Starting with v10.3 of Vulnerability Response, the Auto-Close Stale Vulnerable Items module helps you clean up older, stale vulnerable items (VIs) not recently found by your third-party integrations. Moving these VIs to Closed reduces the number of active vulnerable items and vulnerability groups in your Now Platform instance and helps you reconcile assets in your CMDB.

1. Navigate to Vulnerability Response > Administration > Auto-Close Stale Vulnerable Items.
   The Auto-Close Stale Vulnerable Items form is displayed.

   Note: The messages displayed in the following images refer to the Rapid7 comprehensive integrations, and they are only displayed for Rapid7 users.

   

   

2. Fill in the fields.
3. For the Auto-close stale items based on field, or, prior to v12.0, the Auto-close stale items by field, choose if you want to close older vulnerable items based on the date when vulnerable items were last found, or the date when assets were last scanned. Both searches match the age of older, stale VIs in number of days to a date provided by your scanner.
   Choose one option:

   • Vulnerable items last found. Prior to v12.0 of Vulnerability Response, this option was called Vulnerable item last detected, but both of these options refer to the most current, or latest date that vulnerable items were found again by the scanner.
   • Assets last scanned. Prior to v12.0 of Vulnerability Response, this option was called Asset last scanned. This option refers the most current date an asset was last scanned by a third-party scanner.
4. For Rapid7 users only, verify any comprehensive integrations you require are enabled.
   • Starting with v12.0 of Vulnerability Response and v11.0 of the Rapid7 integrations, as shown in the preceding figure, if you select Vulnerable items last found to base your search on, this feature requires a successful integration run of one of the Rapid7 Comprehensive Vulnerable Item Integrations.
   • Prior to v12.0 of Vulnerability Response and v11.0 of the Rapid7 integrations, this feature requires a successful integration run of one of the Rapid7 Comprehensive Vulnerable Item Integrations, regardless of whether you choose Vulnerable item last found or Asset last scanned.
5. To enable the module, click the Active check box to select it.
6. In the days ago field, enter the age of older, stale VIs in number of days that you want to close.

   Default is 90 days. You can enter any positive value for the number of days. This value is used to match a date provided by your scanner. With 90 and Vulnerable items last detected displayed, any vulnerable items not detected in the last 90 days are automatically closed. With 90 and Assets last scanned displayed, any vulnerable items associated with assets not scanned in the last 90 days are automatically closed.

   Note:

   There is a relationship between the days ago field and the Import since field on the Rapid7 Comprehensive Vulnerable Item Integration – API. For this integration, the Import since field on the configuration page is empty by default.

   If you do not enter a value, or the field has no value, then the data for the number of days configured in the days ago field is used.

   For example, if the number of days defined in the auto-close configuration is 90, and the Import since field is empty on the Rapid7 Comprehensive Vulnerable Item Integration - API configuration page, then the first integration run imports the data for the last 90 days. The Import since field for the Rapid7 Comprehensive Vulnerable Item Integration - API is editable, so you can also provide whatever values you want. 90 days is provided as a default if the field remains empty so that the auto-close doesn’t close the false positives.

   This relationship between the these fields applies only to the first integration run. After that, changing the days ago field on the Auto-Close Stale Vulnerable Items form doesn’t affect the Import since field on the Rapid7 Comprehensive Vulnerable Item Integration – API configuration page. The field is changed to the first run’s start time so that the subsequent integration runs import only the delta information

   The scheduled job, Auto-Close Stale Vulnerable Items, runs daily, identifies if you selected the date vulnerable items were last found, or the date assets were last scanned, and transitions the vulnerable items that match your criteria to Closed – Stale.

   For the vulnerable items that are transitioned to Closed – Stale, if the scanner confirms that all the detections are fixed, the vulnerable items associated with the detection transition to Closed - Fixed.

   After the vulnerable items that are transitioned to Closed – Stale, if the scanner finds any detection going forward for the vulnerable items, any vulnerable items associated with the detection transition back to Open.