Hi,
The title may not be representative of what should necessarily be occurring but it's what I feel should occur based on the behavior. Has anyone seen an issue in which a VIT is reopened months or even a year after it was originally resolved, in which an entirely new VIT should be created in its place?
As an example, a machine may have a Microsoft Channel vulnerability listed and updating Office will result in the VIT auto-closing. It will, however, potentially reopen months or even a year (presumably even years later as we continue to use Vulnerability Response). This, in my opinion, should not be expected behavior, despite what https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1005922 may document. A VIT first discovered in, say, November of 2023 that is resolved, should not be re-opening nearly a year later just because the threat/summary is the same. An entirely new VIT should be opened, in my opinion. This hurts us because the remediation target dates are not updated so it appears that there are VITs nearly a year old when in reality the Office version/channel only recently became unsupported, not that a machine has been out of compliance for nearly a year.
We are on an older version of this integration and need to upgrade. Has anyone observed this same behavior in newer versions?
Example activity history of a VIT that will continue to re-open and re-close indefinitely:
