---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Grouping multiple findings as remediation tasks for easy processing using remediation task rules

# Grouping multiple findings as remediation tasks for easy processing using remediation task rules {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Grouping multiple findings as remediation tasks for easy processing using remediation task rules

Remediation task rules in ServiceNow enable vulnerability analysts and remediation teams to efficiently manage multiple findings by automatically grouping them into remediation tasks.
This automation eliminates manual task creation, streamlining remediation efforts and improving task management.
Show full answer Show less  

## Key Features

* **Remediation task rules:** Define criteria to group findings into remediation tasks based on attributes like vulnerability severity, configuration item, assignment group, risk score, technology, or attack vector.
* **Group By criteria:** Up to six criteria can be used to configure how findings are grouped, allowing flexible and precise task assignment.
* **Execution modes:**
  * **Match All (default):** Evaluates all applicable rules; a finding may belong to multiple remediation tasks.
  * **Match First:** Evaluates rules sequentially and applies only the first matching rule; each finding is assigned to one remediation task.
* **Automatic task creation and updating:** When findings are created, imported, or updated, remediation task rules evaluate and assign them appropriately, either adding to existing tasks or creating new ones.
* **Automatic re-evaluation:** When assignment group or preferred solution fields change on findings, tasks can be automatically re-evaluated and reassigned by enabling the relevant system property.
* **Manual reapplication:** Rules can be manually reapplied to update groupings and tasks based on changes to findings or rule configurations.
* **State synchronization:** Changes in remediation task states roll down to associated findings, and when all findings reach a common terminal state, their collective state rolls up to the remediation task.
* **Assignment management:** Assignment groups and assignees from remediation tasks roll down to findings unless overridden, ensuring consistent ownership.

## Practical Application for ServiceNow Customers

By configuring remediation task rules, customers can automate the grouping of vulnerability findings, reducing manual effort and accelerating remediation workflows. Selecting appropriate "Group by" criteria and execution modes allows tailoring task assignments to organizational needs and workload balance. Enabling automatic re-evaluation ensures tasks remain aligned with the latest findings data without manual intervention. Using these capabilities improves visibility, coordination, and efficiency in vulnerability remediation processes.

## Performance Considerations

Carefully design and optimize remediation task rules to avoid excessive or redundant rules that could degrade system performance.

## Managing Rules and Tasks

* Rules can be reordered, reapplied, or deleted with options to also remove associated open tasks.
* Tasks can be created automatically via rules or manually in the IT Remediation Workspace as needed.  
Remediation tasks help vulnerability analysts and remediation teams manage findings in bulk. By configuring remediation task rules, you can automatically group findings into remediation tasks, eliminating the need for manual
task creation and streamlining remediation efforts.  
Remediation task rules define how findings are grouped into tasks. A default rule based on vulnerability is included in the system, but rules can also use other attributes such as:

* Vulnerability severity or summary
* Configuration item (CI) or product model
* Assignment group
* Risk score
* Technology or attack vector

{#sem-grouping-multiple-findings-remediation-tasks-processing__ul_gky_jv2_xfc}You can define up to six "Group by" criteria and apply multiple conditions. Once a match is found, the system either adds the finding to an existing Open remediation task or creates a new one. These rules apply to newly created findings or the ones updated with attributes that impact task assignment: Task rules can be reapplied to update groupings as needed. Rules are evaluated after CI matching, risk calculation, and assignment.  
Note:  
Excessive rules may impact performance. Ensure that rules are optimized to avoid duplication and inefficiency.️

## Remediation task rule execution mode {#sem-grouping-multiple-findings-remediation-tasks-processing__execution_mode}

You can configure how remediation task rules are evaluated during finding ingestion by setting the execution mode. Two modes are available:

* Match All (default): All applicable rules are evaluated and executed for each finding. A finding can be assigned to multiple remediation tasks if it matches more than one rule.
* Match First: Rules are evaluated sequentially by execution order and only the first matching rule is applied. Each finding is assigned to exactly one remediation task.  
You can change the execution mode using any of the following methods:

* Switch between modes using the label link: Match All or Match First rule on the Remediation task rules page.
* Navigate to Security Exposure ManagementAdministrationAdvanced Settings and update the Remediation Task Rule Mode setting.
* Update the sn_sec_rem.remediation_task_rule_mode system property directly AllSystem Properties. Valid values are match-all and match-first.

## How remediation task rules work {#sem-grouping-multiple-findings-remediation-tasks-processing__section_ejv_5gs_fgc}

When a new finding is created, imported, or reopened, the system evaluates it against the defined remediation task rules. In Match All mode, all rules are evaluated. In Match First mode, evaluation stops at the first matching rule based on execution order. For each rule where the condition matches, the system pulls the
relevant data from the "Group by" selections and builds a group name. If a matching open remediation task exists, the finding is added to it. Otherwise, a new task is created. By default, remediation task rules use the assignment
group set by the assignment rules on the finding. The assignment of these remediation tasks is controlled by the assignment rules. When a task rule is deleted, you have the option to delete all open tasks created by that rule.

## Automatic re-evaluation of remediation task rules {#sem-grouping-multiple-findings-remediation-tasks-processing__section_autoreeval_nfc}

Remediation task rules are automatically re-evaluated when the Assignment group or Preferred solution changes on a finding. You don't need to manually reapply the rule. The finding is
unlinked from its current remediation task and regrouped under the task that matches its updated value.

To enable automatic re-evaluation, activate the sn_sec_rem.rerun_task_rules system property. This property is not activated by default. For steps to enable it, see [Assigning findings to remediation teams using assignment rules](https://www.servicenow.com/docs/eGNJ00gR1r0ney~~aTmnSg "Assignment rules automatically assign findings, such as vulnerable items, application vulnerabilities, container vulnerabilities, and configuration test results, to the appropriate groups for remediation. This streamlined triage ensures that tasks are directed to the appropriate teams, and enhances consistency and visibility across security and compliance programs.").

A change to any other Group by field doesn't trigger re-evaluation. To regroup findings based on changes to those fields, manually reapply the remediation task rule.

## Managing remediation task rules {#sem-grouping-multiple-findings-remediation-tasks-processing__section_brs_hw2_xfc}

Reapplying rules: Use the Reapply button on the rule form to rerun the rule on all open remediation tasks it created. The reapplication process deletes and recreates tasks based on the updated rule. Reapply behavior depends on the execution mode:

* Match First: All rules are reapplied sequentially by execution order. You cannot selectively reapply individual rules. Use the drag handles on the rules list to reorder rules by priority before reapplying.
* Match All: You can select specific rules to reapply using the checkboxes on the rules list, or reapply all rules at once.

Deleting rules: When deleting a rule, you may also delete the open tasks created by it. Tasks not in the Open state remain unaffected.

## Creating and managing remediation tasks {#sem-grouping-multiple-findings-remediation-tasks-processing__section_zql_ggg_xfc}

Remediation tasks can be created in the following ways:

* Automatically using remediation task rules (recommended for efficiency).
* Manually in the IT Remediation Workspace. For more information, see [Create a remediation task manually in the IT Remediation Workspace](https://www.servicenow.com/docs/DpLFz~cCkF31_6M1IdaRag "Starting with v25.0.4 of Vulnerability Response, you can create remediation tasks manually from the Host vulnerable items, Application Vulnerable items, Container vulnerable items, and Configuration test results lists on the List page of IT Remediation Workspace.").
{#sem-grouping-multiple-findings-remediation-tasks-processing__ul_n5v_hgg_xfc}

## State synchronization {#sem-grouping-multiple-findings-remediation-tasks-processing__section_ckd_j4g_xfc}

* Rolldown: When a remediation task state changes (for example, from Open to Under Investigation, this change is pushed to all associated findings.)
* Rollup: When all associated findings share a common terminal state (for example, Deferred, Closed - Fixed), their state rolls up to the remediation task. Rollup jobs run at scheduled intervals (for example, every 15 minutes).
{#sem-grouping-multiple-findings-remediation-tasks-processing__ul_tby_k4g_xfc}

## Assignment management {#sem-grouping-multiple-findings-remediation-tasks-processing__section_y12_y4g_xfc}

Assignment groups and assignees from remediation tasks are rolled down to associated findings unless those findings already have different assignments. This roll down helps standardize ownership across all related records.
**Related concepts**   

* [Configuring remediation task rules](https://www.servicenow.com/docs/RmdlpBHNSZWENp1hmEfORQ#sem-configure-remediation-task-rules "By configuring remediation task rules, you can automatically group findings based on filter conditions.")

*[\>]: and then