Threat was not auto-remediated – Red Canary Support

Issue

Autoremediate is not working. A Threat was not marked as remediated even though a Playbook including the "Mark Threat as Remediated" action was triggered.

Environment

Red Canary Automate

Resolution

If any action for the Playbook is skipped - as opposed to succeeding or failing - the Playbook will never mark a Threat as remediated. Red Canary will not give a false sense of a successful remediation when in fact some actions weren't completed (for any reason).

For example:

This Threat had items that were skipped because there was no IOC on which to act. Because the items were skipped, this would never automatically mark as remediated.