Mark a finding invalid
Use Mark as invalid when you determine that a vulnerability finding does not apply to the affected release or environment. For example, a finding may be invalid when the reported dependency is not present, the affected version is incorrectly identified, or the vulnerable condition is not applicable.
Marking a finding as invalid preserves the risk decision and associated actions in the Audit trail. Depending on your user role and the current risk decision, the available actions may vary.
Ensure that:
You have reviewed the vulnerability details and supporting evidence.
You have confirmed why the finding is invalid for the affected release or environment.
You have sufficient information to document the reason for the decision.
You have the appropriate permissions to change the risk decision.
Navigate to Release Security > Monitoring dashboard >Vulnerabilities.
Locate the vulnerability you want to review.
Use the search functionality or configure the displayed columns, if necessary. Select the alert name to open the vulnerability details.
Navigate to Secure release > Monitoring dashboard > Vulnerabilities.
Search and locate the vulnerability with the Risk accepted decision. You can use the search functionality and configure the displayed columns to help locate the vulnerability.
Select the Alert name for which you want to view the details.
Review the vulnerability details and the current risk decision. Verify the affected dependency, version, release, and other available evidence to confirm that the finding does not apply.
The Mark as invalid action can be available for findings with the following risk decisions, depending on your user role:
- Not yet reviewed
-Pending review
- Risk accepted
After reviewing the vulnerability details, from the vulnerability details, select Action > Mark as invalid.
Provide the invalid finding details.
In the Mark as invalid dialog, provide the required information explaining why the finding is invalid. Include sufficient details to support the decision, such as why the vulnerability does not apply to the affected dependency, release, or environment.
Configure suppression, if required.
To prevent the vulnerability from appearing in future scans, select the option to Suppress future scans for this vulnerability.
If you enable suppression, specify the Expiry/Revalidate date to define how long the suppression remains valid.
Nota
Suppression is optional and can be configured when you Mark as invalid. Apply suppression only when future detections of the vulnerability should be excluded for the defined scope and period.
Confirm the decision.
Review the information and confirm Mark as invalid. The Risk decision changes to Invalid finding.
(Optional) Review the audit trail.
Open the vulnerability's Audit trail to verify that the invalid finding decision and associated changes have been recorded. The audit trail maintains a history of actions performed on the vulnerability.
Importante
The actions available under Action depend on your user role and the current Risk decision. If new information indicates that the finding is applicable, review the risk decision again and take the appropriate action.