"For alerts on change notifications, the process is we detect a change, review it then close the ticket. Now, the next time a change is detected, it's reopening the ticket but the only update is "Roar has determined the finding has not been remediated...". For this to work properly it needs to include the actual change data also."
The expected behavior is that Roarbot is smart enough to differentiate between standard alerts (i.e. license expirations) and change alerts (i.e. public facing exposed ports list has changed). For change alerts, it doesn't make sense for Roarbot to comment that the issue has not been remediated. Instead, we'd like to see Roarbot comment on a new change, and include the change in the comment.
Submitted on behalf of Steve from RUN.
|Last Reviewed Date||2020-09-08|
Our latest release includes an improvement to our alerts where if a change alert is re-opened, Liongard is now including a Roarbot comment with the Change Detection that causes that alert to re-open. Thanks everyone for your feedback and votes on this idea!