VR-Manual "close" option no longer available for VULs

[LeslieC]

Hello,

In a recent update (or maybe since we switched from using Rapid 7 to Tenable) we have lost the manual "Close" button for Remediation Tasks (VULs). The VUL will close automatically only if all VIT statuses are Closed - Fixed (substate). Many of our VULs remain open because of associated VITs with an "other" or "false positive" substate. What is the best option to fix this issue. We will always have these substates and these VULs are fixed per our environment, but never close. 

We have been manually moving the State to "Resolved" but that is considered "Active" so these VULs are staying in users work queues. A few questions:

1. Will the close button come back?

2. Can/Should we change business rules for closure to include the false positive and other substate?

3. Can we edit rules or configuration to make the VR "Resolved" state NOT active? 

What are the potential issues with either #2 or 3?

Thanks,

Leslie

[Community Alums · Accepted solution]

Hi @LeslieC 

If VULs remain open due to associated VITs in a substate like "Other" or "False Positive", you can use the Split functionality available in the Vulnerability Response (VR) module.

By using the Split feature, the VIT records that are preventing the VUL from being resolved will be separated, allowing the resolution process to proceed without obstruction.

Refer : https://www.servicenow.com/docs/bundle/washingtondc-security-management/page/product/vulnerability-r...

2. Can/Should we change business rules for closure to include the false positive and other substate?

Yes, you can customize the business rules to include these substates for VITs when evaluating whether a VUL is eligible for closure.

but you could misrepresent true exposure if a false positive was marked incorrectly.