Question about VR and default setup

[rita_m]

Hi - 

A few years ago, we had a consultant company build our VR application to our company's design specs. 

It was recently discovered that Vulnerability Group records (sn_vul_vulnerability) aren't having their active field set to false when the state is updated to resolved.  This is apparently how it has been since the consultants had the VR application go live; I'm supposed to not only fix the bug but to fix all historical data.

However, in order to fix this problem, I'd like to know first how it's handled in the default VR application; if the issue doesn't happen there, I'd like to return at least part of our application to system default as part of fixing the problem if possible. But there's been an issue with ServiceNow PDIs for quite some time now and I haven't been able to get a temporary default instance running that I can use to check the default VR build. It's gotten to the point I need to get this development done very quickly if I'm going to make the next release cycle.  So I'm reaching out to the community.

How does the default VR application update sn_vul_vulnerability table tickets to active=false when they are set to state=resolved (101)?  Is it a business rule?  What's the sys_id of this business rule, of so? Could I get the current default script code for ?

We're on Xanadu patch 8 the VR apps we have installed include the following: 

Much thanks!

[Martin Dewit]

I ran Debug Business Rules and closed a VUL record. From the logs there could be a couple OOB ways that active is set to false. I see "mark closed" and "Task Active State Management" on the Task table (extension of sn_vul_vulnerability). I could not find anything within Vulnerability Response that sets active to false, which leads me to these Task Business Rules. 

I would recommend running the same Debug in your instance to see what kind of results you get.