What happens to open detections when a VIT is closed

[Yamsanibhavani]

Hello Everyone,

We encountered a situation where a VIT was closed with the reason field as "invalid". The worknotes mention the following:
Additional Information: Closed because of CIs do not match
Closed by: SecCommon System
Closed VIT (VITXXXXXXX) and created VIT (VITXXXXXX)
However, detections related to this VIT are still in an open state

My Question is: What happens to open detections when a VIT is closed in this manner? Are they transferred to the new VIT, or do they remain orphaned? Any guidance on how this process works would be appreciated.

[Community Alums]

Hi @Yamsanibhavani ,

I haven't encountered this kind of issue before. Have you checked whether the CI is active or has been decommissioned?

Regarding question:
What happens to open detections when a VIT is closed this way? Are they carried over to a new VIT, or do they remain orphaned? Any clarification on how this process functions would be helpful.

If a VIT is closed while detections are still open, a new VIT will be created for those open detections.

[Yamsanibhavani]

Hi @Community Alums 

Thanks for your response.

Are they carried over to a new VIT, or do they remain orphaned? - Yes, this is my question, However, there is only one VIT record with this issue, that open detection is still under closed VIT and no new VIT is created for the open detection.

Thanks

Yamsani Bhavani

[Community Alums]

Hi @Yamsanibhavani ,

"CIChangeProcessorBase" This  is the script include responsible for this 

I see the same comment mentioned in the script include.

Regards,

Sneha