Remediation
Fixed by pull request.
Approved by a person.
REAEGIS prepares the fix, opens the pull request in your repository, and proves the result. A reviewer who is not the author approves every change.
ORION-1 / pull request #482
ApprovedRebuild api-gateway
on a hardened image
Opened by REAEGIS for finding 0482
SI-2
orion-1/api-gateway
Dockerfile
Removed: FROM node:20.11.0Added: FROM registry1.dso.mil/…/nodejs20:20.11.1
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
- Prepared by
- REAEGIS
- Reviewer
Maya Reyes- Merged
- 14:21
Enforced
AC-5 Reviewer is not the authorCM-3 Change recordedORION-1 / Remediation / pull request #482
ApprovedRebuild api-gateway on a hardened image
orion-1/api-gatewayDockerfile
# runtime baseRemoved: FROM node:20.11.0Added: FROM registry1.dso.mil/…/nodejs20:20.11.1WORKDIR /appCOPY --chown=node:node . .
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
- Prepared by
- REAEGIS
- Reviewer
Maya Reyes- Merged
- 14:21
Enforced
AC-5 Reviewer is not the authorCM-3 Change recordedORION-1 / pull request #482
ApprovedRebuild api-gateway
on a hardened image
Opened by REAEGIS for finding 0482
SI-2orion-1/api-gateway
Dockerfile
# runtime baseRemoved: FROM node:20.11.0Added: FROM registry1.dso.mil/…/nodejs20:20.11.1WORKDIR /app
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
- Prepared by
- REAEGIS
- Reviewer
- Maya Reyes
- Merged
- 14:21
Enforced
The same finding,
two ways to close it.
Finding 0482, a vulnerable container base image, followed from the first alert to a closed POA&M item.
By hand
Each step is a hand-off.
Nothing links one to the next.
Scanner alert
INBOXArrives by email or dashboard
Ticket
TICKETOpened and assigned by hand
Manual patch
SHELLApplied by an engineer
Screenshot as evidence
PNGPasted into a document
Spreadsheet
XLSX
POA&M updateRow edited by hand
Re-typed into the system of record
MANUAL ENTRYEntered again, field by field
Ends withA screenshot and a spreadsheet row
With REAEGIS
Each step is an event in one signed record.
Finding mapped to controls
FINDING 0482 · SI-2 · RA-5
AXIOMFix prepared
Hardened image, isolated branch
Iron BankAREPull request opened
#482 · orion-1/api-gateway
REAEGISReviewer approves
Maya Reyes, not the author
AC-5Three checks pass
Finding absent. Nothing new.
3 of 3RAMPART
Gate passes.POA&M item closes
with signed evidenceITEM 0117 · ANCHORED IN REKOR
CHRONICLE
Ends withOne signed record, anchored in Rekor
Code or infrastructure.
Each fix takes
its own path.
A vulnerable package and a misconfigured cluster are not fixed the same way. Each one goes to the right repository, the right checks, and the right approver.
- 01Finding
- 02Change
- 03Check
- 04Approval
- 05Verification
Code remediation
Packages, base images, application flaws
Vulnerable package or base image
FINDING 0482 · SI-2
Pull request to the application repository
Iron BankRebuilt on a hardened image
Re-scanned before review
Maya Reyes approves
Reviewer is not the author
Re-scan passes. Gate clears.
Confirmed in production
Infrastructure remediation
Cloud settings, cluster policy, STIGs
TLS 1.0 enabled at ingress
FINDING 0519 · SC-8
Pull request to the infrastructure repository
ingress.tf
Plan and policy check before apply
1 TO CHANGE · 0 TO DESTROY
Change control board approves
Boundary change recorded
Applied. Drift cleared.
Confirmed on the next sync
Code remediation
Packages, base images,
application flaws
- 01
Finding
Vulnerable package or base image
FINDING 0482 · SI-2
- 02
Change
REAEGISPull request to the
application repositoryDockerfileRemoved:FROM node:20.11.0Added:FROM registry1.dso.mil/…/nodejs20:20.11.1 - 03
Check
Iron BankRebuilt on a hardened image
Re-scanned before review
- 04
Approval
AC-5Maya Reyes approves
Reviewer is not the author
- 05
Verification
RAMPARTPHAROSRe-scan passes. Gate clears.
Confirmed in production
Infrastructure remediation
Cloud settings, cluster policy, STIGs
Infrastructure repository- 01
Finding
TLS 1.0 enabled at ingress
FINDING 0519 · SC-8
- 02
Change
REAEGISPull request to the
infrastructure repositoryingress.tfRemoved:min_protocol_version = "TLSv1_0"Added:min_protocol_version = "TLSv1_2" - 03
Check
Plan and policy check before apply
1 TO CHANGE · 0 TO DESTROY
- 04
Approval
CM-3Change control board approves
Boundary change recorded
- 05
Verification
RAMPARTPHAROSApplied. Drift cleared.
Confirmed on the next sync
One signed record, whichever path the fix took
CHRONICLE
- POA&M item closed
- Evidence signed
- Anchored in Rekor
Three checks pass, or the finding stays open.
Every fix is verified before its POA&M item can move. Each result is signed.
- PASS
Check 01: Original finding absent
from the re-scan14:02Finding 0482PRESENT
14:31Finding 0482ABSENT
- PASS
Check 02: No new findings introduced
14:0241 open findingsBASELINE
14:3140 open findings0 NEW
- PASS
Check 03: The gate that failed now passes
14:02VULNERABILITYFAIL
14:29VULNERABILITYPASS
Scanners that run the checks
OSV-ScannerTrufflehogNative auditFails closed. A failed check stops the pipeline and is recorded by CHRONICLE.
What it takes to close a POA&M item.
Five conditions, each with its own evidence. Then two phases: fix verified, production confirmed.
ORION-1 / POA&M / item 0117
ClosedBase image vulnerability, api-gateway
POA&M ITEM 0117 · FINDING 0482
SI-2RA-5
Change approved by a second person
MetApproval record. The reviewer is not the author.
AC-5Evidence produced: sha256:71c0…e9a4Time: 14:19
Pull request merged
MetMerge commit on the protected branch.
#482Evidence produced: sha256:b3f8…02d7Time: 14:21
Build succeeds
MetBuild log and image digest.
Evidence produced: sha256:0e6a…7c15Time: 14:24
Gate passes on the remediated branch
MetGate result, signed.
RAMPARTEvidence produced: sha256:d95b…48f0Time: 14:29
Three verification stages pass
MetRe-scan results from all three stages.
Evidence produced: sha256:4a27…bb61Time: 14:31
5 of 5 conditions met
Any unmet condition keeps the item open
ORION-1 / POA&M / item 0117 / closure
ClosedBase image vulnerability, api-gateway
POA&M ITEM 0117 · FINDING 0482
SI-2RA-5
| Condition | Evidence produced | Time | Status |
|---|---|---|---|
| Change approved by a second personAC-5Approval record. The reviewer is not the author. | sha256:71c0…e9a4 | 14:19 | Met |
| Pull request merged#482Merge commit on the protected branch. | sha256:b3f8…02d7 | 14:21 | Met |
| Build succeedsBuild log and image digest. | sha256:0e6a…7c15 | 14:24 | Met |
| Gate passes on the remediated branchRAMPARTGate result, signed. | sha256:d95b…48f0 | 14:29 | Met |
| Three verification stages passRe-scan results from all three stages. | sha256:4a27…bb61 | 14:31 | Met |
5 of 5 conditions met
Any unmet condition keeps the item open
Closes in two phases
- Phase 114:31Fix verified14:31
- Phase 215:04Production confirmed15:04
The ISSO validates the closure
Evidence chain
Signed- FINDING
- REMEDIATION
- VERIFICATION
- APPROVAL RECORD
- GATE PASS
Works with the network cable cut.
In an air-gapped deployment, a deterministic rule engine handles most findings inside the enclave.
RULE ENGINE COVERAGE
About 80%
of findings handled by the rule engine
in air-gapped deployments,
with no external service
ENCLAVE BOUNDARY · AIR-GAPPED
Inbound onlyCAC and PIV
- Finding
REAEGIS
Deterministic rule engineNo external service- Fix
- Internal log
- Rule engine, no external service
- Remaining findings
Authorization is not a destination. It is a system property.
Request a demo and we will walk one finding from detection to signed evidence.
- Request access
Federal programs
Invitation only, with CAC and PIV.
- Create a workspace
Commercial teams
Self-register with single sign-on.
- See pricing
Pricing
Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.