---
title: "Auto Validator"
description: "Rules that verify, reject or accept new findings, and tag and group them, as they arrive."
url: https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage/auto-validator
slug: appsec-portal/triage-findings/automate-triage/auto-validator
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Auto Validator

The Auto Validator triages new findings by rules, so the security team only looks at the findings
that no rule recognizes. A rule says which findings it applies to and what to do with them: for
example, reject the findings of a secret scanner in test files, or verify every critical finding of
a dependency scanner.

Rules act on **Unverified** findings only. A finding that someone has already triaged is never
changed by a rule.

## Create a rule

Open **Auto Validator** in the sidebar and click **Create Rule**:

- **Status change**: what the rule does with the findings:

  | Action | Result |
  | --- | --- |
  | **Confirm** | Verified |
  | **Reject** | Rejected |
  | **Temporarily Accept** | Temporarily Risk Accepted, for the number of days in the workflow settings |
  | **Permanently Accept** | Permanently Risk Accepted |
  | **Add Tags and Groups** | the status doesn't change |

- **Add tags to validated findings** and **Group validated findings**: tags and
  [finding groups](https://whitespots.io/docs/appsec-portal/triage-findings/finding-groups) to add to the findings. A group is created in each product
  if it doesn't exist.
- **Create a task in the task tracker when a finding is verified**: **Use task tracker settings**,
  **Always create** or **Never create**. See [Task trackers](https://whitespots.io/docs/appsec-portal/integrations/task-trackers).
- The scope: the products or assets the rule applies to, or **Global** for all of them, now and in
  the future.
- The conditions (see below).
- **Active**: turn a rule off without deleting it.

**Findings to be affected** shows the Unverified findings that the rule would change now. Check it
before you save: a rule that is too broad rejects real vulnerabilities.

The quickest way to start a rule is from a finding: **Create Validator Rule** on the finding fills
in the conditions from its title, description, severity and scanner, and the status change from
its status. The rule starts with all products in scope; click **Edit** next to **Affected
products** to narrow it. See [A finding](https://whitespots.io/docs/appsec-portal/triage-findings/finding#automate-the-same-decision).

<video src="https://whitespots.io/api/image/9c01cf6087d6331dcbb0a57cca04720d.mp4" width="1440" height="900" class="shot-light" autoplay muted loop playsinline controls></video>
<video src="https://whitespots.io/api/image/453af44cdfbfad0905baec4d04ab7e7f.mp4" width="1440" height="900" class="shot-dark" autoplay muted loop playsinline controls></video>

## Conditions

A condition checks one field of the finding. All conditions of a rule must match (**AND**).

| Field | Example |
| --- | --- |
| **Title**, **Description** | `Hardcoded password` |
| **Severity** | Critical |
| **File Path**, **Line** | `.*/tests?/.*` |
| **Dependency**, **Vulnerable Url**, **Docker Image Tag**, **Branch**, **Custom Field** | |
| **Scanner**, **Scanner Type** | Gitleaks Scan; Secrets |
| **Tag** | `false-positive` |
| **Import Source** | **Internal**, or **External** for findings imported from DefectDojo |

Each text condition is **Equals**, **Contains value** or **Matches regex** (PostgreSQL regular
expressions). **NOT** inverts it.

## In which order rules run

When several rules match one finding, they run by action: first **Add Tags and Groups**, then
**Reject**, **Temporarily Accept**, **Permanently Accept**, and **Confirm** last. So a finding that
both a reject rule and a confirm rule match is rejected. Overlapping rules are fine.

## When rules run

- **Validate findings on import**: each import runs the rules on its new findings.
- **Launch frequency (seconds)**: the rules also run on all Unverified findings at this interval,
  so a new rule applies to the findings that are already there.

Both are in the settings at the top of the **Auto Validator** page, with **Enable Autovalidator**
to turn all rules off.

## Ready-made rules

Click **Import Rules** and upload a rule set file, for example the one for the built-in scanners.
**Allow for products** sets the scope of the imported rules. Importing rules needs access to all
products.

Rules need a paid license. See [License](https://whitespots.io/docs/appsec-portal/administration/license).

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Triage findings](https://whitespots.io/docs/appsec-portal/triage-findings) > [Automate triage](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage)
- Previous: [Automate triage](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage)
- Next: [Deduplicator](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage/deduplicator)