Issues

Issues group one or more vulnerabilities for tracking, prioritization, and remediation. An issue captures a point-in-time snapshot of every (vulnerability, asset) pair it contains, so the original context survives even if the asset or vulnerability later changes.

Use issues to:

• Roll several related vulnerability instances up into a single unit of work.
• Assign a risk level, state, and due date, and track progress over time.
• Record decisions and discussion in a per-issue timeline.
• Push the issue to Jira as an external ticket and keep the runZero timeline in sync through a Jira webhook.

What is an issue

Each issue has these fields:

• Name is a short label that identifies the issue.
• Description holds longer free-form context about the issue.
• Remediation holds guidance for the people doing the work.
• Risk is one of none, low, medium, high, or critical. The default is the highest risk found across the issue’s vulnerabilities at creation time.
• State is one of open, in progress, closed, or resolved. Unless the state is closed, runZero sets it to resolved automatically once every instance is remediated (see Automatic remediation tracking below). A Jira webhook state mapping can also set the state.
• Due date is an optional target date for resolving the issue.
• Owner is the single user responsible for the issue. Issues use the built-in Issue owner ownership type and cannot take custom ownership types. See Issue ownership for details.
• Instances are the (vulnerability, asset) pairs captured in the snapshot.

Creating an issue

You can create issues from anywhere in the runZero Console that shows vulnerabilities or groups of vulnerabilities:

• The vulnerability groups inventory
• The findings inventory
• The vulnerabilities by asset inventory table
• The vulnerabilities card on an asset details page
• The vulnerabilities table on a findings details page
• The vulnerabilities table on a certificate details page
• A vulnerability details page

Select one or more vulnerabilities and click Create issue. runZero opens a draft issue where you can edit the name, description, solution, risk, and due date before saving. Saved issues appear on the Issues page for the current organization.

At creation time, runZero stores a snapshot of each selected vulnerability and its asset on the issue, so the issue keeps showing the original instance details even if the underlying asset is later modified, deleted, or rescanned.

Working with an issue

The issue details page has these sections:

• Header shows the name plus quick-edit risk, state, and due date.
• Summary shows the description and remediation guidance.
• Instances is the table of vulnerabilities captured in the snapshot, with a slideout for vulnerability and snapshotted asset details. Instances whose vulnerability has since been remediated are flagged.
• Comments and History tabs hold the issue timeline (see below).
• Sidebar shows risk, state, due date, and the linked Jira ticket, if one exists.

Comments and history

The issue timeline records three kinds of entries:

• User events cover changes to the issue fields and comments a runZero user writes on the Comments tab.
• System events are entries runZero generates automatically (state changes, ticket creation, and similar actions).
• Jira events arrive through the Jira webhook, one timeline line per changelog item on the linked ticket.

The Comments tab shows comments only; the History tab shows everything in the timeline.

Issue ownership

An issue can have one owner. Issue ownership is separate from the ownership types used for assets and vulnerability records: every issue uses the built-in Issue owner type, and custom ownership types cannot be added to an issue. When an issue is linked to Jira, runZero can sync its owner with the Jira assignee if it finds a matching external user. See Issue owner synchronization.

Automatic remediation tracking

Whenever a scan, import, or integration import finishes for an organization, runZero recomputes the remediated instances counter for every issue in that organization except closed ones. An instance counts as remediated when the original vulnerability is no longer present on the original asset.

If the state is closed, runZero does not recompute the remediated instances and makes no automated changes to the state.

When every instance on an issue is remediated, runZero moves the issue to the resolved state.

If a resolved issue has one or more of its vulnerabilities detected on the original asset again, runZero moves it back to in progress to alert you to the regression.

Linking a Jira ticket

To push an issue to Jira as an external ticket, first create a Jira credential. The Issues page sidebar shows a Create Jira ticket action where you pick the Jira credential and, optionally, upload a CSV of the issue’s instance snapshot as a Jira attachment. After the ticket is created, the runZero issue stores the Jira issue key, a deep link to the ticket, and the credential and Jira base URL used. The Jira integration page has the full details.

Permissions

• Viewing issues requires read access to the organization the issue belongs to.
• Creating, editing, and deleting issues requires write access to that organization.
• Issues don’t appear in the All organizations view; switch into a specific organization to use the Issues page.