Skip to main content

Bulk Actions

When your Action Centre contains dozens or hundreds of findings, acting on them one at a time is impractical. Bulk actions let you select multiple findings and perform the same operation on all of them in a single step -- whether that is remediating, acknowledging, or suppressing.

Available Bulk Actions​

Guardian Pro supports three bulk actions:

ActionEffectUse Case
RemediateApplies automated remediation to all selected findings that support it.Fix a batch of similar issues at once (for example, enable encryption on 20 S3 buckets).
AcknowledgeMarks all selected findings as acknowledged. They remain visible but no longer affect the health score.Accept known findings that you have reviewed but cannot or choose not to fix immediately.
SuppressSuppresses all selected findings. They are hidden from default views and excluded from the health score.Permanently accept risk for findings that do not apply to your environment or are mitigated by other controls.

Selecting Findings​

Individual Selection​

Click the checkbox next to any finding to add it to your selection. A selection bar appears at the top of the Action Centre showing the number of selected findings and the available bulk actions.

Select All (Visible)​

Click the Select All checkbox in the header to select all findings currently visible on the page. This respects your active filters and lens, so you can filter first and then select all matching results.

Selecting from Smart Groups​

Smart Groups integrate directly with bulk actions:

  1. Expand a Smart Group to see its individual members.
  2. Use Select All within the group to select every member.
  3. Or select specific members within the group.

This is one of the most efficient workflows in the Action Centre -- find a Smart Group of related issues, select all members, and remediate the entire batch.

tip

Combine filters with Smart Group selection for precise batch operations. For example, filter by Region: us-east-1, expand a Smart Group, and select all members to remediate only the findings in that specific region.

Bulk Remediation​

Bulk remediation follows the same safe workflow as individual remediation, with additional batch-specific features.

Preview​

When you click Remediate Selected, Guardian Pro generates a batch preview that shows:

  • Total findings -- How many findings will be remediated.
  • Remediation summary -- A grouped view of the changes that will be applied.
  • Resources affected -- A list of all resources that will be modified.
  • Findings without remediation -- Any selected findings that do not support automated remediation are listed separately and excluded from the batch.
  • Risk assessment -- An aggregate risk assessment for the batch.

Execution​

After confirming the batch preview:

  1. Guardian Pro queues all remediations for execution.
  2. Each remediation runs independently -- a failure on one resource does not prevent the others from proceeding.
  3. Progress is tracked in the Remediation Activity Monitor at the bottom of the Action Centre.

Results​

After execution completes, you will see a summary:

  • Successful -- Findings that were remediated successfully.
  • Failed -- Findings where remediation encountered an error, with details.
  • Skipped -- Findings that were excluded (no automated remediation available).
caution

Review the batch preview carefully before confirming, especially when remediating a large number of findings. While each remediation is independently safe, a large batch of changes may have cumulative effects on your environment (for example, modifying dozens of security group rules simultaneously).

Bulk Acknowledge​

Acknowledging findings in bulk is useful when you have reviewed a set of issues and determined that they represent accepted risk or are being tracked through another process.

What Acknowledgment Does​

  • The finding status changes to Acknowledged.
  • The finding remains visible in the Action Centre but is excluded from the default view (you can see acknowledged findings by filtering for the Acknowledged status).
  • The finding no longer contributes to health score deductions.
  • The finding is still re-evaluated on subsequent scans. If the underlying issue is resolved, the finding will be automatically closed.

When to Use Acknowledgment​

  • You have reviewed the finding and understand the risk, but remediation is deferred.
  • The finding is being tracked in an external system (ticketing, JIRA, etc.).
  • The finding applies to a non-production environment where the risk is accepted.
  • A compensating control exists that mitigates the risk.
info

Acknowledgment is reversible. You can return an acknowledged finding to Active status at any time by selecting it and choosing to un-acknowledge.

Bulk Suppress​

Suppression is a stronger action than acknowledgment. Suppressed findings are hidden from the Action Centre by default and are fully excluded from the health score.

What Suppression Does​

  • The finding status changes to Suppressed.
  • The finding is hidden from the default Action Centre view. You must explicitly filter for Suppressed status to see suppressed findings.
  • The finding does not contribute to health score deductions.
  • The finding is still re-evaluated on subsequent scans. If the underlying configuration changes, the suppression remains in place until manually lifted.

When to Use Suppression​

  • The finding is a known false positive for your environment.
  • The finding relates to a resource or configuration that is intentionally set up this way.
  • An external control fully mitigates the identified risk.
  • The finding does not apply to your use case (for example, a development-only account where certain security controls are intentionally relaxed).
caution

Use suppression judiciously. Unlike acknowledgment, suppressed findings are hidden from default views, which means they can be easily forgotten. Periodically review your suppressed findings to ensure they are still appropriate.

Bulk Action Bar​

When you have one or more findings selected, the Bulk Action Bar appears at the top of the Action Centre:

  • Selection count -- Shows how many findings are currently selected.
  • Remediate button -- Available when at least one selected finding supports automated remediation.
  • Acknowledge button -- Always available for active findings.
  • Suppress button -- Always available for active findings.
  • Clear Selection -- Deselects all findings.

The bar remains visible as you scroll through the findings list, so you can continue selecting items and then execute the bulk action when ready.

Combining Bulk Actions with Filters and Lenses​

Bulk actions are most powerful when combined with the filtering and lens capabilities of the Action Centre:

Example Workflow: Fix All Quick Wins​

  1. Select the Quick Wins lens.
  2. Click Select All to select all Quick Win findings.
  3. Click Remediate Selected.
  4. Review the batch preview and confirm.
  5. Monitor progress in the Remediation Activity Monitor.

Example Workflow: Acknowledge All Low-Severity Findings​

  1. Filter by Severity: Low.
  2. Click Select All.
  3. Click Acknowledge Selected.
  4. All low-severity findings are acknowledged and excluded from the health score.

Example Workflow: Suppress Known Exceptions by Service​

  1. Filter by Service: EC2 and Severity: Medium.
  2. Select the specific findings that are known exceptions.
  3. Click Suppress Selected.

Audit Trail​

All bulk actions are recorded in the audit trail. The audit entry includes:

  • Who performed the action.
  • When it was performed.
  • Which findings were affected.
  • What action was taken (remediate, acknowledge, suppress).
  • For remediations: the outcome for each finding (success, failure, skipped).

Frequently Asked Questions​

Is there a limit on how many findings I can select?​

There is no hard limit on selection count. However, for very large batches (hundreds of remediations), Guardian Pro processes them in manageable chunks to ensure reliability.

Can I undo a bulk acknowledgment or suppression?​

Yes. Filter the Action Centre to show Acknowledged or Suppressed findings, select the ones you want to revert, and change their status back to Active.

What happens if some findings in a bulk remediation fail?​

Each finding is remediated independently. Failures on individual findings do not affect the others. After the batch completes, you will see a summary showing successes and failures, with error details for any failures.

Next Steps​