Some Alerts Marked As Closed Even Though They Are Still Vulnerable?

Alerts in Shadow Map may sometimes be marked as Closed even though the vulnerability persists. This can happen due to several factors related to scanning limitations, connectivity issues, or temporary fluctuations in exposure counts.

Possible Reasons for Incorrectly Closed Alerts

1. Technical Issues on the Shadow Map Side

   • Software bugs, maintenance, or system updates may temporarily affect scanning results, leading to alerts being incorrectly marked as closed.
   • The Shadow Map team actively works to resolve such issues to ensure accuracy.

2. Firewall Blocking on Client Servers

   • If the client’s firewall blocks Shadow Map’s IP addresses, scanners may be unable to access the server, preventing the detection of existing vulnerabilities.
   • In such cases, previously detected alerts may disappear and be marked as closed until access is restored.

3. Connectivity Issues with Client Servers

   • If Shadow Map scanners fail to connect to a server due to network disruptions, scans may not detect vulnerabilities that are still present.
   • This can cause alerts to be incorrectly marked as closed when they should remain open.

4. Temporary Server Downtime

   • If a client’s server is offline during a scheduled scan (due to maintenance, updates, or outages), Shadow Map may not detect previously flagged vulnerabilities.
   • This can result in alerts being closed automatically, even though the vulnerability still exists.

Reopened Alerts: Why Do They Appear Again?

• If a previously closed alert is detected again in subsequent scans, Shadow Map reopens the existing alert rather than creating a new one.
• This helps track recurring vulnerabilities and ensures that organizations are aware of security gaps that may not have been fully mitigated.

How to Prevent Alerts from Being Incorrectly Closed?

• Ensure Shadow Map’s IPs are whitelisted to avoid scan disruptions.
• Manually verify critical alerts if unexpected closures occur.
• Review reopened alerts promptly to address unresolved vulnerabilities.