VIT Records are still open after detection closed as stale

[Yamsanibhavani]

Hello Everyone,

Seeing VIT records are still open after the detections are closed as stale. Only few records fall under this issue, what might be the reason for this? I also saw there are few VITs which are closed as stale when the detections are closed as stale. 

I have already gone through this link - https://www.servicenow.com/community/secops-forum/behavior-of-auto-close-vi-on-retired-ci-within-vr-... , These seems working as some VITs are closing. Could anyone please suggest me a way to find the cause for this issue.

Thankyou in advance.

[bharanikumar20]

Hi, Auto close doesn't apply if the detections is manually marked in review or in progress 

[Yamsanibhavani]

Hi @bharanikumar20 , 

Thanks for replying.

The record is not edited or updated manually. I have checked the audit details of the current. No audits done on the record. Can you or anyone help me to get the reason why this is happened.

[Shaik Abdul Mu1]

@Yamsanibhavani , Can you check below

1. Check if there are multiple detections for one VIT, if any one detection is open, the VIT remain open.
2. Check if there are any active integration instances for VIT. Refer below from docs

**The Auto-Close Stale Detections scheduled job runs daily. The job determines whether you have selected the date when detections were last found or the date when assets were last scanned. It then transitions the corresponding detections to the Stale state. It's important to note that the Auto-Close Stale Detection feature only closes stale detections for active integration instances. Vulnerable items and detections associated with active integration instances are closed. Starting from v22.0 of Vulnerability Response the scheduled job has been modified to take into account the common table [sn_vul_cmn_auto_close_rule].

After the detections are marked as Stale, if the scanner reports finding that detection again, the Status field of the detections transitions to Open. The detection's corresponding vulnerable items are also reopened.**

Thanks

Abdul Musavvir

[Yamsanibhavani]

Hi @Shaik Abdul Mu1 ,

Thanks for the reply.

1) There are no multiple detections on the VIT, only there is single detection with stale state.

2) This VIT comes under active integration only, still it is not moving the state to closed. The Schedule job is running as expected. And to add, the last found date on detection is also very old.

Thanks 

Yamsani Bhavani