Skip to main content

Create a campaign from your assistant

Ask your AI assistant for a campaign in one sentence: « a campaign to remove CVE-2025-13465 by the end of the year ». It creates it in Astrolabe as a draft, with your rights, and gives you its link. You start it from Astrolabe and read which components the vulnerability hits.

Before you start​

  • Your assistant is connected to Astrolabe: see Connect your AI assistant.
  • Compass, Campaigns and Tech stack are on in Administration › Plugins. The campaign reads what the Tech stack tab of each component found: see See a component's tech stack.
  • You may create campaigns: your role gives you the rights compass.campaign.create and compass.assessment.create.

1. 💬 Ask your assistant​

  1. Ask your assistant, in your own words. For example:

    Create a campaign in Astrolabe to remove CVE-2025-13465 by 2026-12-31. Description: move lodash to 4.17.23 or later.

  2. Your assistant answers with the campaign: its name, Draft, how many components it covers, its check Not affected by CVE-2025-13465, and its link in Astrolabe.

The campaign is a draft unless you asked for it to start: say « and start it now » in your sentence to skip step 2.

2. 🚩 Start the campaign​

  1. In the left sidebar, click Campaigns. Your campaign is there, marked Draft.

  2. On its card, click Edit campaign (the pencil).

  3. Under Details, untick Mark as Draft.

  4. Click Next five times, through Checks, Filters, Milestones, Notifications and Review. The review shows Draft: No.

  5. Click Save. The message Campaign updated appears, and the card says Active.

3. 👀 Read which components it hits​

  1. On the Campaigns page, click the campaign.

  2. In the Components table, the column Not affected by CVE-2025-13465 gives a mark per component:

    You seeIt means
    passedThe component does not install a version the vulnerability affects.
    failedThe component installs an affected version: it has to move.
    not measuredAstrolabe could not tell. It counts neither for nor against the component.

    How the check reads a component: see Check a vulnerability in a campaign.

✅ That's it!

🔎 See what assistants wrote​

An administrator sees every campaign an assistant created.

  1. In the left sidebar, at the bottom, click Administration.

  2. Under INTELLIGENCE, click AI assistants, then the Calls tab.

  3. Tick Writes only. Each line marked Write is a change an assistant made, with its person, the tool (compass.create-campaign), when, and Succeeded or Failed.

❓ Frequently asked questions​

Can my assistant delete or change a campaign? No. It can create one; changing, cancelling or deleting a campaign stays in Astrolabe.

Can it create a campaign on other checks than a vulnerability? Yes. Ask it which checks exist (« which Compass checks can a campaign use? »), then name them in your request.

Which components does the campaign cover? Every component of the catalog.

🛠️ Troubleshooting​

Your assistant answers « You do not have the right compass.campaign.create. Ask your administrator for it. » Your role may not create campaigns. Ask your administrator for that right.

Your assistant answers « You do not have the right compass.assessment.create. Ask your administrator for it. » No check watches this vulnerability yet, and your role may not create one. Ask your administrator for that right, or ask them to create the check first.

Your assistant answers « Campaigns are turned off by your administrator. » Ask your administrator to turn Campaigns on in Administration › Plugins.

Your assistant answers « The Tech stack is turned off by your administrator: no vulnerability could be measured. Ask them to turn it on in Administration › Plugins. » Ask your administrator to turn Tech stack on in Administration › Plugins.

Your assistant answers « CVE 2025 13465 is not a CVE nor a GitHub advisory id (CVE-2021-44228, GHSA-35jh-r3h4-6jhm). » The id is misspelled. Write it as CVE-2025-13465 or GHSA-35jh-r3h4-6jhm.

Every component is « not measured » The components have not been analysed yet, or they do not lock the version of their dependencies: see the troubleshooting of Check a vulnerability in a campaign.