When a remediation task will be auto-closed after its resolved

[sath]

Hi,

Few of our remediation tasks were put in resolved state about a month back and they were auto-closed yet. It should be auto-closed during everyday imports, right?

Should resolved remediation tasks be closed manually? 

[andy_ojha · Accepted solution]

Hey there,

Be careful with that assumption - there is no real "Auto-Close" specifically for Remediation Tasks...

The State lifecycle of the Remediation Task, moving to Closed (with some flavor of substate -> Fixed, Cancelled, etc.) -- is driven by the related Vulnerable Items / Detections, and their target Closure State resolution values like Fixed, Stale, etc.

Think of the State on the Remediation Task, being automatically adjusted through a roll-up, driven by the States of the related Vulnerable Items -- when all related Vulnerable Items transition to some form of "Closed" state...

Reference from docs

• https://docs.servicenow.com/bundle/vancouver-security-management/page/product/vulnerability-response...
• "Note: The Closed/Fixed state is a special case. For the vulnerable items that are set to the Closed/Fixed state, if all vulnerable items within a remediation task are set to Closed/Fixed — such as when a scanner finds that all the vulnerabilities have been remediated — the remediation task is automatically marked as Closed/Fixed."
  
• https://docs.servicenow.com/bundle/vancouver-security-management/page/product/vulnerability-response...
• Rollup of VI states to remediation tasks (VUL)

  State precedence: Open > Closed - Fixed > Closed - Stale.

  1. If any VIs in a VUL (remediation task) are Open, the VUL state is not changed.
  2. If at least one VI is Closed - Fixed and the rest are Closed - Stale, the VUL state transitions to Closed - Fixed.
  3. If all the VIs in a VUL are Closed - Stale, the VUL state transitions to Closed - Canceled.