Create auto-close rules for Container Vulnerability Response

---
title: Create auto-close rules for Container Vulnerability Response
description: Use auto-close rules to close older container vulnerable items \(CVITs\) automatically based on the filter conditions that you set.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/container-vulnerability-response/cvr-create-auto-close-rules.html
release: australia
product: Container Vulnerability Response
classification: container-vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Use, Container Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create auto-close rules for Container Vulnerability Response

Use auto-close rules to close older container vulnerable items \(CVITs\) automatically based on the filter conditions that you set.

## Before you begin

Role required: sn\_vul.container\_manage\_auto\_close\_stale\_vi

## Procedure

1.  Navigate to **All** > **Container Vulnerability Response** > **Container Vulnerable Items** > **Auto-Close rules**.

    The base system provides the following auto-close rules: **Container Vulnerabilities last scanned**: Vulnerabilities not reported within the last 90 days are transitioned to Stale State.

2.  Select **New** to create auto-close rule.

3.  Fill in the fields on the form.

<table id="table_s3f_vcb_2cc"><thead><tr><th>

Field

</th><th>

Value

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the auto-close rule.

</td></tr><tr><td>

Active

</td><td>

Option to activate the rule. If activated, it closes any detections automatically that match its filter criteria.

</td></tr><tr><td>

Execution order

</td><td>

Unique value for the execution of the auto-close rule. This value determines the order of execution. The default value is 100.

</td></tr><tr><td>

Integration type

</td><td>

Container Vulnerability Integration

**Note:** To scan host vulnerabilities using Prisma Cloud Compute integration, select **Vulnerability Scanner Integration**.

</td></tr><tr><td>

Description

</td><td>

Description of the auto-close rule.

</td></tr><tr><td>

Condition

</td><td>

Filter conditions used to identify detections that should be closed.

</td></tr></tbody>
</table>4.  Select **Submit**.

    The **Auto-Close** rules scheduled jobs run on a daily basis. It identifies CVITs based on the specified conditions and transitions the matching ones to the **Stale** state. In cases where there are CVITs with both Closed and Stale statuses, the CVIT is closed with the sub state set as Fixed.


**Parent Topic:**[Remediating container vulnerabilities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/remediate-cvr.md)