Vulnerability Response: Auto-Close Stale Vulnerable Items not workingIssue Auto-Close Stale Vulnerable Items scheduled job is not closing older records that should qualify as stale.ResolutionThe problem is caused when the AutoCloseUtils._autoCloseByLastDetected() is called by the scheduled job. This is due to the VIT records having no integration_instance value set this feature is only available for instances which are using Tenable/Rapid7/Qualys integrations. https://docs.servicenow.com/bundle/quebec-security-management/page/product/vulnerability-response/task/vr-autoclosevi.html * This function is used to automatically close VITs that * not have been detected by scanners for defined number of days. * Their state will be set to 'Closed', and substate to 'Stale'. */ _autoCloseByLastDetected: function(days) { var lastFoundBefore = new GlideDate(); lastFoundBefore.addDaysUTC(-days); var startTimer = new GlideDateTime(); gs.info("Scheduled Job Auto-Close Stale Vulnerable Items by Last detected Execution Started : " + startTimer.getDisplayValue()); //multi instances for R7 IVM, Qualys and instance for DWH var int_instances = this._getInstances(); var rowCount = 0; var vi = new sn_vul.PagedGlideRecord("sn_vul_vulnerable_item"); vi.addEncodedQuery("integration_instanceIN" + int_instances + "^active=true^last_found<" + lastFoundBefore); vi.setSortField("sys_id"); while (vi.next()) { vi.gr.setValue("state", StateUtils.STATES.CLOSED); vi.gr.setValue("substate", StateUtils.SUB_STATES.STALE); vi.gr.close_notes = gs.getMessage("This vulnerable item has been transitioned to 'Closed' - 'Stale', because it has not been detected in the last {0} days.", days.toString()); vi.gr.update(); rowCount++; } The problem here is that there are no VIT records that match the records which will be returned by get_instances due to the incomplete tanable setup. Once an eligible integration is set up, you'll be able to update the VIT records to use that for the integration_instance value and the job will pick them up. The integration instance should be populating on sn_sec_int_impl _getInstances: function() { var instances = []; var gr = new GlideAggregate("sn_vul_integration_run"); gr.addEncodedQuery("integration.integration_script=1b84b9655b049010a3b798ea0a81c736^ORintegration=82baa32f1bfbc050de31fd1f0a4bcb57"); gr.addQuery("state", "complete"); gr.addQuery("substate", "success"); gr.addQuery("end_datetime", ">", "javascript:gs.beginningOfLast7Days()"); gr.groupBy("implementation"); gr.query(); while (gr.next()) //collecting the instance ids for IVM and DWH instances.push(gr.implementation); //collecting instances for Qualys and Tenable gr = new GlideAggregate("sn_sec_int_impl"); gr.addQuery("integration", "IN", this.INTEGRATIONS_FOR_VI_LAST_DETECTED); gr.query(); while (gr.next()) instances.push(gr.getUniqueValue()); return instances; }, [/code]