Risk Acceptance
Use the Risk Acceptance management page to:
- See high priority accepted risks sorted by their acceptance date to re-accept, extend the date, add notes, or revoke acceptance
- Re-accept an expired accepted risk because it is still relevant
- Revoke an accepted risk to mark the policies effected by it as to remove the acceptance and re-evaluate the effected resources
- Edit the expiration date to postpone it
Risk Acceptance for Posture
Risk Acceptance for Posture requires role permission to read or edit.
Prerequisites
- Sysdig Secure SaaS with the current Compliance module
- Review how to use the Option: Accept Risk in posture/compliance findings
Usage
Log in to Sysdig Secure and select Policies > Risk Acceptance | Posture.
Make sure that you have the required permission: Posture, Risk Acceptance (read or edit).
Any compliance risks that were accepted are displayed, in order of acceptance date.
Filter results by:
Context: Free text search on relevant terms such as the Platform, Control Name, Resource Name
Reason:
Risk Owned
,Transferred
,Avoided
,Mitigated
,Not Relevant
,Sysdig Accepted Risk
, orCustom
.Note that
Sysdig Accepted Risks
are autogenerated and an explanation is included in the hover-over tooltip.User: View acceptances by who created them
Expired/Active: Note that the table can be sorted by expiration or acceptance date, ascending or descending
Select an entry to open its detail drawer and:
- Revoke an acceptance
- Edit the
Reason
orExpiration
details - Make sure that you have the required permission: Posture, Risk Acceptance - edit.
Risk Acceptance for Vulnerabilities
Prerequisites
Review Understanding Risk Acceptance for Vulnerabilities for a full overview of how this feature is used for vulnerability findings, including:
- Enablement prerequisites
- Types of risk assessed
- How to use in Pipeline and Runtime scan results
Use the Accept Risk | Vulnerabilities panel to review acceptances that are expired or close to expiry and manage them.
Usage
Log in to Sysdig Secure and select Policies > Risk Acceptance | Vunerabilities.
Any vulnerabilities that were accepted are displayed, in order of acceptance date.
Filter results by:
- Search: Free text search on relevant terms such as the image name, package name, CVE ID, etc.
- Entity:
Vulnerability
,Image name
,Host name
- Reason:
Risk Owned
,Transferred
,Avoided
,Mitigated
,Not Relevant
, orCustom
. - Expired/Active: Note that the table can be sorted by expiration or acceptance date, ascending or descending
Select an entry to open its detail drawer and:
- Revoke an acceptance
- Edit the
Reason
orExpiration
details
Note: When an acceptance expires, it no longer excludes the vulnerability from the vuln count.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.