---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create an exclusion rule

# Create an exclusion rule {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create a rule to filter or exclude detections from getting converted into vulnerable items (VITs) during ingestion.

## Before you begin

Role required: Vulnerability admin

## About this task

## Procedure

1. Navigate to AllVulnerability ResponseExclusion Rules.
2. On the Exclusion Rule record page, select New to create a rule.  
   A message saying 'Enable property to automatically close vulnerable items when all associated detections are closed' is displayed. By default, the property is inactive. To enable, select the property link and enter the value as True in the Value field.
3. On the form, fill in the fields.  
   {#create-exclusion-rule__table_tqk_fb3_4mb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the exclusion rule. |
   | Active | Option to activate the exclusion rule. |
   | Execution order | Unique order for each exclusion rule. |
   | Condition | Filter conditions for the detections that can be defined while processing them. Note: You can't select Exclusion rule or Vulnerability item field conditions. |
   | Description | Description of the exclusion rule. |
   [Table 1. Exclusion Rule form]

   {#create-exclusion-rule__table_tqk_fb3_4mb}
4. Select Submit.  
   The activity is recorded in the system.  
   Note:  
   Once an exclusion rule is created, it takes effect on detections starting from the subsequent ingestion.

*[\>]: and then