---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Request a false positive for a vulnerable item or remediate task

# Request a false positive for a vulnerable item or remediate task {#ariaid-title1}

Release version: Brazil  
Updated November 5, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Indicate a false positive request for a finding or a remediation task in the Security Exposure Management Workspace. A false positive is a condition where a scanner incorrectly reports that a finding exists in the
system due to situations such as an incorrect classification, improper logic, or an algorithm in the scanner.

## Before you begin

Role required:

* sn_vul.remediation_owner for host vulnerable items (VITs)
* sn_vul.app_security_champion for application vulnerable items (AVITs)
* sn_vul_container.remediation_owner for container vulnerable items (CVITs)
* sn_vulc.remediation_owner for configuration test results (CTRs)
{#sem-falsepst-reqst__ul_lzn_lvp_fgc}

## About this task

## Procedure

1. Navigate to WorkspacesSecurity Exposure Management Workspace.
2. Select List icon .
3. Select the remediation task or vulnerable item.  
   Use the filter bar or column sort to find a specific finding by ID, severity, asset, or current state. To narrow the list to your own tasks, set the Assigned to filter to Me.
4. Select Mark as False Positive.
5. Enter information about the request.  
   In the Mark as False Positive dialog box, provide the following:
   * Reason --- select the false-positive reason from the choice list (for example, Incorrect classification, Scanner algorithm error, or Mitigating control in place).
   * Justification --- describe why this finding is not a real vulnerability. Include the scanner version, observed behavior, and any reproduction steps that demonstrate the finding is incorrect.
   * Until --- optional expiry date after which the finding reopens automatically for review.
   * Evidence --- attach screenshots, scan-tool output, or supporting documents that substantiate the false-positive claim.
6. Select Request Approval.
7. Provide additional information about your request to the approver and select Submit.  
   Note:  
   The Take Questionnaire modal appears only when the Enable questionnaire to mark false positive check box is selected in the Exception Management Configuration form. .
{#sem-falsepst-reqst__steps_jfm_ct1_hwb}

## Result

The state of the vulnerable item or remediation task transitions to In Review.

Your request is submitted for approval and the approver receives an email notification about your request.

You will receive an email notification upon approval or rejection of your request.

## What to do next

In the Security Exposure Management Workspace, on the List page, navigate to Exception RequestsMy requests and open the corresponding state change approval record (VCA#) and check the status of your request in the Approval state column:{#sem-falsepst-reqst__table_abm_tqr_gbc__entry__3}

| Approval state | Record | Remediation task |
|-|-|-|
| Approved | The State of the record transitions to Closed with Reason as False positive. | The State of the remediation task transitions to Closed with Reason as False positive. The state is rolled down to the records in the remediation task accordingly. Navigate to the Details tab of a Remediation task and set the expiry date for false positive in the Until field if required. The remediation task reverts to the Open state after the specified date and the state is rolled down to the test results. |
| Rejected | The state of the record does not change. | The state of the remediation task and its records reverts to previous state. |
| Expired | The approval request has exceeded the configured approval expiry period. The record reverts to its previous state. | The remediation task and its records revert to their previous state when the approval expires. |
| No Longer Required | The approval is no longer needed (e.g., the finding was resolved by other means). | The approval is no longer needed for the remediation task. |
[ ]

{#sem-falsepst-reqst__table_abm_tqr_gbc}

In the Activity stream of a record or remediation task, you can view the entire workflow of the false positive request.

*[\>]: and then