Reopening of Closed VIs by the VR System

[Patrik Z]

Hello,

a client has several VIs that have been reopened by the VR System after being Closed so I'd just like to ask about the following scenario that occurred:

1. VI is Deferred by a user
2. VI is Closed (Substate is Fixed) by VR System
3. Detection Last Found is updated
4. VI is Opened by VR System (I assume based on the update of the Detection last found date)

And my questions are whether that's how it's supposed to work OOTB? I mean, shouldn't a new Detection record be created instead of updating the old one?

Also, they don't like a Closed VI to be reopened - what is reopening the VIs, I'd say it's the scanner (they use Qualys) but could it be something else?

Thank you in advance, guys.

Patrik

[joe_harvey · Accepted solution]

Hey Patrik,

On their own, VR's reaction to each scanner result seem reasonable:

• A VI is Closed when the scanner indicates that it has been remediated
• A Closed VI is reopened when the scanner indicates that the situation exists again

The end result is frustrating, a VI that should be Deferred ends up as Open. This is probably an edge case that will not happen very often but you can request an enhancement if you feel it is warranted.

The code where VR makes the determination on reopening a VI is in Script Include DetectionBase. Basically, if the VI State/Substate is Closed/Fixed or Closed/Stale or Resolved, it is reopened.

Regarding the question of creating a new VI vs. reopening the existing one, you can probably make a case for either option. I think that having all of the detections in one VI may help to keep track of the Close/Reopen cycle and help figure out why it is occurring.

I hope that this helps,
--Joe

[cmcclendon]

Hi Patrik. We are going through the same issue with Qualys reopening closed VIs. It is very frustrating for the customer.

-Chris

[RameshM1]

We had this issue in December 2021. and then our team had resolved it or atleast found a reasonable explanation. Will check with my team and revert.

[arun_kumar79]

Hi Ramesh,

could you provide more info on how your team has resolved this issue?

Any points would be appreciated, 

Thankyou