Excluding Issues

Why do you need to exclude issues from Nanitor?

An important step while hardening your IT infrastructure is to do due diligence on detected issues of Nanitor. Some of the detected issues of Nanitor might not apply to the IT infrastructure, are false positives, or are hard or impossible to remove. Resolving issues might also have severe consequences for the stability or functionality of a running system and in those cases, you might rather accept the risk of an existing issue rather than remediate the detected issue by Nanitor. Removing issues from the diamond or from the list of detected issues in Nanitor is an essential piece in making progress toward an improved security posture. The issue in Nanitor can be "removed" after due diligence. Removing an issue from Nanitor is an acceptance of the possible thread a detected issue can cause. 

This process is called an "exception" within Nanitor. An exception for an issue can be made for all assets where an issue has been detected, assets with a specified label, or dedicated assets only. This gives you the ability to remove a detected issue only for those assets where remediation is not possible, the issue does not apply or you accept the risk.

Excluding an issue globally

Looking through the list of your issues may uncover an issue that might be wrongly flagged or might not apply to your organization at all. In those cases open the issue and click on the exception button on the top right.

This will bring up a popup where you need to enter at least a comment or a reason why this issue can be excluded/flagged from Nanitor.

If you need only exclude that issue for a subset of assets you can do so by applying the exclusion rule only for a specific label that defines the set of assets to which you want this exclusion rule to be applied. For those cases select one or labels from the dropdown list.

If you want to buy yourself some time and exclude an issue only temporarily until a final decision or better due diligence has taken place, it can be useful to exclude an issue for a certain amount of time. That could e.g. also be the case when you know e.g. that a patch is not going to be installed before next month and you wish to not populate any more in the list of flagged issues by Nanitor.

Excluding issues for specific assets

Sometimes it might also be the case that you only want to exclude an issue for specific assets where an issue has been detected on. Simply click on the number of assets where for the detected issue.

This will bring you to the list of the affected assets.

Now after an evaluation, you can select the assets which you want to have this issue removed from and click again on the top right button to exclude the assets from the scope of that issue.

That will bring up a confirmation window with the two assets that you have selected earlier.