Conclusion

Workshop Complete

Congratulations — you’ve completed the Defend, Contain, Comply workshop.

What you built

Over this workshop, you managed a complete vulnerability lifecycle:

Phase What Happened AAP Capabilities Used

DEFEND

Critical CVE detected → automated containment in seconds

EDA webhooks, rulebooks, workflow triggers, firewalld, SELinux

CONTAIN

Errata published → OPA policy-gated patch with approval and evidence

Workflow templates, approval nodes, OPA queries, set_stats, reporting

COMPLY

System audited → CIS-hardened → evidence generated → container delivered

OPA compliance queries, sysctl/SSH/service hardening, HTML reporting, Podman build/scan/push

Business outcomes demonstrated

  • Mean-time-to-contain: From 45+ minutes (manual SSH) to seconds (EDA + workflow)

  • Policy enforcement: Zero patches applied without passing OPA policy gates

  • Audit readiness: Compliance reports generated automatically with before/after evidence

  • Provable compliance: 13 OPA-audited, CIS-hardened controls with per-control pass/fail

  • Supply chain trust: Every container image traceable to specific advisory remediation

Architecture recap

The complete flow you automated:

Splunk Alert → EDA Webhook → Containment Workflow
                                    ↓
                          Patch Available Notification
                                    ↓
                    OPA Policy Gate → Approval → Patch → Verify → Report
                                                                    ↓
                                            Compliance Audit → CIS Harden → Re-Audit → Report
                                                                                          ↓
                                                                  Container Build → Scan → Push

Feedback

Your feedback helps improve this workshop. Please share your experience with the facilitator or submit issues to the workshop repository.