Requesting feedback to see if anyone has changed the IRE default for "Operation Status" (which is "Operational") for Vulnerability Response create CIs.
1) Qualys scans a server and detects a vulnerability.
2) VIA the SN VR API we consume that vulnerability for that Server.
3) As part of the VR ingestion process the CI lookup rules/IRE is triggered. If the server with the vulnerability does not match to a server in the CMDB it creates an unmatched CI in the CMDB and appears to set the Status to "Operational".
The question is: Rather than having the Operation Status set to "Operation" for the newly VR created unmatched CI, has anyone changed IRE to set the Operational Status to something other than Operational? Would this be recommended or not?
Thanks
