RemediationPolicy

The tenant’s remediation policy (triage policy in the console): the remediation window per severity band, the triage threshold, and the CVSS scores that separate the bands. Exposure reports grade against it, compliance reports cite it, and jail COUNT_PAST_SLA rules read its windows. One per tenant. Either adopt a published standard as it is, so reports cite the standard, or declare your own windows. Saving your own never edits the policy earlier snapshots and reports cite: it saves a new revision and points the tenant at it.

apiVersion	vulnetix.com/v1
kind	RemediationPolicy
Group	Prioritisation
Status	Served. The config engine plans and applies it.
Objects per tenant	one (metadata.name: default)
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists RemediationPolicy in its kinds. See Management tokens.
Terraform resource	vulnetix_remediation_policy, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.157.0 and later.
Pinned schema	v1.15.0/RemediationPolicy.schema.json
Newest schema	latest/RemediationPolicy.schema.json
First released in	v1.1.0
Print the built-in copy	vulnetix config schema RemediationPolicy

Minimal

Only the fields the kind requires. From examples/RemediationPolicy/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  standard: nist-800-40

HCL (resource vulnetix_remediation_policy)

# Only the arguments the kind requires. From config-schemas examples/RemediationPolicy/minimal.yaml.

resource "vulnetix_remediation_policy" "default" {
  standard = "nist-800-40"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  standard: nist-800-40
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/RemediationPolicy/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
# Two alternative forms of the one tenant policy: apply one or the other.
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
  labels:
    team: platform-security
  annotations:
    ticket: https://jira.example.com/browse/SEC-2213
spec:
  description: Tighter than NIST for internet-facing estates.
  remediationDays: { critical: 7, high: 30, medium: 90, low: 180 }
  allowanceDays: { critical: 2, high: 7, medium: 14, low: 30 }
  triageThresholdDays: 2
  exposureWindowDays: 14
  threatWindowDays: 30
  suppressionReviewMaxAgeDays: 180
  severityThresholds: { high: 8.9, medium: 6.9, low: 4.0 }
---
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  standard: fedramp

HCL (resource vulnetix_remediation_policy)

# Every argument the kind supports. From config-schemas examples/RemediationPolicy/advanced.yaml.

resource "vulnetix_remediation_policy" "default" {
  allowance_days = {
    critical = 2
    high     = 7
    low      = 30
    medium   = 14
  }
  description          = "Tighter than NIST for internet-facing estates."
  exposure_window_days = 14
  remediation_days = {
    critical = 7
    high     = 30
    low      = 180
    medium   = 90
  }
  severity_thresholds = {
    high   = 8.9
    low    = 4
    medium = 6.9
  }
  suppression_review_max_age_days = 180
  threat_window_days              = 30
  triage_threshold_days           = 2
  labels = {
    team = "platform-security"
  }
  annotations = {
    ticket = "https://jira.example.com/browse/SEC-2213"
  }
}

# Or, instead (one per tenant, so declare only one):
#
# resource "vulnetix_remediation_policy" "default_2" {
#   standard = "fedramp"
# }

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
# Two alternative forms of the one tenant policy: apply one or the other.
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
  labels:
    team: platform-security
  annotations:
    ticket: https://jira.example.com/browse/SEC-2213
spec:
  description: Tighter than NIST for internet-facing estates.
  remediationDays: { critical: 7, high: 30, medium: 90, low: 180 }
  allowanceDays: { critical: 2, high: 7, medium: 14, low: 30 }
  triageThresholdDays: 2
  exposureWindowDays: 14
  threatWindowDays: 30
  suppressionReviewMaxAgeDays: 180
  severityThresholds: { high: 8.9, medium: 6.9, low: 4.0 }
---
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  standard: fedramp
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly RemediationPolicy	Always RemediationPolicy.
metadata	object	yes		no other keys	Metadata for a kind the tenant has exactly one of. The name is fixed to default.
metadata.name	string	yes		exactly default; pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes
spec.standard	string	yes, in the standard form		baseline-cvss, nist-800-40, fedramp, essential8, cisa-bod-19-02	A published standard, adopted as it is: baseline-cvss (Baseline CVSS), nist-800-40 (NIST SP 800-40), fedramp (FedRAMP), essential8 (Essential 8), cisa-bod-19-02 (CISA BOD 19-02).
spec.description	string	no
spec.remediationDays	object	yes, in the custom form		no other keys	Days to remediate a finding in each band. Windows that do not widen as severity falls are accepted with a warning: they are usually transposed.
spec.remediationDays.critical	integer	yes		1 to 3650
spec.remediationDays.high	integer	yes		1 to 3650
spec.remediationDays.medium	integer	yes		1 to 3650
spec.remediationDays.low	integer	yes		1 to 3650
spec.allowanceDays	object	no		no other keys	Grace days past each band’s window before a finding counts as past its SLA.
spec.allowanceDays.critical	integer	no	0	0 to 3650
spec.allowanceDays.high	integer	no	0	0 to 3650
spec.allowanceDays.medium	integer	no	0	0 to 3650
spec.allowanceDays.low	integer	no	0	0 to 3650
spec.triageThresholdDays	integer	yes, in the custom form		1 to 3650	Days by which a new finding must be triaged. Longer than the critical window is accepted with a warning.
spec.exposureWindowDays	integer	yes, in the custom form		1 to 3650	The exposure window, in days.
spec.threatWindowDays	integer	yes, in the custom form		1 to 3650	The threat window, in days.
spec.suppressionReviewMaxAgeDays	integer	no	365	1 to 3650	How long a suppression may go without being re-affirmed before reports call it overdue.
spec.severityThresholds	object	yes, in the custom form		no other keys	The CVSS base scores that separate the severity bands, as the published standards define them. They must increase: low < medium < high.
spec.severityThresholds.high	number	yes		0 to 10
spec.severityThresholds.medium	number	yes		0 to 10
spec.severityThresholds.low	number	yes		0 to 10

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	Exactly one of these holds: (1) the standard form (standard); (2) the custom form (description, remediationDays, allowanceDays, triageThresholdDays, exposureWindowDays, threatWindowDays, suppressionReviewMaxAgeDays, severityThresholds).

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.
• Singleton. There is one per tenant, and its name is always default.

How apply treats it

A named standard links the published policy row. Custom windows save a new row and move the OrgTriagePolicy pointer, so the object keeps its name and older rows stay as the snapshots that cite them saw them.

Terraform and OpenTofu

The resource is vulnetix_remediation_policy in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_remediation_policy.

Import an object that already exists by its name (default):

# Import an existing RemediationPolicy by its name (metadata.name).
terraform import vulnetix_remediation_policy.default default

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/RemediationPolicy/custom.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  description: Tighter than NIST for internet-facing estates.
  remediationDays: { critical: 7, high: 30, medium: 90, low: 180 }
  allowanceDays: { critical: 2, high: 7 }
  triageThresholdDays: 2
  exposureWindowDays: 14
  threatWindowDays: 30
  suppressionReviewMaxAgeDays: 180
  severityThresholds: { high: 8.9, medium: 6.9, low: 4.0 }

examples/RemediationPolicy/standard.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/RemediationPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: RemediationPolicy
metadata:
  name: default
spec:
  standard: nist-800-40

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.