Add Recast, Change Result, and Accept Rules

Using Recast, you can create rules to modify or accept severities for vulnerabilities and web applications. Similarly, you can change or accept results of host audits. You can also create these rules directly from the Findings table, as described in Create Recast Rules from the Findings Page.

Note: When you create or modify a recast rule, the changes may not appear immediately across Tenable Vulnerability Management. Recast rules operate on an eventually consistent data model, and the Explore > Findings view uses a cache for faster performance. Here are details about the process.

  1. Rule Evaluation: As new findings are imported, they are queued for evaluation against your recast rules. It is possible for a new finding to appear in the Explore > Findings view before your rule has been evaluated and applied to it.

  2. View Caching: After a recast rule has been evaluated and the Revised Finding count is updated in the recast rules table, there is an additional cache period of up to 60 minutes for the Explore > Findings view to reflect this change.

The types of rules you can create are as follows:

Rule Description
Recast In the Vulnerabilities and Web Applications tabs, modify the severity findings based on query criteria.
Accept In the Vulnerabilities, Host Audits and Web Applications tabs, accept the risk of vulnerability findings for Vulnerabilities and Web Applications or accept the Original Result of host audit findings and hide them from the Findings table.
Change Result In the Host Audits tab, change the Original Result of host audit findings, for example, by changing Failed to Passed.
Note: The total number of rules you can create is subject to a global container limit. For more information on capacity and how rules are counted, see Rule Capacity and Global Limits.

Create a Recast or Accept Rule

To create a Recast or Accept rule:

  1. In the left navigation, click Recast.

    The Recast page appears.

  2. Click either the Vulnerabilities or Web Applications tab.

  3. Above the table, click Add Rule.

    The Add Recast Rule pane appears.

  4. Configure the following options:

    (missing or bad snippet)

  5. Click Save.

    The system processes the rule, which may take time if many findings are targeted. When complete, the rule appears in either the Vulnerabilities or Web Applications table and the system updates the Findings table.

Create a Change Result or Accept Rule

To create a Change Result or Accept rule:

  1. In the left navigation, click Recast.

    The Recast page appears.

  2. Click the Host Audits tab.

  3. Above the table, click Add Rule.

    The Add Change Result Rule pane appears.

  4. Configure the following options:

    (missing or bad snippet)

  5. Click Save.

    The system processes the rule, which may take time if many findings are targeted. When complete, the rule appears in the Host Audits table and the system updates the Findings table.