Meaning of "Reopened" Alerts and How to Identify Causes?

Reopened Alerts (Reopened Tag)

Reopened alerts are previously closed alerts that reappear in later scans. Instead of creating a new alert entry, Shadow Map reopens the existing alert and updates its status to Reopened. These alerts require review and investigation to ensure that the underlying issue has been properly addressed.

Possible Reasons

1. Maintenance or Updates

   • An alert may have been resolved and marked closed, but subsequent system updates, patches, or configuration changes may inadvertently reintroduce the vulnerability.
   • When detected again, Shadow Map will reopen the alert for reassessment.

2. Connectivity Issues

   • If Shadow Map’s scanning IPs were blocked by the host server or if there were temporary connectivity issues, the scanner may not detect the vulnerability in some scans.
   • This could result in the alert being automatically closed, as it appears to be resolved.
   • Once connectivity is restored and the vulnerability is detected again, the alert will be reopened with an updated status.

                   More Possible Reasons

Closed Alerts (Closed Tag)

Closed alerts are those that Shadow Map has marked as resolved. These alerts are assigned a Closed tag, indicating that they are no longer detected as active vulnerabilities.

Conditions for an Alert to be Marked as Closed:

• Shadow Map conducts regular scans at scheduled intervals.
• If an alert is not detected in subsequent scans, it is considered resolved and automatically assigned a Closed tag.
  
  

Ensuring Accuracy in Alert Status

To prevent unresolved vulnerabilities from being incorrectly marked as closed:
✔️ Regularly verify patches and updates to ensure they effectively remediate issues.
✔️ Monitor server and network configurations to avoid blocking Shadow Map’s scanning IPs.
✔️ Investigate reopened alerts promptly to address any potential re-emergence of threats.