Triage vulnerability remediation with the Security RX Agent

Public preview

This feature is currently available as a public preview and is subject to change. For more information, see our pre-release policies.

The Security RX Agent assesses a vulnerability in the context of your tech stack and turns it into a suggested remediation plan. When Security RX identifies a vulnerability, the agent triages the CVE, provides an analysis, drafts step-by-step remediation recommendations, and can open a Jira ticket or GitHub issue in the affected repository — triggering a coding agent you already use (such as GitHub Copilot, Claude, or a custom agent) to initiate a fix via pull request for your team to review.

With the Security RX Agent, you can:

Triage and understand a vulnerability in context, including uncovering live signals of potential exploitation.
Move from finding a vulnerability to a remediation plan without leaving New Relic.
Use your existing GitHub coding agent (such as Copilot, Claude, or your own agent) to initiate a fix.
Keep a human in the loop — triage the creation of issues and pull requests to let your team review and merge.

Important

The Security RX Agent uses generative AI to provide a suggested remediation path. Remediation paths are suggestions. A human should carefully review them before implementation.

Prerequisites

Before you onboard the Security RX Agent, make sure you have:

Security RX Apps enabled for your account, with your account opted in to the Security Agent public preview.
An Organization Manager role in New Relic to create connections.
A GitHub personal access token (PAT) for the account or organization that owns the repositories you want to remediate. The token needs Issues: Read and write permission on those repositories.
A GitHub coding agent installed and enabled on the repositories you want to remediate (for example, the GitHub Copilot coding agent, the Claude GitHub app, or your own agent). This setup is done in GitHub by a repository or organization administrator.

Conseil

The coding agent must be enabled per repository. GitHub Issues must also be enabled on each repository you select. If either isn't enabled on a repository you select, the Security RX Agent still creates the labeled issue, but your agent won't act on it until you enable both there.

Set up the Security RX Agent

Onboarding is a guided wizard you complete once to connect the Security RX Agent to the destinations where it files work — GitHub (issues for your coding agent to fix) and Jira (tickets for your team). The wizard has four steps:

GitHub configuration → Jira configuration → Review → Finish

To start, go to one.newrelic.com > Security RX > Security Agent, then select Onboard Security Agent.

GitHub configuration

Connect the GitHub destination and choose how the Security RX Agent triggers your coding agent.

Select or add a GitHub connection. Choose an existing connection, or add a new one by entering your GitHub GraphQL URL (for GitHub.com: https://api.github.com/graphql) and a personal access token (PAT) with Issues: Read and write.
Select repositories. New Relic lists the repositories your token can access. Choose the ones where you want the Security RX Agent to raise remediation issues (an allow-list).
Choose a remediation trigger. Pick how each issue is handed to your coding agent — Assignment, Comment (trigger phrase), or Workflow (label). See Choose a remediation trigger for details.

Select Continue.

Jira configuration

Connect the Jira destination where the agent files remediation tickets.

Field	What to enter
Select or add Jira connection	An existing Jira connection, or a new one created with your Jira site URL and auth method.
Space/project	The Jira project where remediation tickets are created.
Jira issue type	The issue type used for created tickets (for example, Task or Bug).
Jira org ID	Your Jira organization ID.
Jira priority ID	The priority assigned to created tickets (for example, High or Critical).

Select Continue.

Review

Review your selections across both destinations — GitHub connection, selected repositories, and remediation trigger; Jira connection, space/project, issue type, and org ID. Return to any step to change a value before continuing.

Finish

Confirm to activate the Security RX Agent. From then on, when you begin a workflow to remediate a vulnerability, the agent files the work in the destination you chose — creating a GitHub issue (and triggering your coding agent) or a Jira ticket — with the suggested remediation plan attached.

Choose a remediation trigger

Coding agents are triggered in different ways. Choose the trigger that matches the coding agent you use. The Security RX Agent always creates the issue and applies the srx-remediate label; the trigger determines how your agent is invoked.

Trigger	How it works	Use this for
Assignment	The Security RX Agent assigns the issue to your coding agent, which starts working when assigned.	GitHub Copilot coding agent, Claude, and custom agents.
Comment (trigger phrase)	The Security RX Agent posts a comment containing a trigger phrase you configure (for example, `@claude fix` ). Your agent watches for that phrase and starts working.	Claude, and custom agents that respond to a comment phrase.

Trigger

How it works

Use this for

Assignment

The Security RX Agent assigns the issue to your coding agent, which starts working when assigned.

GitHub Copilot coding agent, Claude, and custom agents.

Comment (trigger phrase)

The Security RX Agent posts a comment containing a trigger phrase you configure (for example,

@claude fix

). Your agent watches for that phrase and starts working.

Claude, and custom agents that respond to a comment phrase.

Assignment trigger

When you choose the assignment trigger, New Relic shows the coding agents that can be assigned in your selected repositories and you pick one. When the agent creates an issue, it assigns that issue to your chosen agent, which begins work and opens a pull request.

Requires the coding agent (for example, copilot-swe-agent for Copilot) to be enabled and assignable on the repository.
Creates the issue even if a repository doesn't have the agent enabled, and adds a comment noting it couldn't be assigned there.

Comment (trigger phrase) trigger

When you choose the comment trigger, you provide the trigger phrase your agent listens for (for example, @claude fix). After creating the issue, the agent posts a comment with that phrase, which starts your agent.

Requires your agent to be installed and configured to watch for that phrase (for example, the Claude GitHub app, or your own agent).
Uses a phrase specific to your agent — use the phrase your agent documents.

How remediation works

Once the Security RX Agent is configured, the remediation flow works as follows. Each step passes the agent's analysis and remediation plan to the next, so your coding agent starts with context about where the vulnerability runs, not a bare CVE number:

Select a vulnerability — In Security RX, open the Security Agent and select a vulnerability to address.
Review the analysis — Review the agent's analysis of the vulnerability, including its impact, importance, and relevant metrics.
Generate a remediation plan — Select the affected entities you want to fix and choose a remediation mode. Review the generated plan that outlines the fix and identifies the associated GitHub repository.
Create an issue — Select Create GitHub Issue. This automatically generates an issue in your repository containing the full remediation plan.
Trigger the workflow — Depending on your configured trigger mode, confirm that the issue has been assigned to your coding agent or that the trigger phrase has been posted.
Open a pull request — Wait for your coding agent to open a pull request with the fix.
Review and merge — Your team reviews the pull request and merges the fix as appropriate.