Fixed Vulnerable Items are not changing to closed status even after detected closed/fixed by Qualys?

AndrewP · ‎05-05-2021

I am finding multiple vulnerable items that are remaining in Open status, even after Qualys no longer detects them. The Vulnerable Item Detection (DET#) shows them with a Status of Closed and a Source Status of Fixed, however the VIT# still shows as Open.

I believe the logic needed to update is in DetectionBase (QualysHostImportReportProcessor > Detection > DetectionBase). I have seen mention of Detection, but the bulk of the logic is in DetectionBase.

We are using VR version 12.1.4

Chris McDevitt · ‎05-06-2021

Hi,

First up, avoid customization to the Scripts Includes like the plague.

Second, keep an eye on the June Store release of VR and upgrade. (but if you customize the VR SI then it is much harder to upgrade....).

Third, take advantage of the "Close Stale Vulnerabilities"

https://docs.servicenow.com/bundle/quebec-security-management/page/product/vulnerability-response/task/vr-autoclosevi.html

And Auto delete rules:

https://docs.servicenow.com/bundle/quebec-security-management/page/product/vulnerability-response/task/enable-auto-del-vi-vg.html

Fourth,

Take a look at the VI's that are not closing. Drill down into the Detections. Are you seeing one Detection closed and another open? (one or more). Add "Detection Key" to the list view on the Detections list (related list). Are the keys different? Take a look at the Proof. Are they different? If the answer is yes, then this is most likely the issue. Again keep an eye on the June Store release.

It is hard to remote diagnose.... so...

View solution in original post

AndrewP · ‎05-05-2021

We tried to update line 730. "else if (!statesCounts["0"]..." to "else if (statesCounts["1"]..."

Shivam Sarawagi · ‎05-05-2021

Hi,

If you check any VI which is supposed to be fixed, How many Detections you see under it. Also, what is the state of those detections?

AndrewP · ‎05-06-2021

For VIs that have been fixed there is usually a first Open Detection with a status of Open and source status of Active. Then a second Closed Detection with a status of Closed and a source status of Fixed.

This appears to be affecting a large number of VIs that have already been patched.

Thanks!

Ashutosh Munot1 · ‎05-05-2021

HI,

Can you check if the state field is flipping between closed and open?

Are there any detections in open of other state apart from closed ones?

Thanks,
Ashutosh