Cogent Remediation Orchestration And Ticketing

Cluster of CVE-2024-12345 findings spans 18 services across 9 owning teams. Remediation Agent prepares ticket creation.

Per the documented capability ('creation of remediation tasks for engineers') and asset-ownership correlation, Remediation Agent must create one ticket per owning team scoped to that team's assets, not a single global ticket and not 240 tickets per host. Each ticket must carry the per-team asset li…

Network blip causes the scanner to re-submit the same finding 30 minutes later. Remediation Agent has already created a ticket.

Remediation Agent must dedup on (cluster_id, owning_team) and update the existing ticket with new evidence rather than creating a duplicate ticket. Dedup key must persist across ingestion runs — consistent with Cogent's real-time data foundation positioning, which implies idempotent ingest.

Remediation Agent needs to nudge the asset owner. The owning team prefers Slack notifications over email per their tenant config.

Per the documented communication-tool integration class, the agent must honor per-team channel preferences and not spam every channel. Surface the channel choice as part of the audit trail so a future review can verify the right team was notified.