Re-evaluating a Report

Re-evaluating means that the components captured in an existing report are evaluated against the current policy set, waiver data, and available component intelligence.

Click on the Re-Evaluate Report button on the top right of the application report to analyze the new policy configurations.

A re-evaluated report will reflect changes in the policy and waivers.

For example, if you create a new policy and then click Re-Evaluate Report, Lifecycle evaluates the components already present in the report against that policy and updates the reported violations accordingly.

Change in Re-evaluate Report functionality

Starting in Release 189, the Re-evaluate Report function evaluates the components contained in an existing report against the current policy set, waiver data, and the latest component intelligence available from Sonatype Open Source Threat Intelligence.

Keeping Records

Re-evaluating a report overwrites that report's metadata with the new results. This means that the original report and the re-evaluated report could become inconsistent. Repeated re-evaluations can exacerbate the discrepancy.

Reports can serve as records of your application's contents at a specific point in time. If this kind of record-keeping is important to your organization, then avoid re-evaluating your reports outside a testing or sandbox Application.

Re-evaluating vs. Re-scanning

Note
Re-evaluation does not reflect changes to proprietary component configuration. If you have added or updated proprietary component patterns, you must perform a new scan for those changes to take effect.

Change Type	Re-evaluate Report	New Scan Required
Policy changes	Yes	Not required
Waiver changes	Yes	Not required
Latest Sonatype threat intelligence (Release 189+)	Yes	Not required
Proprietary component configuration changes	No	Yes
New or changed application dependencies	No	Yes
Source code changes	No	Yes

The Re-Evaluate Report button is not a new scan of your application. It evaluates the existing scan data against the current policy, waivers, and the latest Sonatype threat intelligence data. It does not fetch new source code or detect new or changed components.

Re-evaluation uses the components captured in the original report and evaluates them against the current policy set, waiver data, and available component intelligence.

A new scan is required to detect new or changed application components.

Quick Re-evaluate vs. Re-evaluate

If Automated Waivers are enabled, Lifecycle provides two re-evaluation options.

Option	Behavior
Quick Re-evaluate	Evaluates the report against current policy, waiver data, and available component intelligence. Automated waiver processing is skipped.
Re-evaluate	Performs the same evaluation and also processes automated waivers, including applying or removing automated waivers where applicable.

Note
The behavior of Quick Re-evaluate and Re-evaluate differs only when Automated Waivers are configured.

If you need to re-scan :

Wait for your next CI build, if you're integrating with CI/CD tools like Jenkins.
Re-scan the application manually using the Sonatype IQ CLI.
Trigger a scan using the Source Control Evaluation REST API:

curl -u admin:admin123 -X POST \
    -H "Content-Type: application/json" \
    -d '{"stageId":"source","branchName":"main"}' \
    "http://localhost:8070/api/v2/evaluation/applications/<applicationInternalId>/sourceControlEvaluation"

Enable Default Branch Monitoring to automatically re-scan the default branch daily.

Note
Triggering a manual scan using the REST API against the source stage may pause Default Branch Monitoring for 7 days.

SCM Requirements (Maven)

For Maven projects using Source Control Evaluation:

A pom.xml must be present and discoverable in the repository.
The IQ Server must have valid credentials or token to clone the repository.
Source Control Evaluations must be enabled at the organization or application level.