Defer a container vulnerable item in Container Vulnerability Response

If you determine that the issue associated with a container vulnerable item (CVIT) is of low risk and can be immediately deferred without further analysis, you can use the Defer feature.

始める前に

Role required: sn_vul.vulnerability_admin or sn_vul.admin (deprecated)

Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see Assign the Vulnerability Response persona roles using Setup Assistant. For more information about managing granular roles, see Manage persona and granular roles for Vulnerability Response.

このタスクについて

A scheduled job runs every day checking for deferred vulnerable items that have reached their reopen date. On the day the CVIT's deferral is set to expire, the record is reopened.

手順

1. Navigate to All > Container Vulnerability Response > Container Vulnerable Items.
2. Open a vulnerable item.
3. Click Request Exception.
4. Fill in the fields on the form, as appropriate.

   Field	Description
   Until	Select the date when the Deferred state expires and the remediation task is reactivated. 注: Starting with version 18.0 of Container Vulnerability Response, if a deferred container vulnerable item (CVIT) is closed and reopened by a scanner before the exception window expires, the state of the CVIT reverts to deferred state honouring the active exception window. To enable this functionality, set the value of the system property sn_vul.container.auto_defer_cvit_in_active_exception_window to true. Additionally, the deferred Until date persists even after the vulnerable item gets closed or the exception expires. The role required is sn_vul_container.manage_exception_configuration for both read and write. After the record is submitted, if email notifications are defined, members of the Container Vulnerability Response group receive an email when the expiration date is within one week. When the defer date expires, the vulnerable item is set back to Open and a second email notification is sent out.
   Reason	Enter the reason for deferring the issue. Choices include: Awaiting maintenance window False positive Fix unavailable Risk accepted Mitigating control in place Other
   Additional information	Enter any other relevant information.

5. Click Submit.
   The group is marked In Review. A Reopen related link appears. The reopen date and reason appear in work notes under the State Change Approvals tab.

   Starting with Container Vulnerability Response v2.3, you can add relevant information in the Work Notes field in the Notes section for a deferred container vulnerable item.