Declara
⌘K
compliance-ownerauditorP0Updated
Was this page helpful?

VEX exists to say the thing Article 14 also turns on: a vulnerable component being present in your SBOM is not the same as your product being affected by it. Declara uses VEX statements to suppress matches you've already assessed — but only up to a point, and that boundary is the part worth understanding rather than just following.

The rule

  • not_affected and fixed are finished assessments. They suppress a match before it becomes an alert.
  • under_investigation is not a finished assessment. It never suppresses, regardless of how confident the statement sounds.
  • A statement that arrives after an alert is already open does nothing, even if its status is not_affected or fixed.

Why suppression only works before an alert exists

Suppression is checked at match time, against every VEX statement in your workspace, before deciding whether a match should raise an alert. If a suppressing statement is already on file when a component starts matching an advisory, the match is recorded as suppressed and nobody is interrupted.

Why an open alert doesn't retroactively close

Once an alert exists, somebody is presumably already looking at it — that's what the alert is for. If a VEX statement arriving afterward could silently close it, a real finding could disappear from view exactly when someone had started paying attention to it, with no human decision behind the disappearance. That's a worse failure mode than a redundant statement sitting unused next to an alert someone is already working through.

This is a deliberate design choice, not a bug and not an oversight: where Declara has a choice about whether the system decides quietly or a human sees the change, it errs toward the human seeing it.

What to do instead

If you've assessed a match as not_affected or fixed and an alert is already open on it, closing that alert is a triage decision you make explicitly — through the alert's own triage flow, not by resubmitting the VEX statement. The statement is still recorded and still visible as context; it just isn't the mechanism that closes an alert that's already been raised.

Related