Exceptions

In certain situations, you may want to put off remediating vulnerabilities collated in BMC Helix Automation Console.
For example:

• Assets with vulnerabilities are planned for decommissioning. 
• Vulnerabilities may be less critical, or in legacy applications on production servers.
• Vulnerabilities are to be remediated in a planned maintenance window at a later date.

In such scenarios, you can create exceptions to exclude specified vulnerabilities while creating remediation operations.

Only users with administrative rights can create exceptions. All other users can only view the exception details.

When you create an exception for the current date, it is in the Active state. When you create an exception for a future date, it is in the Enabled state, and on the specified date, the status changes to Active.

The impact of exceptions for vulnerabilities is described in the following table:

If you create an exception for a vulnerability on all the assets, then the same vulnerability data don't appear on the Risks > Vulnerabilities and Dashboard > Vulnerability Dashboard pages. 

Sometimes the vulnerability scanning systems result wrongly indicates vulnerabilities on the assets. In this case, you can create permanent exceptions to restrict those vulnerabilities from getting reported in the future scan results. If you want to extend an exception for vulnerabilities for which the remediation content is still not available, you can update the end date of that particular exception.

Where to go from here

To create, view, disable, enable, and delete an exception, see Working with exceptions.