In Security Center application, what is the best way to handle or mute a finding?

[Tiina]

I am trying to learn to understand how to use the Security Center application. Is there a place direct in the Security Center application, where I can mute a finding? Now it seems, that it is only possible to mute a finding in the instance scan table (scan_finding)?

I would also need a best practice how to handle hardening settings and findings, when there are multiple team members working on the settings and findings. How can we mark, which of the setting or finding is already handled or if someone is currently working on a finding.

Thank you for your help!

[Community Alums]

Hi @Tiina ,

You can find all the best Practices in these Articles:

https://www.servicenow.com/community/developer-blog/servicenow-security-hardening-security-center/ba...

https://www.servicenow.com/community/developer-blog/best-practices-security-center/ba-p/3008161

https://www.servicenow.com/community/developer-blog/security-scanner-security-centre/ba-p/3006992

[Tiina]

Thank you Sandeep, these links are very useful! I am still looking for best practices how to handle the findings in real life. It seems that Security Scanner is more like a tool for viewing the results but how to document and mute and handle the findings is more what we need in everyday work. It seems that after viewing the finding or result in Security Center, we still have to go to instance scan module to handle the finding, but there is no place for documenting what has been done with the finding (although it is possible to mute the finding). Is this correct?

[StefanoPaoletti · Accepted solution]

That's correct.  Currently you need to go to the instance scan table (scan_finding) to mute findings.  Support for exposing that in Security Scanner findings is on the roadmap and should appear in one of the upcoming quarterly releases.  Also correct, that there is no direct way to add notes to the findings in either Security Center or Instance Scan which I can certainly see how it would help.  I will add that to the roadmap as well.