How to Suppress and Globally Suppress Open Ports in CYRISMA
This article explains how to suppress open port detections within CYRISMA's Vulnerability Management module. Suppressing these findings helps reduce alert fatigue and improves scan result relevance—especially for environments where certain open ports are known and accepted. This applies to internal unauthenticated scans, external IP scans, and web application scans.
Written by Liam Downward
Updated at June 20th, 2025
- User Manual
- Self Onboarding Guide
- Agents
- The Cyber Risk Assessment Process
- PSA Integrations
- General Questions and Troubleshooting
- The Cyber Risk Assessment Process (Video Tutorials)
- Sales and Prospecting Articles
- CYRISMA Partner Portal Access
- Glossary
- API Documents
- CYRISMA Change Log
- Support Ticket SLA
- Billing Questions
Table of Contents
Suppressing an Open Port for a Specific Host
Log in to the CYRISMA dashboard.
Navigate to Vulnerability Scan > Scan History and select either:
Internal Unauthenticated
External
Web App
Click on the scan result and drill down by selecting a machine or IP address from the Vulnerabilities Breakdown chart.
Once in the Host Vulnerability Summary, expand the row for the open port you wish to suppress (e.g., Port 80 or Port 443).
Click the three-dot (•••) menu to the right of the port entry.
Select Suppress.
(Optional) Enter a justification for the suppression action.
Click Confirm or Save.
This action hides the selected port from vulnerability reports for this specific host only.
Globally Suppressing an Open Port Across All Scans
To suppress a port finding across all scanned targets within the tenant:
From Vulnerability Scan > Scan History, select any scan where the port in question appears.
Drill down into a device/IP from the Breakdown Chart and access the Host Vulnerability Summary.
Expand the relevant Open Port entry.
Click the three-dot (•••) menu and choose Globally Suppress CVE.
(Optional) Add a suppression reason for documentation purposes.
Click Confirm or Save.
This suppression will apply to all matching scan types—internal unauthenticated, external, or web app—depending on where it originated.
Important Notes:
The default suppression period is typically 30 to 90 days.
After the period expires, the suppressed port reappears for reassessment.
You can configure suppression duration under:
Admin → System Config → Suppression Days