VR "Expiration Notifications Not Firing" After Upgrading to Vulnerability Response v30x (USEM)

[sarah_bioni]

After migrating to Vulnerability Response v30x — the version that introduces Unified Security Exposure Management (USEM), a significant architectural upgrade to the Vulnerability Response applications — some teams report that legacy deferral/exception expiration notifications stop firing and that a familiar scheduled job appears to be "missing" from the instance.

This is working as expected. The legacy scheduled job and its associated notifications were intentionally replaced as part of the USEM re-architecture. This article explains the symptom, the root cause, how to validate the new mechanism, and what to review before and after the upgrade.

Symptoms

• The scheduled job "Check Vulnerable Item and Groups Deferment Expiration" can no longer be found in the instance.
• One or more of the following out-of-the-box (sn_vul scope) notifications no longer trigger:
  • False positive marked VIT is expiring — sn_vul.vi_marked_as_fp_expiring
  • False positive marked VI expired — sn_vul.vi_marked_as_fp_expired
  • Exception on VG expired — sn_vul.vg_exception_expired
  • False positive marked VG is expiring — sn_vul.vg_marked_as_fp_expiring
  • False Positive marked VG expired — sn_vul.vg_marked_as_fp_expired
  • Exception on VI expired — sn_vul.vi_exception_expired
  • Exception on VIT is expiring — sn_vul.vi_exception_expiring
  • Exception on VG is expiring — sn_vul.vg_exception_expiring

 

Root Cause

USEM is not an incremental feature release — it is an architectural change. USEM delivers a modernized Security Exposure Management Workspace, standardized data models, modularized remediation workflows, and a richer, role-based user experience, and it introduces a dedicated Exception Management application that provides a controlled process for requesting, reviewing, and approving exceptions to vulnerable findings.

As part of that consolidation, the legacy sn_vul scheduled job "Check Vulnerable Item and Groups Deferment Expiration" was removed by design and replaced with a new job that handles expiration processing under the unified exception model:

• Replacement job: Associate Findings with Exception Rules and Validate Expirations

Regards,

Sarah Bioni