Vulnerable Item state changed automatically by VR System user
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎11-15-2023 03:34 AM
Hi All,
In our environment at below cases , the VR system changing the state of the VITs automatically:
1. When the VITs are moved from deferred to open state it's getting reopened by the VR system user instead of the scanner , before the inbound to open getting received and the inbound failed stating the VIT is already in open state.
2. When VITs state changed to Open to Resolved state and when it's reopened again the VR system changing the state of the VIT to Under Investigation automatically.
3. When the VIT is closed , it reopened again by the VR system.
Kindly let me know what's the reason for this behavior , and how we could restrict this behavior of VR system.
#vulnerabilityResponse #VRModule #utah #VRsystemuser #secops
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎11-16-2023 06:47 AM
I don't understand the problem here. This sounds like the system is doing exactly what it was designed to do. I think you'll have to explain what your concern with this behavior is.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎11-16-2023 08:12 AM
Hi All,
I am also looking for reason on below cause:
1. When the VITs are moved from deferred to open state it's getting reopened by the VR system.
What makes VITs to move from deferred to open state?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎11-16-2023 08:48 AM
When a VIT is deferred, they are deferred until a date in the future, which is stored in the "Until" field on the VIT. Once the Until date is reached, the deferral expires, and the VIT is returned to its previous state. This is shown towards the lower right in the VIT state diagram in the link below. Hope this helps!
