Scanner Rules
Overview
Section titled “Overview”Scanner rules are the individual security checks that run during scans across your repositories, cloud infrastructure, domains, and other assets. Fencer maintains a global catalog of rules and lets you enable or disable them per organization. By managing which rules are active, you control the scope and noise level of your security findings.
Prerequisites
Section titled “Prerequisites”- At least one scan type configured (code, cloud, domain, or application scan).
- Any built-in role can view rules. Enabling or disabling a rule and ignoring a rule’s vulnerabilities needs permission to edit scans, which the Administrator role has.
How it works
Section titled “How it works”Every check Fencer runs is registered as a scanner rule, and every rule is enabled for your organization until you disable it. Each rule is classified by category, rule type (Predefined or Advisory), and the type of asset it applies to (Code, Infrastructure, SaaS, Artifacts, Domain, Application, or Endpoint). Rules link directly to the findings and vulnerabilities they produce, giving you a clear view of which checks generate the most noise or the most actionable results.
When you disable a rule, new vulnerabilities from that rule are automatically marked as ignored with the Rule Disabled reason. To find which rule produced a specific vulnerability, open the vulnerability’s detail page and look in the More Info section.
Usage / Configuration
Section titled “Usage / Configuration”Viewing scanner rules
Section titled “Viewing scanner rules”- Go to Main > Vulnerabilities.
- Select the Rules tab to open the scanner rules page.
- Pick a category in the left-hand list, or scroll through all rules. More rules load as you scroll.
The page opens filtered to Rules is Matched, which shows only rules that have produced vulnerabilities in your organization. Remove that filter to browse the whole catalog. Click How do rules work? for a short explanation in the app.
Filtering and sorting rules
Section titled “Filtering and sorting rules”Use the filter bar and search to narrow down rules:
- Status — Enabled or Disabled rules.
- Rules — Only rules matched by vulnerabilities in your organization.
- Rule Type — Predefined or Advisory.
- Asset Type — Code, Infrastructure, SaaS, Artifacts, Domain, Application, or Endpoint.
- Integration — Rules from a specific scan integration.
- Framework — Rules mapped to a compliance framework.
- Added — When the rule was added.
- Search — Free-text search across rule titles and check IDs.
Sort by Category (the default), Open Vulnerabilities, Resolved Vulnerabilities, or Ignored Vulnerabilities.
Click a rule card to expand it and see its open, resolved, and ignored vulnerability counts, its total findings, and which compliance frameworks it maps to. A disabled rule also shows who disabled it.
Enabling or disabling a rule
Section titled “Enabling or disabling a rule”- Find the rule you want to toggle.
- Click the toggle switch on the rule card to enable or disable it for your organization.
Reviewing suggestions
Section titled “Reviewing suggestions”Fencer tracks how many vulnerabilities from each rule your team has ignored. When a rule reaches 10 or more ignored vulnerabilities in your organization, the rules page shows a banner: “Some rules have been ignored often. Consider disabling them.”
- Click Review rules in the banner to show only the suggested rules. Click Show all rules to go back.
- Review each suggested rule and decide whether to disable it or ignore its open vulnerabilities.
Ignoring all vulnerabilities for a rule
Section titled “Ignoring all vulnerabilities for a rule”When you disable a rule that still has open vulnerabilities, Fencer asks whether you want to ignore them:
- On the rule card, click Yes, ignore in the “Would you like to ignore all open vulnerabilities for this rule?” prompt (or Dismiss to keep them open).
- In the Ignore Vulnerabilities dialog, choose a Reason for ignoring and optionally add notes.
- Click Ignore to mark all open vulnerabilities from that rule as ignored.
Examples
Section titled “Examples”Disabling a noisy rule
Section titled “Disabling a noisy rule”Suppose a static analysis rule generates many false positives in your codebase because you use a framework that auto-escapes output.
- Go to the Rules tab and search for the rule name or check ID.
- Find the rule card and confirm the matching check ID.
- Toggle the rule off for your organization.
- When asked, click Yes, ignore and choose False Positive to clear its existing open vulnerabilities.
Acting on a suggestion
Section titled “Acting on a suggestion”You notice the suggestions banner and click Review rules. For a rule with 15 ignored findings, you decide to disable it entirely and ignore its remaining open vulnerabilities. For another rule, you keep it enabled and leave its vulnerabilities for your team to triage.
Troubleshooting
Section titled “Troubleshooting”- A disabled rule still has open vulnerabilities. Disabling a rule doesn’t change existing vulnerabilities. Ignore them from the prompt that appears when you disable the rule, or triage them on the Vulnerabilities page.
- A rule I expected isn’t listed. The page shows only matched rules by default. Remove the Rules is Matched filter to see the whole catalog.
- The suggestions banner doesn’t appear. Suggestions only show when at least one enabled rule has 10 or more ignored vulnerabilities in your organization.
- The toggle doesn’t save. Changing a rule needs permission to edit scans. Ask an Administrator.