Confused about Remediation Task Rules, when do they run/trigger?

[Ketil Ellertsen]

Hi!

I have set up a remediation task rule, that groups based on assigned_to field and vulnerability. When I click the reapply button, it correctly deletes all existing VULs related to the rule and creates new, which contain any VIT meeting the condition. 

However, when new VITs are created these are not automatically added to existing VULs, even though they satisfy the conditions. I saw in the documentation that only VULs created through condition filter/filter groups that are updated automatically. If that is the case, what is the point of having these Remediation Task Rules? It feels like I am missing something. 

The remediation task rule in question:

[Stephen Laseau]

Missed your other question.  During insert, VITs are only assigned to groups that are in a state of "Open".  If no open group meets the logic of a remediation task rule, then a new group is created.  Therefore, you can have multiple groups based on the same remediation task rules, just in different states such as "Open", "Under Investigation" or "Closed".

[Ketil Ellertsen]

Hi Stephen!

Thank you for your reply. So that probably means that something is wrong on my side. Whenever I create new VITs manually they are not added to existing VULs nor does it create new VULs. But it does work when I use the reapply button in the remediation task rule. 

Do you have any suggestion on how to fix this? Where to begin to look?

Thanks!

[Stephen Laseau]

If it meets the condition of the remediation task rule then it should join an Open group or create it.  Make sure the rules are Active and there is not some condition that is not being met.

Review a VIT you manually created and scroll to the bottom to the Vulnerability Groups/Remediation Tasks related list.  Is nothing showing there?  If not, you must not be meeting all of the criteria or the rule must not be active. 

There is also a Case Sensitive checkbox on the rules - perhaps that is the issue?

Perhaps provide a screenshot of your rule.

[William Froger]

That's very enlightening, thanks.

I've tried to set a business rule in order to automatically assign a remediation task to a specific user.

Does the Business Rules apply before the remediation task rules ?

[Stephen Laseau]

Best practice is to use the Remediation Task Rules to handle assignment.  Cannot help beyond that.