Create auto-close rules

task brazil Updated Sep 10, 2026 2 min read create-auto-close-rules.md

Raw file servicenow.com

Use auto-close rules to close older detections automatically based on the filter conditions that you set.

Before you begin

Role required: sn_vul.manage_auto_close_stale_vi

Procedure

Navigate to All > Vulnerability Response > Administration > Auto-Close Rules.

The base system provides the following auto-close rules:
- Assets last scanned: Detections associated with assets that haven’t been scanned within the last 90 days are transitioned to Stale state.
- Manual detections last found: Manual detections that haven’t been found within the last 90 days. If you activate Detections last found record, then this feature requires a successful integration run of Rapid7 Comprehensive Vulnerable Item Integrations and Microsoft TVM Machine Vulnerabilities Integration (Full import) within the last seven days.
- Detections last found: Detections that haven’t been found within the last 90 days.
Select New to create a new auto-close rule.

Fill in the fields on the form.

Field	Value
Name	Name of the auto-close rule.
Active	Option to activate the rule. If activated, it closes any detections automatically that match its filter criteria.
Ignore deferred items	If selected, any detections that are mapped to the In-review or Deferred states are ignored and not closed. If you clear this option, any detections that match your criteria are closed.
Execution order	Unique value for the execution of the auto-close rule. This value determines the order of execution. The default value is 100.
Description	Description of the auto-close rule.
Condition	Filter conditions used to identify detections that should be closed.

Select Submit.

The Auto-Close Stale Detections scheduled job runs daily. It identifies detections based on the specified conditions and transitions the matching ones to the Stale state. The job handles the following scenarios:
- If all the detections within a vulnerable item (VIT) are marked as stale, the VIT is closed with the sub-state set as "Stale".
- If there is at least one detection that remains open within a VIT, while others are in the Stale status, the VIT remains open.
- In cases where there are detections with both "Closed" and "Stale" statuses within a VIT, the VIT is closed with the sub-state set as "Fixed". When you upgrade to the latest version of Vulnerability Response, the conditions set in your auto-close rules also get updated accordingly. Additionally, if the rules are associated with different domains, the rules are created specifically within those domains.

55 lines · 3.4 KB Wrap lines

---
title: Create auto-close rules
description: Use auto-close rules to close older detections automatically based on the filter conditions that you set.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/vulnerability-response/create-auto-close-rules.html
release: brazil
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Closing stale detections in Vulnerability Response, Triage vulnerabilities automatically, Vulnerability Response remediation overview, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create auto-close rules

Use auto-close rules to close older detections automatically based on the filter conditions that you set.

## Before you begin

Role required: sn\_vul.manage\_auto\_close\_stale\_vi

## Procedure

1. Navigate to **All** &gt; **Vulnerability Response** &gt; **Administration** &gt; **Auto-Close Rules**.

The base system provides the following auto-close rules:

- **Assets last scanned**: Detections associated with assets that haven’t been scanned within the last 90 days are transitioned to **Stale** state.
- **Manual detections last found**: Manual detections that haven’t been found within the last 90 days. If you activate **Detections last found** record, then this feature requires a successful integration run of Rapid7 Comprehensive Vulnerable Item Integrations and Microsoft TVM Machine Vulnerabilities Integration \(Full import\) within the last seven days.
- **Detections last found**: Detections that haven’t been found within the last 90 days.
2. Select **New** to create a new auto-close rule.

3. Fill in the fields on the form.

|Field|Value|
|-----|-----|
|Name|Name of the auto-close rule.|
|Active|Option to activate the rule. If activated, it closes any detections automatically that match its filter criteria.|
|Ignore deferred items|If selected, any detections that are mapped to the **In-review** or **Deferred** states are ignored and not closed. If you clear this option, any detections that match your criteria are closed.|
|Execution order|Unique value for the execution of the auto-close rule. This value determines the order of execution. The default value is 100.|
|Description|Description of the auto-close rule.|
|Condition|Filter conditions used to identify detections that should be closed.|

4. Select **Submit**.

The **Auto-Close Stale Detections** scheduled job runs daily. It identifies detections based on the specified conditions and transitions the matching ones to the **Stale** state. The job handles the following scenarios:

- If all the detections within a vulnerable item \(VIT\) are marked as stale, the VIT is closed with the sub-state set as "Stale".
- If there is at least one detection that remains open within a VIT, while others are in the Stale status, the VIT remains open.
- In cases where there are detections with both "Closed" and "Stale" statuses within a VIT, the VIT is closed with the sub-state set as "Fixed".
When you upgrade to the latest version of Vulnerability Response, the conditions set in your auto-close rules also get updated accordingly. Additionally, if the rules are associated with different domains, the rules are created specifically within those domains.