Auto Closer

Resolve or delete the findings that a scanner no longer reports.

Updated

When a scanner stops reporting a finding, the vulnerability is usually fixed. The Auto Closer acts on such findings each time a report of the scanner is imported.

It’s set for each scanner: open the settings, then Scanners, open the scanner and turn on Enable Auto Closer. Then Choose Auto Closer action:

  • Resolve: the finding moves to Resolved and gets the auto-closed tag. Its task tracker task follows. If a scanner reports it again, it goes back to Unverified.
  • Delete: the finding is deleted.

Resolve keeps the history and is the safer choice.

Which findings it acts on

A finding is closed when the new report of the same scanner doesn’t contain it, and the finding:

  • is in the same product, and on the same asset and branch as the report;
  • is not resolved or rejected. Findings with an accepted risk are closed too.

Findings are matched by their name, file path, line, vulnerable URL and dependency. A finding whose line moved in the new report counts as a new one, and the old one is closed.

When not to use it

  • The scanner runs only part of its checks, for example a quick scan on push and a full scan at night: the quick report misses the findings of the full one, and they are closed.
  • Two jobs send reports as the same scanner in one sequence: the second report closes the findings of the first. See Sequences.
  • The scanner can fail and still send a report, for example an empty report after a timeout: all its findings on that asset are closed.