Risk State and Status lifecycles
The lifecycle of the risk State and Status is different depending on the Source that discovered the risk.
- State — A manually set value that you use to keep track of risk remediation.
- Status — An automatic values that the system updates after completing a scan.
The system automatically sets the State of a risk to Unsuccessful Validation if the State was previously Fixed, Waiting Validation and then the risk was detected again during the next scan.
To remove the risk from the list of actionable risks and from the risk calculation, change the State to Accepted or False Positive.
See Risk states and Risk statuses for more information.
Risks discovered using Agent Arctic Wolf
When Agent Arctic Wolf discovers a risk, each newly discovered risk has a State of Open and a Status of Active.
-
If the risk is not found — The Status automatically changes to Mitigated.
-
If the risk is found and the status is not already Active — The Status automatically changes to Active.
After seven days, Obsolete risks are removed.
Risks discovered using EVA scanning
When a risk is discovered using EVA scanning, the risk Source is EVA. Each newly discovered risk has a State of Open and a Status of Active. During the next monthly scan, if the risk is no longer found, the Status automatically changes to Mitigated. The State remains as Open, even though the risk is mitigated because this value is manually set.
Risks discovered using IVA scanning
When IVA discovers a new risk, it sets the Status to Active.
- The risk was not detected during the previous scan.
- The asset associated with the risk isn't found for more than 24 hours.
Asset is offline
- Active — The risk was detected in the previous scan and is online.
- Inactive — The risk was not detected during the previous scan, or the risk exists on an asset that is considered to be offline because it has not been detected for 24 hours. The risk remains as Inactive for 90 days unless the risk is detected again, or the device comes back online. After 90 days, if the risk is not detected, the Status automatically changes to Mitigated. After 90 days of the risk being offline, the risk Status automatically changes to Obsolete. In both cases, the risk is removed from the default actionable risk view and from the risk score calculation.
Note:
- Inactive is a Status used only for IVA risks.
- After seven days, Obsolete risks are removed.
This diagram shows the lifecycle of mitigated risks that were discovered by an IVA:
This diagram shows the lifecycle of offline assets that were discovered by an IVA:
If the asset associated with the risk isn't found for more than 24 hours, the Status changes to Inactive. For example, if you have decommissioned the asset
If the device comes back online, the Status changes back to Active. If the asset remains offline, you can delete the asset to remove the risk from the actionable risk view and update your risk score immediately.
Otherwise, after 90 days, the Status changes to Obsolete, and the risk is removed from the actionable risk view and from your risk score. After seven days, Obsolete risks are removed.
Open risk not found
If a risk is Open and Active and IVA doesn't detect the risk on a subsequent scan, the Status changes to Inactive. If IVA detects the risk again, the Status changes back to Active.
If the risk remains undetected, you can manually mark the Status as Mitigated to remove the risk from the actionable risk view and update your risk score immediately. Otherwise, after 90 days, IVA changes the Status to Mitigated, and the risk is removed from the actionable risk view and from your risk score.
Diagrams
This diagram shows the lifecycle of mitigated risks that were discovered by an IVA scan:
This diagram shows the lifecycle of offline assets that were discovered by an IVA scan: