Automate triage
Rules that verify, reject, merge, rate and close findings for you.
Updated
Most findings that scanners report are either known false positives, duplicates, or the same kind of finding you triaged yesterday. Rules handle them, so people only look at what’s new.
| Rule | What it does | Runs |
|---|---|---|
| Auto Validator | verifies, rejects or accepts Unverified findings; tags and groups them | on import and at an interval |
| Deduplicator | keeps one finding when the same vulnerability is reported twice | basic deduplication on import, rules at an interval |
| CVSS rules | sets the CVSS vector and with it the severity | at an interval |
| Auto Closer | resolves or deletes findings that a scanner no longer reports | on import, per scanner |
Load the ready-made rule sets before the first scan, as described in First steps, and then add your own.
To change rules, a user needs the Automation rules permission (see Users and roles). The Auto Validator, Deduplicator and CVSS rules need a paid license; the Auto Closer and basic deduplication don’t. See License.
Each finding shows under Affected by which rules changed it, and each rule has View findings, processed by rule.