Understanding suppression

View as Markdown

You can hide findings, vulnerabilities, and vulnerability groups from the platform by suppressing them. Suppression can be useful for filtering out false positives or hiding vulnerabilities that don’t apply to your environment. runZero keeps suppressed objects rather than deleting them, along with metadata about when, why, and by whom they were suppressed.

How suppression works

Suppression behaves differently for each type of object. A suppressed vulnerability instance disappears from the vulnerabilities by asset inventory. A suppressed finding disappears from the findings list, and runZero also suppresses every vulnerability associated with it. A suppressed vulnerability group disappears from the vulnerability groups inventory, and runZero also suppresses every vulnerability associated with the group.

Once suppressed, a vulnerability, finding, or vulnerability group no longer counts toward an associated asset’s risk score or toward dashboard metrics.

When future scans find new vulnerability instances associated with a suppressed vulnerability group or finding, runZero suppresses those new vulnerabilities automatically.

If you suppress every vulnerability instance associated with a finding or vulnerability group without suppressing the finding or group itself, it stays visible in the platform with a count of zero associated vulnerabilities until future scans detect new instances.

Suppressing and unsuppressing objects

You can suppress or unsuppress vulnerabilities, findings, and vulnerability groups from several places in the runZero platform. To suppress an individual finding or vulnerability, use the “Suppress” button in the header of its detail page. For bulk actions, use a data grid view such as the vulnerability inventory by asset, the vulnerability groups inventory, or the findings list.

When you suppress an object, a modal asks for a reason and an optional comment. Select the reason that fits best from the dropdown menu, or select “Other” and give your own reason in the comment box. Click “Suppress” to confirm. On success, the modal closes and the object is marked as suppressed.

A suppressed finding or vulnerability shows a banner at the top of its detail page. To unsuppress it, click “Remove suppression” and confirm.

In a data grid view, select rows with their checkboxes, click “Modify”, and choose “Suppress” or “Remove suppression” from the dropdown menu to act on many objects at once. Each row also has action buttons for suppressing or unsuppressing that row alone.

In the vulnerability inventory by asset, the vulnerability groups inventory, or the findings list, the boolean search term suppressed filters for suppressed or unsuppressed items. For example, suppressed:true finds all suppressed items, and suppressed:any shows suppressed and unsuppressed items together.

Each data grid view also has a “Suppression” quick filter button whose menu switches the view between all items regardless of suppression state, only suppressed items, and only unsuppressed items.

Dashboard widget

The “Suppression overview” dashboard widget shows a count of suppressed findings, vulnerabilities, and vulnerability groups at a glance. Add it to any custom dashboard from the widget library modal.

Suppression events

Suppression actions trigger runZero system events, which can drive rules in the rules engine. The suppression events are:

  • vulnerabilities-suppressed: fires when a vulnerability is suppressed.
  • vulnerabilities-unsuppressed: fires when a vulnerability’s suppression is removed.
  • findings-suppressed: fires when a finding is suppressed.
  • findings-unsuppressed: fires when a finding’s suppression is removed.
  • vulnerability-groups-suppressed: fires when a vulnerability group is suppressed.
  • vulnerability-groups-unsuppressed: fires when a vulnerability group’s suppression is removed.
Updated