VITs are not closing after the detections are closed because the exception rule job does not check for closed state - Known Error

VITs are not closing after the detections are closed because the exception rule job does not check for closed state Description The scheduled job "Associate existing VIs with Auto Exception rule" checks VITs against exception rules and reopens items that don't match the criteria. The job assumes exception rule references are cleared when VITs close via the "Transit to Close" business rule.

In situations where the BR: "Transit to Close" has been customised, etc. thereby causing exception rule references not being cleared when VITs close are closed, VITs won't be closed after the detections are closed.

The scheduled job "Associate existing VIs with Auto Exception rule" checks VITs against exception rules and reopens items that do not match the criteria. However, the job assumes exception rule references are cleared when VITs close via the "Transit to Close" business rule. If the business rule is customized, causing exception rule references to remain when VITs close, the VITs will not close after detections are closed. This results in VITs being reopened by the job despite being in a closed state.

Steps to Reproduce

1. Create an exception rule matching the filter criteria for specific VITs. 2. Close some of the VITs via a scheduled job while retaining the reference to the exception rule. 3. Run the exception rule job. 4. Observe that the closed VITs are reopened again due to the job not checking their closed state.

Workaround Navigate to Script Include

Go to System Definition > Script Includes Search for and open: VulnerabilityAutoExceptionRule (scope: sn_vul_cmn)

Modify the reapplyRules Function

Locate the reapplyRules function At line 433, add the following code to exclude closed VITs from processing:

existingRecordGr.addQuery('state', '!=', '3');

Save Changes

Save the Script Include

Verify the Scheduled Job

Navigate to System Scheduler > Scheduled Jobs Open the job: "Associate existing VIs with Auto Exception rule" Confirm the job now includes the state check to prevent processing closed VITs

Note: Follow the same steps for the CC application scope with the script include VulnerabilityAutoExceptionRule, and add the same code line to the reapplyRules function at line 55.