Create a Recast Rule from Vulnerability Details

Required User Role: Administrator

Required Access Group Permissions: Can View

Recast rules can be created via the Settings page, or via the Vulnerability Details page.

To create a recast rule via the Vulnerability Details page:

  1. View the Vulnerability Details page.
  2. In the Assets Affected table, select the check box(es) next to the asset(s) for which you want to create a recast rule.
  3. In the upper-right corner, click the Actions button.

    The actions menu appears.

  4. In the actions menu, click Recast.

    The Recast Rule plane appears.

  5. In the Action section, select Recast.
  6. In the Vulnerability section, confirm the plugin ID populated by Tenable.io.
  7. From the New Severity drop-down box, select the severity level for the vulnerability.
  8. In the Targets section, confirm the target populated by Tenable.io. For example:
    • If you select all assets on the Vulnerability Details page, the target is set to All.

      Note: If the Targets drop-down is set to All, a warning appears indicating that this option may override existing rules.

    • If you select only some of the assets on the Vulnerability Details page, the target is set to Custom, and Tenable.io populates the Target Hosts box with the appropriate targets.
  9. (Optional) In the Expires box, set an expiration date for the rule.

    This action is only necessary if you want the rule to expire. By default, the rule applies indefinitely.

  10. (Optional) In the Comments box, type a description of the rule.

    The text you type in this box is only visible if the rule is modified and has no functional effect.

  11. Click Save.

    Tenable.io starts applying the rule to the appropriate vulnerabilities. This process may take some time, depending on the system load and the number of matching vulnerabilities. The change is reflected on dashboards, where a label appears to indicate how many instances of affected vulnerabilities have been recast.

    Note: A recast rule does not affect the historical results of a scan.