Vulnerable Items are not auto-closed after the CI Decommissioned Auto-Close Rule is enabledIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The "CI Decommissioned" Auto-Close Rule is enabled in Vulnerability Response. However, Vulnerable Items (VIs) associated with decommissioned or retired CIs are not being automatically closed by the daily scheduled job, even though the rule is active. Symptoms Auto-Close Rule (CI Decommissioned) is active and configuredVulnerable Items remain in Open state and are not auto-closedExpected behavior: VIs should be automatically closed according to the rule schedule Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Vulnerability Response v22.0 and later Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The Auto-Close Rule (CI Decommissioned) may not apply due to one of the following reasons: Root Cause #1: CI State Field is Not Set to "ci_decommissioned" The CI Decommissioned Auto-Close Rule uses the state field of the CI to determine whether a CI has been decommissioned. Why this happens: The Auto-Close Rule explicitly filters on src_ci.state = ci_decommissionedIf the CI’s state remains Active or any value other than ci_decommissioned, the rule does not match and the Vulnerable Item (VI) is not processed. Root Cause #2: Vulnerable Item Source Type Does Not Match the Auto-Close Rule's Integration Type The Auto-Close Rule is configured to only process VIs from specific sources (Integration Type). If the VI source does not match the rule's integration type setting, the rule will not apply. Why this happens: The default "CI Decommissioned" Auto-Close Rule is configured for "Vulnerability Scanner Integration" sourcesIf your VIs were created from a "Manual Integration" source (manually added), they will not be matched by the default ruleA separate Auto-Close Rule with "Source type = Manual Integration" must be created Root Cause #3: No Associated Detection Record Exists for the Vulnerable Item The Auto-Close Rule may fail to process VIs if the corresponding Detection (VIT) record is missing or has been deleted. Many Auto-Close Rule processors depend on the Detection record to evaluate closure conditions. Why this happens: The Auto-Close Rule processor relies on the associated Detection record to evaluate whether the Vulnerable Item should be closed.If no corresponding Detection record exists, the Vulnerable Item cannot be evaluated by the rule and therefore is not automatically closed. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Resolution for Root Cause #1: Verify and Update the CI State Verify that the affected CI’s State is set to ci_decommissioned. After updating the State, wait for the next execution of the Auto-Close Rule Processor scheduled job and verify that the associated Vulnerable Items (VIs) are automatically closed. Resolution for Root Cause #2: Create an Auto-Close Rule for Manual Integration If the affected Vulnerable Items were created through Manual Integration, create a separate Auto-Close Rule with Source Type = Manual Integration. Configure the rule with the same closure logic as the existing CI Decommissioned Auto-Close Rule. After creating and activating the rule, wait for the next execution of the Auto-Close Rule Processor scheduled job and verify that the affected Vulnerable Items are automatically closed. Resolution for Root Cause #3: Verify and Restore Associated Detection Records Verify that each affected Vulnerable Item has an associated Detection (VIT) record. If the Detection record is missing or has been deleted, restore or recreate it if possible. Once the Detection record has been restored, wait for the next execution of the Auto-Close Rule Processor scheduled job and verify that the associated Vulnerable Items are automatically closed.