Dismissal Settings and Snooze

Centralized dismissal controls and the Snooze workflow for temporarily deferring findings.

Overview

The Dismissal Settings tab in the Policies page centralizes the controls that govern how findings can be dismissed across Arnica. From this screen, security administrators can:

• Enforce review for status changes and severity changes submitted from the Arnica UI.

• Turn off the No Capacity dismissal status so it no longer appears in the UI, ChatOps responses, or pull request comments.

• Enable Snooze, a time-bound dismissal that automatically re-opens a finding when the snooze period expires.

Snooze is intended for temporary deferrals — work that a team cannot tackle immediately but does not want to dismiss outright. Snoozed findings remain tracked in Arnica, are excluded from active dismissal flows for the configured number of days, and re-open automatically with optional notifications when the snooze period ends.

Where to find Dismissal Settings

In Arnica, navigate to Admin → Policies and select the Dismissal Settings tab. These settings apply globally across all findings (both secrets and code risks).

The Dismissal Settings tab consolidates the review, No Capacity, and Snooze controls in one place.

Settings

Each setting below is toggled via a checkbox in the Dismissal Settings panel. Changes are committed when you click Save Changes in the top-right corner of the panel.

Require Review for Status and Severity changes made from Arnica UI

When enabled, the Collaborator, Collaborator-Product, and Maintainer-Product roles can no longer change a finding directly from the Code Risks or Secrets pages. Instead, those roles are given the ability to request the change, and a reviewer must approve it before it takes effect. The finding moves to the Pending Review status while a request is outstanding.

The requirement covers both kinds of triage decision:

Action	How the request is reviewed
Status changes, including dismissals	Dismissal requests are processed based on policies using the "User Dismissed Finding Via ChatOps" trigger, which routes them to the reviewers you nominate.
Severity changes, including CVE severity changes on SCA findings and resets of either	Reviewers approve or deny the request from the finding's Timeline tab. See Manual Severity Changes.

This setting governs status and severity changes submitted directly from the Arnica UI only. For routing review requests submitted via ChatOps, see Require Review Before Dismissal.

Disable "No Capacity" dismissal status

When enabled, the No Capacity dismissal status is no longer offered as an option in:

• The Change Status menu on the Code Risks and Secrets pages.

• ChatOps dismissal replies (Slack and Microsoft Teams).

• Pull request comment dismissal commands.

Findings that were previously dismissed with No Capacity retain that status and remain filterable; the setting only blocks new dismissals from being recorded with this status.

The legacy No Capacity status behaves like a permanent dismissal. Snooze is intended as the time-bound replacement for the temporary-deferral use case that No Capacity was often used for.

Enable Snooze functionality

When enabled, developers and operators can snooze findings for a defined number of days. Turning on Snooze automatically also enables Disable "No Capacity" dismissal status to avoid maintaining two overlapping temporary-deferral options

Two additional controls become available when Snooze is enabled:

Snooze for X Days

Sets the default snooze duration applied to any finding that is snoozed.

• Default: 30

• Allowed range: 1 – 365

The snooze expiration date is calculated at the moment the finding is snoozed. Later changes to Snooze for X Days apply only to newly snoozed findings; already-snoozed findings keep their original expiration date.

Re-open notifications for snoozed findings

Controls whether Arnica sends a notification when a snoozed finding auto-reopens at the end of its snooze period.

Option	Behavior
No Notifications (default)	The finding silently transitions back to Open. Re-opening is still recorded in the finding timeline.
Send Instant Message	Arnica sends an instant message via ChatOps. Recipients are configured using the same instant-message selectors as the rest of the policy engine.
Notify Via Product Mapping	Recipients are resolved dynamically from the product ownership mapping for each finding. See Prioritization & Product Ownership.

Snoozing a finding

Once Enable Snooze functionality is turned on, Snooze appears as a dismissal option everywhere existing dismissal statuses are exposed.

From the Arnica UI

On the Code Risks or Secrets page, select one or more findings, open Change Status, and choose Snooze. Provide a justification when prompted. The finding's status transitions to Snoozed and the timeline records the expiration date.

A snoozed finding shows the expiration date on its timeline.

From ChatOps

In the Slack or Microsoft Teams message for a finding, click Dismiss and pick Snooze from the dismissal-reason menu. Arnica records the justification text and snoozes the finding for the configured number of days.

From pull request comments

Arnica's pull request comments accept [arnica] commands for dismissal actions. When Snooze is enabled, snooze is added to the list of valid dismissal reasons alongside fp (false positive) and accept.

The [arnica] dismiss snooze command becomes available once Snooze is enabled.

Reply directly to the Arnica bot's comment using one of the supported command forms:

[arnica] dismiss snooze <reason>

For example:

[arnica] dismiss snooze This will need to wait for a future sprint

Arnica acknowledges the dismissal in the pull request thread and updates the finding's status to Snoozed.

Re-opening snoozed findings

Arnica re-opens snoozed findings automatically when their stored expiration date is reached.

When a finding is re-opened by the system:

• The finding's status transitions back to Open.

• The timeline records the system-driven re-open and preserves the original snooze reason for audit.

• The re-open notification configured in Re-open notifications for snoozed findings is sent.

The timeline preserves the snooze reason, expiration, and system re-open event.

Example: ChatOps re-open notification (Microsoft Teams)

Microsoft Teams notification fired when a snoozed finding auto-reopens. The previously recorded snooze reason is included for context.

Behavior summary

Aspect	Behavior
Scope	Dismissal Settings apply globally to all findings (hardcoded secrets and code risks).
Review requirement	Applies to status changes and severity changes made from the Arnica UI by the Collaborator, Collaborator-Product, and Maintainer-Product roles, on both hardcoded secrets and code risks.
Tenant default	Snooze and Disable "No Capacity" dismissal status are off by default.
Snooze duration	Stored as a fixed expiration date on the finding; later policy changes do not affect already-snoozed findings.
Auto re-open	Performed by a scheduled background job at the stored expiration date.
Re-open notifications	Honor the option selected in Re-open notifications for snoozed findings; product-mapped routing reuses the existing Product Ownership mapping.
Backward compatibility	Tenants that do not enable Snooze see no change in dismissal behavior. Findings historically dismissed with No Capacity retain their status.

Related

• Require Review Before Dismissal — routing dismissal review requests via ChatOps policy rules.

• Rerun Arnica Status Check — rescan a pull request with [a] rerun.

• Manual Severity Changes — adjusting a finding or CVE severity, and the review workflow for those changes.

• Code Risk Policy Settings — full policy engine reference.

• Secrets Policy Settings — secrets-specific policy controls.

• ChatOps — Slack and Microsoft Teams integration overview.