Conclusion

Workshop Complete

Congratulations — you’ve completed the Defend, Contain, Comply workshop.

What you built

Over this workshop, you managed a complete vulnerability lifecycle:

Phase What Happened AAP Capabilities Used

DEFEND

Critical CVE detected → automated containment in seconds

EDA webhooks, rulebooks, workflow triggers, firewalld, SELinux

CONTAIN

Errata published → OPA policy-gated patch with approval and evidence

Workflow templates, approval nodes, OPA queries, set_stats, reporting

COMPLY

System audited → CIS-hardened → evidence generated → container delivered

OPA compliance queries, sysctl/SSH/service hardening, HTML reporting, Podman build/scan/push

Business outcomes demonstrated

  • Mean-time-to-contain: From 45+ minutes (manual SSH) to seconds (EDA + workflow)

  • Policy enforcement: Zero patches applied without passing OPA policy gates

  • Audit readiness: Compliance reports generated automatically with before/after evidence

  • Provable compliance: 13 OPA-audited, CIS-hardened controls with per-control pass/fail

  • Supply chain trust: Every container image traceable to specific advisory remediation

Architecture recap

The complete flow you automated:

Splunk Alert → EDA Webhook → Containment Workflow
                                    ↓
                          Patch Available Notification
                                    ↓
                    OPA Policy Gate → Approval → Patch → Verify → Report
                                                                    ↓
                                            Compliance Audit → CIS Harden → Re-Audit → Report
                                                                                          ↓
                                                                  Container Build → Scan → Push

Taking this further

  • Scale: Add more hosts to inventory and use job slicing for parallel patching

  • Real Splunk: Replace the simulated webhook with a live Splunk HEC integration

  • Image signing: Add cosign signing to the supply chain (provenance attestation)

  • GitOps: Trigger container builds from Git commits to the Containerfile

  • ITSM integration: Connect approval nodes to ServiceNow or Jira for change tickets

  • Extended compliance: Add SCAP or OpenSCAP scanning alongside OPA policy checks

Resources

Feedback

Your feedback helps improve this workshop. Please share your experience with the facilitator or submit issues to the workshop repository.