Active
TMM Created
RHEL CVE Remediation
AI triage with Lightspeed MCP
Description
When a CVE alert arrives, an AI triage agent queries Red Hat Lightspeed for errata availability and reads the host environment from AAP inventory. Dev hosts with a fix available auto-patch through Gitea and AAP. Production hosts pause for human approval with a full audit trail. When no remediation exists, a second agent investigates CVSS, Advisor recommendations, and installed packages, then posts a structured report to Mattermost.
Why it matters
- Lightspeed MCP supplies live vulnerability and remediation data, so routing is based on errata availability and host environment, not guesswork.
- Production patches require explicit approval; dev patches run unattended. Governance matches how enterprises actually operate.
- The investigate path gives SREs actionable context when Red Hat has not yet shipped a fix, instead of a dead-end alert.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Manual trigger
Starts a workflow when a user clicks Run in the UI or calls the workflow execution API — the simplest entry point for on-demand runs like demos, break-glass remediation, or operator-initiated changes. No extra configuration is required, and runs appear in history with the triggering user as the source.
-
AI & integrations
Task agent
Adds LLM reasoning to a workflow — the step receives a natural-language prompt, can call enabled tools, and returns structured output that downstream steps reference through expressions. Use it for unstructured data (logs, tickets, alerts) to summarize, classify, triage, and recommend remediation actions; pair with an approval step for human oversight.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
Approval
Approval step
Pauses the branch and creates an approval request; an approver reviews context, approves or rejects, and the workflow continues on the matching path. Place approvals before destructive or production changes, with configurable approver users/groups, a decision window, and fallback behavior if no one responds in time.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
-
Action steps
Script step
Runs Python or Bash to parse, transform, or reshape data between steps — for example, normalizing an API response before a Task agent or AAP job consumes it. Lightweight alternative to launching a playbook; test with mock upstream output in the builder before publishing. Disabled by default until execution-plane capabilities are available in your deployment — intended for demos and early evaluation today. Additional scripting languages may be supported later based on demand.
-
AI & integrations
MCP integration
Model Context Protocol server tools that Task agents can call to read or change external systems — inventory, ITSM, vulnerability data, and more. Configure integrations under Integrations so agents work with live platform data instead of hallucinating context, choosing which tools each agent can access.
Interactive Experience
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "CVE Alert", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "AI Triage Agent", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "Route Decision", pos: "b", h: 96, constraint: "on" }
C -->|Auto-Patch Dev| D1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Fetch & Commit to Gitea", pos: "b", h: 96, constraint: "on" }
D1 --> D2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Sync & Deploy via AAP", pos: "b", h: 96, constraint: "on" }
D2 --> D3@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run CVE Remediation", pos: "b", h: 96, constraint: "on" }
C -->|Approval Prod| E0@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/approval-node.png", label: "Approve Production Patch", pos: "b", h: 96, constraint: "on" }
E0 -->|Approved| E1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Fetch & Commit to Gitea", pos: "b", h: 96, constraint: "on" }
E1 --> E2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Sync & Deploy via AAP", pos: "b", h: 96, constraint: "on" }
E2 --> E3@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run CVE Remediation", pos: "b", h: 96, constraint: "on" }
C -->|Investigate| F1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "No Known Remediation", pos: "b", h: 96, constraint: "on" }
F1 --> F2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/script-node.png", label: "Parse Investigation Result", pos: "b", h: 96, constraint: "on" }
F2 --> F3@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Notify Mattermost", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D1,D2,D3,E0,E1,E2,E3,F1,F2,F3 noBorder
Switch routing
| Route | Condition | Action |
|---|---|---|
auto_patch |
Dev host + errata available | Fetch playbook from Lightspeed, commit to Gitea, sync AAP, run patch |
approved_patch |
Production host + errata available | Human approval, then same fetch-sync-run pipeline |
investigate |
No errata or host not affected | AI investigation → structured Mattermost report for SRE review |
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
cve_fetch_and_commit.yml
|
Downloads the Lightspeed-generated remediation playbook and commits it to Gitea for AAP project sync. | localhost (Lightspeed MCP + Gitea) |
cve_sync_and_deploy.yml
|
Syncs the AAP project from Gitea, creates a scoped job template for the CVE playbook, and launches it. | localhost (AAP API) |
notify_mattermost_cve.yml
|
Posts a structured CVE investigation report to Mattermost when no errata is available. | localhost (Mattermost API) |