Automatically closing stale test results in Configuration Compliance
Summarize
Summary of Automatically Closing Stale Test Results in Configuration Compliance
The Auto-Close Stale Test Results feature in Configuration Compliance allows you to automatically close older test results that have not been recently detected by third-party integrations. This process reduces the clutter of active test results and remediation tasks in your instance, assisting in maintaining an accurate Configuration Management Database (CMDB).
Show less
Key Features
- Automatic Closure: Test results are moved to Closed-Stale based on customizable conditions set in the condition builder.
- Terminology Update: Key terms have been renamed in version 14.9, including Test Result Group to Remediation Task Group, and Rules to Remediation Task Rules.
- Resolution Field: A new value, [Closed-Stale], indicates that a test result was closed by the auto-close feature, distinguishing it from those closed by scanners.
- State Management: The feature manages the state progression of test results, affecting the overall state of associated remediation task groups.
Key Outcomes
By activating this feature, you can effectively manage stale test results, ensuring that only relevant data is maintained in your system. This leads to improved visibility and efficiency in handling test results and remediation tasks, particularly when assets are decommissioned or not updated by third-party scanners.
You can activate the Auto-Close Stale Test Results feature to automatically close older test results not recently found by your third-party integrations. Moving these test results to Closed-Stale reduces the number of active test results and remediation tasks in your instance and helps you reconcile assets in your Configuration Management Database (CMDB).
| Terminology prior to v14.9 | Terminology v14.9 onwards |
|---|---|
| Test Result Group | Remediation Task |
| Group Rules | Remediation Task Rules |
| Policy | Test group |
Overview
The Auto Close Stale Test Results module helps you automatically close older, stale test results not recently found by your third-party integrations. Test results are moved to Closed-Stale based on the conditions you set in the condition builder.
Key terms
- Test result
- Tests results are imported results from libraries of configuration tests that are mapped to frameworks, policies, and authoritative sources that define how a class of technology assets should be governed. The Configuration Compliance application does not calculate the test results but imports them with third-party integrations.
- Asset last scanned date
- Refers to the value of Last configuration compliance scan date column of the Discovered Item table that is related to the test result. This date refers the most current date and time an asset was last scanned by a third-party scanner.
- Last failed date
- Refers to the Last seen column date of the Test Results table when the Result field value is [failed].
- Stale test results
- Refers to test results in your instance that are aged and have not been found, updated, or detected by third-party integration scans for a significant amount of time.
- Test Results last found
- This search option uses a date and time provided by the third-party scanner. This term refers to the most current, or latest date (days ago) that test results were found again by the scanner. This parameter can be configured.
Use case
At times, assets (configuration items) might be decommissioned in your environment or purged by third party-scanners. When this happens, the assets' associated configuration test results are not updated in the Configuration Compliance application by imported detections and they become inactive (stale).
To reduce the number of active test results (TRs) and remediation tasks (RTs) in your instance, activate the Auto-Close Stale Test Results feature. This feature closes aged test results automatically that have unchanged states or have not been recently imported by your integrations.
As an example, suppose a particular configuration item (CI) has multiple asset IDs, and one of these IDs has not been imported on detections from a third-party scanner in the last 90 days. If you set the condition builder in the Auto-Close Stale Test Results module to close tests results that have not been found or updated in the past 90 days or more, this feature automatically closes any test results that match this filtering.
The Resolution field
To differentiate between the detections that are closed by third-party scanners such as the Qualys and Tenable.io products and the Auto-Close Stale Test Results feature in your instance, a new value for the Resolution field, [Closed-Stale], has been added. Closed-Stale indicates that a TR was closed by the auto-close feature. Closed or Fixed-Closed indicates that a TR was closed by a scanner.
Rollup of TR states to TRGs with the Auto-Close feature
The state progression and precedence for test results is: .
- If any TRs in a TRG are Open, the TRG state is not changed.
- If at least one TR is Closed - Fixed and the rest are Closed - Stale, the TRG state transitions to Closed - Fixed.
- If all the TRs in a TRG are Closed - Stale, the TRG state transitions to Closed - Canceled.
Supported integrations
For more information on the third-party integrations that support this feature, see Understanding the Qualys Vulnerability Integration and Tenable.io integrations with the Vulnerability Response and Configuration Compliance applications.