> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Run Remediation Campaigns
> Use Privilege Zones to create bounded remediation campaigns with clear scope, ownership, and progress tracking.
Privilege Zones can support time-boxed remediation campaigns. A campaign zone is useful when a team needs to focus on a specific risk area, audit concern, executive priority, or application environment.
The zone can be used to create focus, drive remediation, and measure progress. After the campaign, the team can decide whether to keep the zone for ongoing monitoring or move to the next priority.
## Scenario
A security team receives an audit finding related to privileged access into a sensitive application environment. The organization does not yet have a complete enterprise tiering model, but it needs to show progress quickly.
The team creates a Privilege Zone around the systems in scope for the finding. The zone is used to identify unexpected control paths, prioritize remediation, and report progress during the campaign.
## What this can reveal
* Unexpected administrative paths into the scoped environment
* Overly broad groups that need to be reduced
* Service accounts that create hidden control paths
* Ownership gaps between application, IAM, endpoint, and infrastructure teams
* Progress over time as attack paths are removed
## Why this works
A campaign zone gives teams a bounded problem to solve. It reduces the pressure to model the entire enterprise before taking action. It also creates a practical way to communicate progress to leadership, audit teams, or application owners.
## Suggested workflow
1. Define the campaign objective.
2. Select the assets in scope.
3. Create a [zone](/analyze-data/privilege-zones/zones) around those assets.
4. Review [findings](/analyze-data/findings/attack-paths) and identify the highest-value remediation actions.
5. Assign remediation owners.
6. Track [reduction](/analyze-data/findings/posture) in attack paths over the campaign period.
7. Decide whether the zone should remain permanent or be replaced by the next campaign zone.
## Example campaign objectives
* Reduce attack paths into a payment environment
* Validate access into a clinical application
* Clean up administrative access to production infrastructure
* Prepare for an audit or remediate audit findings
* Reduce exposure before a major application migration
* Validate segmentation after a restructuring or acquisition
## Starter Cypher queries
These example Cypher queries help you identify candidate objects for zones and labels during discovery, trials, and early implementation.
Review and tune these queries before using them as production Privilege Zone rules.
### Migration or acquisition campaign discovery
```cypher theme={null}
MATCH (n)
WHERE toUpper(coalesce(n.name, '')) CONTAINS 'LEGACY'
OR toUpper(coalesce(n.name, '')) CONTAINS 'MIGRATION'
OR toUpper(coalesce(n.name, '')) CONTAINS 'ACQUIRED'
OR toUpper(coalesce(n.name, '')) CONTAINS 'OLD'
RETURN n
LIMIT 1000
```
### Audit or compliance campaign discovery
```cypher theme={null}
MATCH (n)
WHERE toUpper(coalesce(n.name, '')) CONTAINS 'SOX'
OR toUpper(coalesce(n.name, '')) CONTAINS 'PCI'
OR toUpper(coalesce(n.name, '')) CONTAINS 'HIPAA'
OR toUpper(coalesce(n.name, '')) CONTAINS 'AUDIT'
OR toUpper(coalesce(n.name, '')) CONTAINS 'COMPLIANCE'
RETURN n
LIMIT 1000
```
### Review immediate inbound relationships to campaign assets
```cypher theme={null}
// Replace Tag_Campaign with your campaign zone's tag label.
MATCH p=(s)-[r]->(t:Tag_Campaign)
WHERE NOT (s:Tag_Campaign)
RETURN p
LIMIT 1000
```
### Review multi-hop paths into campaign assets
```cypher theme={null}
// Replace Tag_Campaign with your campaign zone's tag label.
MATCH p=(s)-[:AD_ATTACK_PATHS*1..]->(t:Tag_Campaign)
WHERE NOT (s:Tag_Campaign)
RETURN p
LIMIT 1000
```
## Guidance
Campaign zones work best when paired with clear ownership and a defined time horizon. The zone creates visibility, but remediation still depends on the right teams taking action.
## Key takeaway
Privilege Zones can turn broad identity risk into a focused remediation campaign with clear scope, ownership, and measurable progress.