> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation.md).

# Deploy ASM and Exposure Management enrichment and remediation automation

The Cortex Exposure Management pack enables you to automate attack surface management (ASM) and vulnerability issue enrichment and remediation. This content pack includes playbooks that streamline the remediation process by enriching issues with contextual information gathered from out-of-the-box integrations with sources like CMDBs, Cloud Service Providers, and VM solutions, and by automatically remediating some types of ASM and runtime vulnerability issues.

{% hint style="info" %}

### Note

For details and requirements regarding the enrichment information that can be collected and the specific issues that can be remediated automatically, review the Exposure Management Content Pack information in Marketplace.
{% endhint %}

Complete the tasks below to enable automated enrichment and remediation of ASM and vulnerability issues.

**Task 1. Install the Cortex Exposure Management content pack**

Install the Cortex Exposure Management content pack and, optionally, the related content packs.

1. Navigate to Settings → **Configurations** → **Marketplace** → **Browse** and locate the Cortex Exposure Management content pack.
2. Select the content pack and review the contents and other details.
3. Click **Install** to add the content pack to the **Cart**.

   The \*\*Cart \*\*displays the number of items you are installing, including any additional required content packs. It also displays relevant optional content packs.
4. (Optional) Select the related content packs you want to install, for example ServiceNow and AWS Enrichment and Remediation.
5. Click **Install**.

**Task 2. Add automation rules for ASM and vulnerability issue enrichment and remediation**

Add the automation rules for exposure management issue remediation and enrichment. Automation rules trigger the Cortex Exposure Management playbooks to run on ASM and vulnerability issues. To learn which issues will trigger the playbooks, review the automation rules.

1. Navigate to **Investigation & Response** → **Automation** → **Automation Rules**.
2. Click **View Recommendations**.
3. Select one or more of the Cortex Exposure Management automation rules.
4. Click **Add Selected Rules**.

**Task 3. Set up integrations**

Install and configure relevant 3rd-party integrations, such as ServiceNow and AWS, to enable the Cortex Exposure Management playbooks to collect enrichment information and to automatically remediate some issues.

1. Navigate to **Settings** → **Data Sources & Integrations**.
2. Select the row of the integration you want to add and click **Add Instance**.
3. Add the parameters, as required.
4. **Save & Exit**.

See the Exposure Management Content Pack for a list of supported integrations. See [Integrations](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations.md) for more detailed information about setting up integrations.

**Task 4. Configure vulnerability policies**

The Cortex Exposure Management playbooks run on specific types of issues. Review your vulnerability policies to make sure issues are being created for relevant vulnerability findings. For information about vulnerability policies and how to configure them, see [Vulnerability policies](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-policies.md).

{% hint style="info" %}

### Note

Cortex Exposure Management playbooks only run on issues that were created after the automation rules have been configured.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.