Create Mitigation Job

You can create a mitigation job to reduce the risk from vulnerabilities on your assets when a patch is not available or can not be deployed yet. A mitigation job applies a mitigation, such as stopping a vulnerable service, without installing a patch. The QID may contain one or more CVEs, and each CVE has an associated Qualys Detection Score (QDS).

You can start a mitigation job from VMDR or from Enterprise TruRisk™ Management (ETM). The starting point decides what the window pre-populates for you. 

Start from How to open the window Pre-populated in the window
VMDR Navigate to the VMDR > Vulnerabilities tab and select the QID to mitigate. From the Quick Actions menu, click View Risk Elimination. You are redirected to the Mitigation > Eliminations tab. Click Mitigate Now.  The selected QID and its CVEs.
ETM Elimination Plan Navigate to TE > Eliminations > Risk Elimination Plan and open a plan handed off from ETM. On the Findings tab, click Mitigate Now for a finding, or select multiple findings, and from the Actions menu, click Create Mitigation Job. The assets associated with the selected findings, and their CVEs.
ETM Findings tab In ETM, navigate to Risk Management > Findings. In the Elimination Options column, click the mitigation count for a finding, select a mitigation option, and click Mitigate Now. The asset associated with the finding, its CVE, and the selected mitigation

The jobs that you start from ETM are CVE-based: they include the CVEs of the selected findings, rather than a QID. For the complete ETM workflow, see Prioritize and Remediate Risks from ETM.

On the Create: Mitigation Job window, perform the following steps: 

  1. Basic Information
  2. Select Assets
  3. Select Actions
  4. Schedule
  5. Options
  6. Job Access
  7. Confirmation

1. Basic Information

   Enter a job title and description of the job in the respective fields and click Next. 
   When you start the job from ETM, a job title is pre-filled, for example, RISKELIMINATIONMITIGATENOW_<number>. You can change the name if required. 

2. Select Assets

How you select assets depends on where you started the job.

When You Start the Job from VMDR

  • Click  to add the required assets to the job on which you want to apply mitigation. The Select Assets window is displayed. Select the required assets and click Apply. You can remove the asset if it is not required. 
  • Click  to add the required asset tag in the mitigation job. You can remove the added asset tag if not required. 

You can add asset tags to mitigation job, only when the QIDs are selected from the VMDR > Prioritization tab. 

 

    Important to Know
  • You can only remove assets, but cannot add additional assets to the mitigation job.
  • If you remove an asset, the associated QID is also removed from the job.
  • You need at least one asset to save the mitigation job.

When You Start the  Job from ETM

You do not need to search for assets. The job already includes the assets on which the selected findings were detected, so the job targets exactly the assets in your elimination plan. You only review them and exclude any assets you do not want to mitigate.

  • You can only remove assets, but cannot add additional assets to the mitigation job.   
  • If you remove an asset, the associated QID is also removed from the job. 
  • You need at least one asset to save the mitigation job. 
  • Review the Assets Selected from the Elimination Plan section. The assets associated with the findings you selected are pre-populated. The section shows:
    • Elimination Plan Name: The elimination plan the findings belong to.
    • Selected Assets: The number of assets on which the job runs the mitigation.
  • Click Preview to view the list of selected assets.
  • To exclude an asset on which you don’t want to run the mitigation, remove it from the list. The excluded asset is moved to the exclusion list, and the job doesn’t run on it. 
  • Click Next.

  • When you start the job from the ETM Findings tab, the asset associated with that finding is pre-populated.

Important to Know
  • You can exclude assets, but you cannot add assets or asset tags to a job that you start from ETM. Only the assets associated with the selected findings can be part of the job. 
  • Only assets that are activated for the Mitigation application are pre-populated. Assets that aren’t activated are automatically excluded.
  • If you exclude an asset, the findings on that asset aren’t mitigated by this job.
  • You need at least one asset to save the mitigation job. If you exclude all the assets, you cannot save the job.
  • To change the asset selection later, edit the job.

 3. Select Actions

The selected QID is auto-populated on this page. The respective CVEs are listed in the left column. The CVEs without available mitigation are categorized separately, as shown in the figure. 

There are two types of mitigation scripts available: 

  • Qualys script: This script is provided by Qualys and is marked as default.
  • Custom Script: The custom script with the highest impact factor is selected if the Qualys script is unavailable. These are the custom scripts created in Custom Assessment and Remediation (CAR application). For more information on the creation of custom scripts, see Create Custom Scripts.
    Note: Custom script is not supported for Mitigations jobs that are created from ETM source. 

The QID status is updated based on the selected CVEs and their available mitigations:

  • Fully Mitigable: The QID is considered Fully Mitigable if mitigation scripts are available for all included CVEs.

  • Partially Mitigable: The QID is considered Partially Mitigable if mitigation scripts are not available for some of the included CVEs.


You can select multiple or all CVEs that you want to mitigate and also select the required script you want to use for mitigation. Click Next. 

 If you do not edit the QID, by default, all the CVEs will be associated with the QID will be sent in the job.

Jobs started from ETM
The page lists the CVEs of the findings you selected, rather than a QID. For each CVE, the recommended mitigation is selected by default, and you can select another available mitigation. If you selected a mitigation option before clicking Mitigate Now, that option remains selected. 

4. Schedule

i) The On Demand job run option is selected by default, and the job is executed once enabled.

ii) To schedule the job to run at a specific time: 

  1. Click Schedule.
  2. Select the required START DATE and START TIME.
  3. To select the required timezone, click Set timezone and select from the options from the dropdown list.
    By default, the system uses the agent timezone.

  4. Click Next. 

 A mitigation job runs only once, either on demand or at the scheduled date and time. You cannot create a recurring mitigation job.

5. Options 

To configure job notification settings:

  1. Enter the email address of the recipient. You can enter a maximum of fifty email addresses.  

  2.  (Optional) Select Execution started checkbox to receive email notification when the job is started
  3. Select the Execution Completed checkbox and enter the percentage of job completion on which you want to receive the notification. 
  4. Click Next.

6. Job Access

Select the co-authors for this mitigation job and click Next. The co-authors can perform job actions based on their permissions, such as editing the job. 

 

7. Review and Confirm

Review your selections, and select Save or Save and Enable the job. 

Note that the SuperUser or Administrator can change the job status (enable/disable), delete, and edit the job.

  • When you click Save, the job is saved, and its status is DISABLED. You can enable it later. 

To run a job in the DISABLED state, you must enable it. To enable it, go to the Jobs tab and click Enable from the Quick Actions menu of a job.

  • When you click Save & Enable, the job is saved and ENABLED. This option is available only when creating a job for the first time, not when editing the job.

The Save and Enable option should be chosen only when you are confident that the job is correctly configured and in a good-to-execute state.

You can use the Disable option to temporarily disable a scheduled job. Later, at your convenience, you can re-enable the job. 

After the Job Runs

Once all the CVEs associated with the QID are mitigated, the asset status changes to Mitigated. After mitigation, the QDS score decreases according to the impact factor, reducing the vulnerability impact on the asset. For example, if the impact factor is 30 and the CVE's QDS score is 90, then after mitigation, the QDS score reduces to 60. 

 When all the CVEs associated with the QID are mitigated, only then does the asset status change to Mitigated.  

The mitigated job status can be viewed on the VMDR > Vulnerabilities tab. Click on the QDS score to see the score reduction. 

For a job that you start from ETM, track the result for each asset on the job’s Job Progress page. Job results can take some time to appear after the status is displayed. After the mitigation is applied, the finding is marked as mitigated, and its risk score is reduced based on the mitigation's impact factor.

Related Topics

Prioritize and Remediate Risks from ETM

 

 

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: October, 2026