Approving Results from Policy Monitor Questions
SUMMARY You can evaluate the results that are returned from a Policy Monitor question in JSA Risk Manager. Approving a result of a question is similar to tuning your system to inform JSA Risk Manager that the asset that is associated with the question result is safe or can be ignored later.
When a user approves an asset result, the Policy Monitor detects that asset result as
approved. Then, when the Policy Monitor question is submitted or monitored in the future, the asset
is not listed in the question results. The approved asset does not display in the results list for
the question unless the approval is revoked. The Policy Monitor records the user, IP address of the
device, reason for approval, the applicable device or rule, and the date and time. Approve results
to Policy Monitor questions that don't represent risk in your network.
- In the results table, select the checkbox next to the results you want to accept.
- Choose one of the following options:
Option Description Approve All Select this option to approve all the results. Approve Selected Select the checkbox next to the results that you want to approve, and then click Approve Selected. - Type the reason for approval.
- Click OK.
- Click OK.
- To view the approved results for the question, click View Approved.
The Approved Question Results window provides the following information:
Parameter | Description |
---|---|
Device/Rule | The device that is associated with this result in Device/Rule Results. |
IP | The IP address that is associated with the asset in Asset Results. |
Approved By | The user that approved the results. |
Approved On | The date and time the results were approved. |
Notes | Displays the text of the notes that are associated with this result and the reason why the question was approved. |
If you want to remove approvals for any result, select the checkbox for each result for which you want to remove approval and click Revoke Selected. To remove all approvals, click Revoke All.