--- description: "The Treatments section in the Fluid Attacks platform allows you to define business decisions concerning vulnerabilities, including assigning fix work to users." keywords: "accept vulnerability, remediate vulnerability, assign fix work, temporarily accepted, permanently accepted, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: Assign treatments --- # Assign treatments import { Image } from "@/components/image"; A treatment represents the organizational decision that you make concerning your approach to a vulnerability. This page presents a guide on how to apply treatments to reported vulnerabilities on Fluid Attacks' platform. ## Define a treatment for a vulnerability > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Vulnerability Manager or Group Manager Follow these steps to define the treatment for a detected vulnerability: 1. Access the [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group) where the vulnerability is reported. Select a group on the Fluid Attacks platform

Select a group on the Fluid Attacks platform

1. In the group's **Vulnerabilities** section, select the weakness in question. You can also go to Vulnerabilities directly from an [email link](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Vulnerability_alert), if you received a notification about it. Select a type of vulnerability on the Fluid Attacks platform

Select a type of vulnerability on the Fluid Attacks platform

1. Find the vulnerability for which you need to define a treatment, select the issue by checking the box next to it and click on the **Edit treatment** button. Edit a vulnerability treatment on the Fluid Attacks platform

Edit a vulnerability treatment on the Fluid Attacks platform

> [!TIP] > > If assigning the same treatment to multiple vulnerabilities, you can select them and then click **Edit treatment**. 1. In the pop-up window, select the treatment for the vulnerability. Assign vulnerability treatment on the Fluid Attacks platform

Assign vulnerability treatment on the Fluid Attacks platform

These are the treatments available in the platform: - **Untreated:** The default state of a newly discovered vulnerability, indicating no action is taken. - **In progress:** Acknowledges the vulnerability and assigns it to a member with the [User](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#User_role) role for remediation. After successful treatment assignment, the member sees this vulnerability in their [To do section](https://help.fluidattacks.com/portal/en/kb/articles/see-vulnerabilities-assigned-to-you). - **Temporarily accepted:** The vulnerability and its associated risks are accepted for a defined period. (Requires specifying a treatment date.) - **Permanently accepted:** The vulnerability and its associated risks are accepted indefinitely. At any time, a vulnerability with this treatment can be changed to 'In progress'. - **[Request zero risk](https://help.fluidattacks.com/portal/en/kb/articles/request-a-vulnerability-be-dismissed-as-zero-risk):** Used when your organization determines that the vulnerability poses no threat. A request is sent to Fluid Attacks to remove the vulnerability from the report. If Fluid Attacks determines otherwise, it remains reported. > [!TIP] > > **Note:** If you have the User role and select any of the acceptance treatments, your edit is handled as a request which has to undergo consideration by a member with the [Vulnerability Manager](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Vulnerability_Manager_role) or [Group Manager](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Group_Manager_role) role. Read further to learn how to [approve treatments](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Approve_or_reject_vulnerability_acceptance_treatments) with these roles. 1. Complete the form with the required information. Fill out treatment form on the Fluid Attacks platform

Fill out treatment form on the Fluid Attacks platform

Here are the descriptions of the remaining fields: - **Assignee:** The member responsible for addressing the vulnerability (not present when 'Untreated' or 'Request zero risk' are selected) - **Treatment justification:** Explanation for the chosen treatment - **Temporarily accepted until:** The date until which the 'Temporarily accepted' treatment is valid (only present when choosing this treatment) - **Tags:** Labels to help categorize and manage the vulnerability (optional) > [!TIP] > > You can use tags to facilitate searching for vulnerabilities reported in the Locations table. Moreover, you can go to [Analytics](https://help.fluidattacks.com/portal/en/kb/articles/common-analytics#Vulnerabilities_by_tag) to see the number of vulnerabilities for each of the tags you or other team members have created. - **Bug-tracking system URL:** URL of the issue in your bug-tracking system (BTS) related to this vulnerability (not present when 'Untreated' or 'Request zero risk' are selected) - Click on **Confirm** when you are done. Alternatively, as step 3, you may simply click on the vulnerability's location instead. Then, in the pop-up window, switch to the **Treatments** tab and proceed from step 4 as instructed above. Edit vulnerability treatment on the Fluid Attacks platform

Edit vulnerability treatment on the Fluid Attacks platform

## Assign fix work to members > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Vulnerability Manager or Group Manager > [!TIP] > > Members with the User role can assign fix work to themselves. Assigning fix work to members is a crucial step in effective vulnerability management, as it ensures accountability and that identified vulnerabilities are actively addressed and remediated in a timely manner. Use Fluid Attacks' platform to facilitate this task: 1. Go to your group's [**Vulnerabilities** section](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_the_list_of_vulnerabilities_detected). 1. Select the type of vulnerability in question. You can also go to the type directly from an [email link](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Vulnerability_alert), if you received a notification about it. 1. From **Locations**, select the specific vulnerability whose remediation you want to assign to yourself or a team member. > [!TIP] > > To do this, you can either (a) click the check box next to the vulnerability and then the **Edit** button or (b) click on the vulnerability's location and then, in the pop-up window, switch to the **Treatments** tab. 1. Select the 'In progress' treatment and choose the assignee. Assign fix work on the Fluid Attacks platform

Assign fix work on the Fluid Attacks platform

1. Provide any necessary instruction or an explanation for the assignment in **Treatment justification**. 1. Modify other values if needed ([see the descriptions above](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Define_a_treatment_for_a_vulnerability)) and click **Confirm** to apply the treatment. > [!TIP] > > **Notes:** > > 1. You can assign 'Untreated' vulnerabilities for remediation or reassign 'In progress' vulnerabilities. > 2. You can even assign 'Temporarily accepted' and 'Permanently accepted' vulnerabilities. > 3. [Vulnerability Managers](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Vulnerability_Manager_role) and [Group Managers](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Group_Manager_role) can assign vulnerabilities to any group member. > 4. Only Fluid Attacks staff can assign vulnerabilities to other Fluid Attacks members. > 5. The **Assigned** dropdown list only shows valid options for assignment. The newly assigned member receives an [email notification](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Vulnerability_assignment) telling them what vulnerability is assigned to them and the group where it is reported. And members subscribed to [treatment updates](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Treatment_updates) notifications are also informed of the assignment. In both cases, the email provides a link to the relevant Locations section. The person who is assigned fix work can find the newly added task in their To do section, accessible from the top-right menu. A red dot in this section's icon represents pending remediation work. To learn to use this section, read [See vulnerabilities assigned to you](https://help.fluidattacks.com/portal/en/kb/articles/see-vulnerabilities-assigned-to-you). See assigned vulnerabilities on the Fluid Attacks platform

See assigned vulnerabilities on the Fluid Attacks platform

## Approve or reject vulnerability acceptance treatments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Vulnerability Manager or Group Manager Fluid Attacks' platform allows for accepting vulnerabilities temporarily or permanently, which means doing no fix work to address them for a defined period or indefinitely, respectively. If you have the Vulnerability Manager or Group Manager role, and you have the [Treatment updates](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Treatment_updates) notification enabled, you receive emails about your team's vulnerability acceptance requests. You have a **deadline of five days** to respond with your approval or rejection. In case of no response, the [vulnerability's treatment](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Define_a_treatment_for_a_vulnerability) reverts to 'Untreated' or 'In progress', whichever was previous to the request. The following are the steps to respond to acceptance requests: 1. Locate the vulnerability in question, either following the link in the email or going to your group's [**Vulnerabilities** section](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_the_list_of_vulnerabilities_detected) and accessing the type's **Locations** section. 1. Click the **Treatment acceptance** option. Accept vulnerability on the Fluid Attacks platform

Accept vulnerability on the Fluid Attacks platform

1. In the pop-up window, specify the treatment request you are responding to. Respond to acceptance request on the Fluid Attacks platform

1. Choose to approve or reject the request using the toggle and provide your feedback. Manage acceptance requests on the Fluid Attacks platform

1. To apply your decision, click on **Confirm**. If you reject the request, the vulnerability's treatment will revert to 'In progress' or 'Untreated', whichever was its treatment before the request. > [!TIP] > > **Free trial** > Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).