Skip to content
Furl Docs

Creating a remediation scope

A remediation scope is a standing policy: “keep this software healthy on these endpoints.” This guide walks through creating one by hand in the Furl UI.

Prefer to describe the rollout in plain language and let Furl compose the filters for you? Use the Forge assistant instead. This page covers the manual form.

Creating a scope requires scope write permission. If you don’t see the option to create a scope, ask an administrator to grant it.

Start a new scope

Section titled “Start a new scope”

Go to the Scopes page and choose to create a new scope. The scope builder opens as a form on the left with a live Preview panel on the right that updates as you set filters.

You’ll fill in four things: the scope’s basics, then the three filters that decide what it acts on — What to remediate, Where to remediate, and When / why to remediate.

Scope basics

Section titled “Scope basics”
  • Name (required) — a clear label such as “Critical Windows patches.” The name is how you’ll find the scope later, and it’s used as the ticket title if you link ticketing.
  • Description (optional) — a note on what the scope covers and why.
  • Update ring policy (optional) — attach a phased-rollout policy so matched endpoints are remediated in ordered stages instead of all at once. You can pick an existing policy or define one inline. See Update Rings.

What to remediate — the subject filter

Section titled “What to remediate — the subject filter”

This filter answers what software or configuration is in scope. At least one subject criterion is required for the scope to be saved.

  • Subject types — choose All software to match every software subject, or Configuration to match configuration subjects. Selecting All software covers everything and disables the individual pickers below.
  • Software — pin specific subjects from the catalog, such as Google Chrome. Searchable.
  • Vendor — pin a vendor to match every subject that vendor produces, now and as the catalog grows (for example, all software by Mozilla).

Where to remediate — the endpoint filter

Section titled “Where to remediate — the endpoint filter”

This filter answers where — which endpoints the scope applies to. All of these are optional. Leaving them empty means the scope isn’t narrowed on that dimension.

  • Endpoint — pin specific endpoints by search.
  • Endpoint owner — narrow to endpoints owned by specific people.
  • OS family — Windows, macOS, or Linux.
  • Agent — whether the endpoint has the Furl agent installed or not.
  • Tags — narrow to endpoints carrying specific tags.
  • Managed by / Not managed by — include or exclude endpoints based on which tool manages them. An integration you put in one list is hidden from the other, because naming the same tool in both would match nothing.

Start narrow. Filtering to a small endpoint group — a canary tag, a single team, a few owners — lets you watch outcomes before you widen the scope.

When / why to remediate — the finding filter

Section titled “When / why to remediate — the finding filter”

This filter decides which findings trigger remediation for a matched target. All settings are optional.

  • Finding types — vulnerability findings are the supported trigger today.
  • Minimum severity — Low, Medium, High, or Critical. A common starting point is High and above.
  • Minimum CVSS score — a floor from 0 to 10.
  • Minimum EPSS score and Minimum EPSS percentile — floors based on exploit-prediction scoring.
  • Actively exploited only — restrict to findings for known-exploited vulnerabilities.

Ticketing (optional)

Section titled “Ticketing (optional)”

If your organization has connected a ticketing integration such as Jira or Freshservice, a Ticketing Integration section appears. Pick a Ticketing System (and, for project-structured systems like Jira, a Project) to have Furl open and maintain one ticket for this scope. Leave it on None to skip. Full details are in Ticketing in a remediation scope.

Check the preview

Section titled “Check the preview”

As you set filters, the Preview panel estimates the scope’s coverage before you commit:

  • Matched targets — how many actionable targets the filters match.
  • Endpoints — how many endpoints are affected.
  • Open findings — outstanding findings across those targets.
  • Strategy coverage — how many matched targets already have a remediation strategy available.

Use the preview to confirm the blast radius. If strategy coverage is low, some matched targets won’t have an available fix yet.

Save and activate

Section titled “Save and activate”

Once the scope has a name and at least one subject filter, choose Create Scope. When the scope is active, Furl evaluates existing targets against its filters right away and starts remediation for matches. New targets discovered later are matched as they arrive.

You can pause, expand, or archive the scope afterward from its detail page. See Remediation Scopes for the full lifecycle and how matched targets become executions.

Section titled “Related”