---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Bulk edit for false positive in the Security Exposure Management Workspace

# Bulk edit for false positive in the Security Exposure Management Workspace {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Mark one or more records (VITs, AVITs, CVITs, or TRs) as false positive concurrently using the bulk edit feature from the Security Exposure Management Workspace instead of manually selecting each item.

## Before you begin

Role required:

* sn_vul.vulnerability_analyst, sn_vul.vulnerability_admin, or sn_vul.remediation_owner for host vulnerable items (VITs)
* sn_vul.app_sec_manager, sn_vul.app_security_champion for application vulnerable items (AVITs)
* sn_vul_container.vulnerability_analyst, sn_vul_container.vulnerability_admin, or sn_vul_container.remediation_owner for container vulnerable items (CVITs)
* sn_vulc.admin, sn_vulc.remediation_owner for configuration test results (CTRs)
{#sem-bulk-edit-request-false-positive__ul_i2c_ypl_5fc}

## About this task

When you raise a false positive request for one or more records from the Bulk edit modal, a remediation task is created with the selected records.  
Note:  
When you raise a false positive request for the Application Vulnerable Items (AVITs) using the bulk edit feature, the AVITs from the scanners with the Manage False positive with Servicenow parameter set to false are not updated.  
* If you select AVITs from various scanners, some with the Manage False positive with Servicenow parameter set to true and other set to false, the AVITs linked to the scanners with the Manage False positive with Servicenow parameter set to false are not updated.
* If you select AVITs from only the scanners with the Manage False positive with Servicenow parameter set to false, the False positive option does not appear in the Reason field in the Bulk Edit modal.
{#sem-bulk-edit-request-false-positive__ul_wk3_b2t_hbc}  
You can mark records as Closed-False positive in bulk as a remediation owner, vulnerability manager, or vulnerability analyst. The records that are updated depend on your persona:

* Remediation owner: Only the records that are assigned to you or to your assignment groups are updated.
* Vulnerability manager or vulnerability analyst: All the records that meet the conditions you specify in the Bulk Edit modal are updated.
{#sem-bulk-edit-request-false-positive__ul-ro-scope-false-positive}  
Note:  
The options in the Reason field depend on your role and the record type:

* Host vulnerable items: If you have the sn_vul.remediation_owner role but not the sn_vul.close_vi_vg role, False positive is the only reason available.
* Application vulnerable items: If you have the sn_vul.app_security_champion role but not the sn_vul.app_write_all role, False positive is the only reason available.
* Container vulnerable items and configuration test results: False positive is the only reason available for all users.
{#sem-bulk-edit-request-false-positive__ul-fp-reason-by-role}

## Procedure

1. Navigate to WorkspacesSecurity Exposure Management WorkspaceList.  
   Note:  
   The selected records must be in the Open, Under Investigation, or Awaiting Implementation state.
2. On the List page, open Active or All list in one of the following lists:  
   * Host Vulnerable items
   * Container Vulnerable items
   * Application Vulnerable items
   * Configuration Test Results
   {#sem-bulk-edit-request-false-positive__ul_v5b_jzn_cbc}
3. Perform one of the following:  
   * Select the check box next to each item if you want to use the Only Selected Items option in the [Record selection](https://www.servicenow.com/docs/x~p_g0PPce1XvDT_s6bO8g#vmws-bulk-edit-request-false-positive__record-slection-field) field.
   * Apply filters if you want to use the All records that match filter option in the [Record selection](https://www.servicenow.com/docs/x~p_g0PPce1XvDT_s6bO8g#vmws-bulk-edit-request-false-positive__record-slection-field) field.
   {#sem-bulk-edit-request-false-positive__ul_xqd_4zn_cbc}
4. Select the Bulk Edit button.
5. On the form, select Closed in the State field, and select False Positive as the Reason to request false positive for multiple records.  
   For a description of the other field values, see [Bulk edit form fields](https://www.servicenow.com/docs/yiUUIn1AApvMb9qFj7Jazg "The following table shows the fields on the Bulk Edit modal in the Security Exposure Management Workspace. The fields that appear depend on the State or Risk rating value you select.").
6. Select Update.  
   Note:  
   If you have configured Questionnaire for false positive requests, this button is labeled Go to Questionnaire instead.
7. On the Take Questionnaire modal, answer the questions and select Submit.  
   A remediation task is created with the selected records. Your request is submitted for approval and the State of the remediation task changes to  In Review.  
   Note:  
   The Questionnaire modal appears only when the questionnaire is enabled for exception requests in the Exception Management form.
   * For more information on configuring a questionnaire for exception requests, see [Configure Exception Management for Vulnerability Response](https://www.servicenow.com/docs/nvJv1NSej6qBu9mMzQWItg "When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy."), [Configure Exception Management for Application Vulnerability Response](https://www.servicenow.com/docs/hUbQRfWpg0t_QP1QguWQmg "Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the module. By default, an exception is requested using the ServiceNow Application Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration."), and [Configure Exception Management for Container Vulnerability Response](https://www.servicenow.com/docs/~Llnd5KAUAjPxUmBbmcuVQ "Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the Container Vulnerability Response module. By default, an exception is requested using the ServiceNow Container Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration."), and [Configuration Compliance Exception Management overview](https://www.servicenow.com/docs/e~SV_zcAo5mGFmUjf3cUfQ "When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions for a remediation task that cannot be remediated according to the policy.").
   * In case you must modify your questionnaire, refer to KB2713229.
   {#sem-bulk-edit-request-false-positive__ul_q1t_wmn_5kc}

   The approver receives an email notification about your request.

## Result

In the Security Exposure Management Workspace, on the List page, navigate to ExceptionsAll, open the corresponding state change approval record (VCA#) and check the status of your request in the Approval state column:{#sem-bulk-edit-request-false-positive__table_cvb_bym_gbc__entry__2}

| Approval state | Result |
|-|-|
| Approved | The state of the Remediation Task transitions to Closed with the Reason as False positive. The state and reason are rolled down to the records. |
| Rejected | The state of the Remediation Task and its records doesn't change. |
[ ]

{#sem-bulk-edit-request-false-positive__table_cvb_bym_gbc}

In the Activity stream of a record or remediation task, you can view the entire workflow of your request.

*[\>]: and then