How CloudRelo's SaaS Agent Works
From ingestion to automated resolution, see how CloudRelo connects your security scanners to intelligent, policy-aware remediation.
Connect your existing scanners.
Generate secure API keys within CloudRelo and add them to your webhook configurations in Wiz, AWS Security Hub, or GCP Security Command Center. When a vulnerability is found, the scanner immediately sends the payload to our SaaS platform.
Validate against your specific rules.
Upload Markdown (.md) or text files to define security policies and guardrails for different groups of VMs or your entire organization. Before any action is taken, the CloudRelo agent checks the proposed remediation against your uploaded policies to ensure it doesn't violate your organization's compliance constraints.
Sample Guardrail Rules
- Environment Lock: Only apply automated updates to lower and dev environments.
- Maintenance Windows: Do not update production instances during active business hours.
- Impact Awareness: Only apply simple, non-disruptive patches to production that do not affect the running application.
- Restart Prevention: Do not update production if a kernel restart is required; automatically escalate and request team approval instead.
Review, Approve, and Verify.
If a proposed fix hits a strict guardrail (like a required kernel restart in production), the CloudRelo agent pauses and sends an interactive notification directly to your Microsoft Teams or Slack channels. Developers can review the context and click to approve or reject the action.
Once an action is executed, the agent validates that the target VM is fully up and running. Finally, it generates a comprehensive post-remediation report, sends an email summary to the security team, and logs all evidence securely in the CloudRelo SaaS dashboard.
Zero-trust, automated remediation.
Once the policy is validated, our intelligent LLM and Vector-powered agent determines the exact commands needed. Using Retrieval-Augmented Generation (RAG), the agent cross-references the vulnerability against a database of previous incidents and deep-level OS security studies. This ensures the LLM applies safe precautions before attempting any OS patches.
Using AWS IAM Roles (at the organization or account level) or GCP Workload Identity Federation, the agent assumes short-lived credentials to execute the fix directly—without requiring permanent inbound open ports.