Issue Lifecycle
Issue Lifecycle
Every issue in FortWatch follows a defined lifecycle from creation to resolution. Understanding this lifecycle helps you manage your security workflow effectively.
Issue Statuses
- Open — The issue has been identified and needs attention. This is the default status when an issue is created.
- In Progress — Someone is actively working on resolving the issue.
- Resolved — The issue has been fixed. If a scan closed it, a later scan that finds the same vulnerability reopens it. If someone on your team marked it fixed, scans leave it closed.
- Dismissed — The issue has been acknowledged but intentionally set aside. See the Dismissing Issues article for details.
Automatic Issue Creation
Issues are automatically created when:
- A scan produces a finding with Critical or High severity.
- No existing open or in-progress issue matches the same vulnerability type and asset.
This ensures critical and high-severity findings always have a tracked action item without requiring manual intervention.
Working an Issue
A typical issue workflow looks like this:
- Review — Read the issue details, including the underlying finding, severity, and affected assets.
- Analyze — Use AI Analysis to get remediation guidance and understand the risk.
- Fix — Apply the recommended remediation steps on your infrastructure.
- Rescan — Run a manual scan to verify the fix. If the vulnerability is no longer detected, the finding will not appear in the new scan results.
- Resolve — Mark the issue as resolved.
Issue Reopening
If a scan closed an issue because it no longer found the vulnerability, and a later scan finds it again, FortWatch automatically reopens the issue. This prevents fixes from silently regressing.
An issue your team closed (marked fixed, a false positive, or snoozed) is your decision: scans don't check it again or reopen it. Reopen it yourself if the problem comes back; a snoozed issue also reopens when its snooze ends. To have FortWatch confirm a fix, run a rescan instead of marking the issue fixed: the issue closes on its own once the scan no longer finds the problem.
Multi-Asset Issues
A single issue can be linked to multiple assets if the same vulnerability is found across several targets. The issue will show all affected assets, and resolving it implies the fix has been applied everywhere.