Configuring remediation target rules

By configuring remediation target rules, you can set the expected time frame for addressing findings, similar to how service level agreements (SLAs) set deadlines for fixing vulnerabilities.

The base system ships with three remediation target rules that are applicable only for application vulnerable items:

• Critical Risk Rating Rule: A remediation target with a 1-Critical risk rating, a remediation target of 15 days, and a reminder of 7 days before the target date.
• Medium-High Risk Rating Rule: A remediation target with either a 2-High or 3-Medium risk rating, a remediation target of 30 days, and a reminder of 7 days before the target date.
• Less Critical Risk Rating Rule: A remediation target with a 4-Low risk rating, a remediation target of 45 days, and a reminder of 7 days before the target date.

These rules are inactive by default. If you choose to edit one, rather than create a new one, remember to check the Active box before saving. The remediation target and reminder are calculated from the date and time the finding was last opened.

Recalculation of remediation target date

Starting with Unified Security Exposure Management version 30.0.4 and Vulnerability Response version 26.4.4, administrators can configure how the system recalculates the remediation target date when a finding’s risk rating changes.

• Under normal conditions, the system calculates the RT date as:

  Remediation Target = Target from (date) + Target (days)

• When the risk rating changes, the system calculates a new RT date using the following formula. The selected recalculation method determines whether this new date replaces the existing RT date.

  Recalculated RT date = Field change time + Target (days)

  Field change time captures when the risk rating changed. Target (days) uses SLA of new risk rating.

The following options define how the system applies the recalculated RT date when a risk rating changes:

For configuration steps, see Recalculate a remediation target date.

Parent Topic:Configure rules to manage findings

Related topics

Defining your own service level agreements (SLAs) using remediation target rules

Create or edit remediation target rules

Create remediation target rules to ensure the timely remediation of high-risk vulnerabilities by setting up a remediation target rule at the findings level.

Before you begin

Role required: See Access control lists (ACLs) for administration rules

Procedure

1. Navigate to Workspaces > Security Exposure Management Workspace.

2. Select Administration in the navigation pane.

3. Select Review on the Remediation target rules tile.

4. On the Rules page, select Remediation target in the navigation pane.

5. Select New.

6. On the remediation target rule form, enter the required details.

   For a full description of each field, see Remediation target rule fields.

7. Select Save.

   This rule goes into effect during the next run of the scheduled job, Evaluate remediation targets or when using the Reapply button on the Remediation target rules list view. The same is true when an existing rule is updated.

Related topics

Create or edit remediation target rules

Recalculate a remediation target date

Examples of recalculating a remediation target date

Recalculate a remediation target date

The remediation target (RT) date defines when a finding must be remediated. Recalculation verifies that RT dates stay accurate and reflect the latest risk rating updates. When a finding’s risk rating changes, the system can recalculate RT dates using the most recent update date, helping maintain accurate SLAs and avoid outdated or overdue target dates.

Before you begin

Note: By default, recalculation applies only to findings that aren’t overdue. To include overdue findings in the recalculation, enable the sn_sec_cmn.evaluate_targetmissed_records system property.

Role required: admin

About this task

[Omitted video] Description: Recalculate remediation target date

Procedure

1. Navigate to Security Exposure Management > Administration > Remediation Target Rules.

2. Open an existing rule to make updates.

   If you need to create a new rule, select New.

   For instructions, see Create or edit a Vulnerability Response remediation target rule.

3. Choose how the system should recalculate the remediation target (RT) date when the risk rating changes.

   • In Workspace, this option appears in the Recalculate target date section
   • In Classic view, use the Target recalculation method field.

1. Select Save.

What to do next

For more information on remediation target rules, see:

• Vulnerability Response remediation target rules
• Create or edit a Vulnerability Response remediation target rule
• Examples of recalculating a remediation target date

Examples of recalculating a remediation target date

The following examples show how the system recalculates the remediation target date based on different rule selections and risk rating changes.

Note: By default, SLAs define the remediation window for each risk level:

• Low risk: 30 days
• Medium risk: 15 days
• High risk: 10 days