Remediation Strategies
A remediation strategy is a method for fixing a remediation subject. It answers the question: “how do we remediate this?” A subject like Chrome might have multiple strategies — update via package manager, update via script, or uninstall entirely. Furl picks the best one based on confidence score and what the endpoint supports.
How strategies work
Section titled “How strategies work”Strategies combine a type (what to do) with an execution method (how to do it).
Strategy types
Section titled “Strategy types”| Type | Description |
|---|---|
| Update | Upgrade to the latest or a fixed version |
| Patch | Apply a specific patch |
| Uninstall | Remove the software entirely |
| Configure | Change a configuration to mitigate the issue |
| Manual | Human-performed remediation with instructions |
Execution methods
Section titled “Execution methods”| Method | Description |
|---|---|
| Package manager | Use apt, Chocolatey, Homebrew, etc. |
| Script | Run a remediation script on the endpoint |
| Manual | Provide instructions for a human to follow |
Strategy sources and visibility
Section titled “Strategy sources and visibility”Strategies come from different sources with different visibility:
| Tier | Source | Who can use it |
|---|---|---|
| Global | Curated by the Furl team | Everyone |
| Community | Opted-in customers | Opted-in customers only |
| Organization | A single customer | That customer only |
Most subjects already have one or more global strategies, so you typically don’t need to author your own to get started.
Creating an organization strategy
Section titled “Creating an organization strategy”When the default strategy for a subject doesn’t fit your environment, you can author your own. A common reason: your team already has a tested PowerShell script for installing Chrome that handles your specific GPO settings.
- Pick the subject — strategies are always attached to a remediation subject, not to a CVE or a finding.
- Pick the type — update, patch, uninstall, configure, or manual.
- Pick the execution method — package manager, script, or manual.
- Provide the implementation:
- For package manager strategies, supply the package identifier (e.g.,
google-chrome-stable). - For script strategies, supply the script body and any preflight requirements.
- For manual strategies, write the instructions the end user (or an admin) should follow.
- For package manager strategies, supply the package identifier (e.g.,
- Save. The new strategy is available immediately for scope matches; over time, its confidence score updates based on real outcomes.
Organization overrides
Section titled “Organization overrides”Instead of authoring a brand-new strategy from scratch, you can override the default strategy for a subject by creating a client remediation policy. This lets a team say “for Chrome, always use our custom script instead of the global package manager strategy” without disabling the global strategy for everyone else.
Strategy selection
Section titled “Strategy selection”When a target is ready for remediation, Furl picks a strategy in this order:
- Check for organization overrides — if you’ve defined a client remediation policy for this subject, use it.
- Find compatible strategies — filter by subject, by execution method compatibility (does the endpoint support the package manager? scripts?), and by OS.
- Rank by confidence score — pick the highest-confidence compatible strategy.
Selection is conservative by design: a strategy that has worked reliably in the past is preferred over a newer or less-tested option.
Related
Section titled “Related”- Remediation Subjects — strategies are defined per subject
- Strategy Executions — the record of running a strategy
- Confidence Score — how reliable a strategy is
- Remediation Targets — strategy selection happens when a target is ready
- Governance — controls whether a chosen strategy auto-executes