Vulnerability Scan Results Record Status

Each Vulnerability Scan Results record has an Overall Status value which describes where each record is currently located in the Vulnerability Tickets advanced workflow. The statuses for Vulnerability Scan Results records are:

  • Active
  • Pending Remediation
  • Accepted Risk
    • Closed
  • Deferred Risk
  • Pending Verification
  • Verified
  • Closed

As each Vulnerability Scan Results record proceeds through the Vulnerability Tickets advanced workflow, the Overall Status value changes based on the following factors (and where they originate from):

  • Ticket Status (Vulnerability Tickets)
  • Verifiable by Scanner (Remediation Plans)
  • Permanent Exception (Exception Requests)
  • VSR Scan State (Vulnerability Scan Results)

For exact details, review the Vulnerability Tickets application advanced workflow in Archer.

Important Information to Keep in Mind

  • Vulnerability tickets that have permanent exceptions cannot be reopened. In the case where a permanent exception was logged against the ticket first, the ticket will no longer accept changes. A new ticket would have to be opened and worked against the same Vulnerability Scan Results record if changes were needed. Vulnerability Scan Results records can still be reopened from an Accepted Risk state as soon as there is more than 1 ticket or remediation plan associated in an active state.
  • Accepted Risk is similar to Closed, except Accepted Risk can change status given conflicting scenarios.
  • If there are any Approved remediation plans associated to the Vulnerability Scan Result record, then the record ignores any exception requests.
  • Ensure that there is no conflicting data or statuses in Vulnerability Scan Results records. If there is conflicting data or statuses, the following rules are applied:
    • If 2 associated tickets are Verified and Closed, then the Vulnerability Scan Results record is set to Verified.
    • If there are any Open or In Progress associated tickets, then Vulnerability Scan Results records cannot be set to Verified or Closed.
    • Remediation Plans take priority over Exception Requests.