should fail _if and only if_ the targeted file is found.
-
+**Query explanation:**
-Query explanation:
-
-
-
-* The “inner” query returns true if the file exists
-* The “outer” query returns the value 1 if the “inner” query determination is false
+* The “inner” query `(SELECT 1 FROM homebrew_packages WHERE name = 'xz' AND version >= '5.6.0')` returns true if the file exists
+* The “outer” query `SELECT 1 WHERE NOT EXISTS` returns the value 1 if the “inner” query determination is false
A Policy failure event generates the webhook to trigger our remediation automation.
-
### Scripts
Below is a script that will:
-
-
* Determine if the `xz` package was installed via Homebrew
* Update Homebrew if `xz` is detected
@@ -152,37 +141,18 @@ else
fi
```
-
-Integrating a third-party automation solution is required to execute this script if it is stored in Fleet. To complete the remediation workflow, the third-party solution must:
-
-
-
-* Receive the webhook sent from the Fleet Policy failure event
-* Use the webhook as a trigger to send an HTTP request to the Fleet API to execute the script
-
-Here is a [Tines](https://www.tines.com/) workflow integration that performs these steps, remediating vulnerable Fleet Hosts:
-
-
-
-
-
-It is non-optimal to require a 3rd party solution for executing scripts. It would be ideal to have the ability in Fleet to find and remediate vulnerable Hosts via a Fleet-only workflow.
-
+> Fleet added the ability to automatically execute scripts on Policy failures in version 4.58 - see: https://fleetdm.com/guides/policy-automation-run-script for more infromation.
## Opportunities
This case study illuminates Fleet's capabilities and, hopefully, will open a dialogue for improvement in the following areas:
-
-
* Enhancing Fleet UI search capabilities
* Simplifying Fleet Policy features to allow for more intuitive query logic
-* Adding Script execution capabilities in Fleet to streamline admin workflows
Efforts to mitigate the `xz` vulnerability at Fleet allowed us to gain valuable insights. By acknowledging current capability limitations, we intend to pave the way for future enhancements that will make Fleet a comprehensive device management solution - much more than just a tool for detection and data collection.
-