Vulnerability moving to Closed state when the scan confirms remediation

[Lorenzo8]

Dear ServiceNow Community,

I am currently helping out on the implementation of ServiceNow VR for a large organization and I am trying to better understand the scanner integration (Qualys in my case). If I understand correctly, Vulnerability Items in the Resolved state will automatically move from Resolved to Closed when the next scan confirms the fix. In turn, if all VITs within a group are set to Closed/Fixed, (manually, or by the scanner integration) the vulnerability group is automatically marked Closed/Fixed as well (source).

My questions are:

• What happens if VITs are remediated but not moved to the Resolved state? Will the integration with Qualys move those VITs to the Closed state even thought they are currently not in the Resolved state? In other words, does the state of a VIT need to be Resolved in order for the Qualys rescan to move the VIT to the Closed state or the VIT will be moved to Closed regardless of its current state?
• Does the VIT state influence the vulnerability group state only when the VIT state is set to Closed? In order works, if all VITs in a group are moved from Open to Under Investigation, or from Under Investigation to Awaiting Implementation, does the state of the group change accordingly, or it only does in the case of the Closed state?

Thanks a lot to everyone who can give me some more specific answer on this! 🙂

[jing3 · Accepted solution]

When scanner find the Vulnerability no longer exists (closed), servicenow VR will close the VIT, SN will move the VIT to Closed regardless of its current state. 

VIT state only influce VUG state when Closed. Individual VIT state will be set by VUG state (if current VIT state is lower than VUG state), Otherwise, VIT state will not update VUG state with the exception of VIT in Close state. 

[rd063]

Hi @jing3 
Could you please tell me which script is responsible for it ?

[YlliK]

Any luck finding it? I have a requirement from the customer that, when the scanner is showing some VITs as fixed if the VIT is on deferred state, it is not closing it automatically, any idea about that?

[VaranAwesomenow]

@YlliK were you able to resolve it.