how detections are updated from stale to closed???

areefshaik2 — Fri, 08 May 2026 07:45:27 GMT

how detections are updated from stale to closed???

auto close rules are apply only to open detections which are last scan or last found more than 45 days or 90 days? then auto close rules are updated the detections to stale .... then how stale detections are moved to closed?? what is actually process???

Re: how detections are updated from stale to closed???

pr8172510 — Fri, 08 May 2026 12:18:48 GMT

Hi @areefshaik2,

As per ServiceNow Vulnerability Response behavior , detections generally move through the lifecycle:

Open → Stale → Closed

The Auto Close Rules primarily evaluate Open detections based on conditions like Last Found date, Last Scan date, or scan inactivity thresholds (for example 45 or 90 days). When those conditions are met, the detection is first moved to Stale instead of directly closing it.

The reason ServiceNow uses the Stale state is to avoid false closures in scenarios where:

the asset has not scanned recently,
scans failed,
or the vulnerability temporarily stopped reporting.

After a detection remains in Stale state and subsequent scans continue to confirm that the vulnerability is no longer detected, scheduled lifecycle jobs in Vulnerability Response move the detection from Stale to Closed automatically.

Auto Close Rules: Open → Stale
Subsequent validation/scheduled lifecycle processing: Stale → Closed

You can also review this behavior from:
Vulnerability Response → Administration → Auto Close Rules
and related Scheduled Jobs handling detection lifecycle processing.

question how detections are updated from stale to closed??? in Community Central forum

how detections are updated from stale to closed???

Re: how detections are updated from stale to closed???