# Re-evaluating a Report

Re-evaluating means that the components captured in an existing report are evaluated against the current policy set, waiver data, and available component intelligence.

Click on the _Re-Evaluate Report_ button on the top right of the application report to analyze the new policy configurations.

A re-evaluated report will reflect changes in the policy and waivers.

For example, if you create a new policy and then click Re-Evaluate Report, Lifecycle evaluates the components already present in the report against that policy and updates the reported violations accordingly.

**Change in _Re-evaluate Report_ functionality**

Starting in Release 189, the _Re-evaluate Report_ function evaluates the components contained in an existing report against the current policy set, waiver data, and the latest component intelligence available from [Sonatype Open Source Threat Intelligence](/content/products/intelligence/index.html).

## Keeping Records

Re-evaluating a report overwrites that report's metadata with the new results. This means that the original report and the re-evaluated report could become inconsistent. Repeated re-evaluations can exacerbate the discrepancy.

Reports can serve as records of your application's contents at a specific point in time. If this kind of record-keeping is important to your organization, then avoid re-evaluating your reports outside a testing or sandbox Application.

## Re-evaluating vs. Re-scanning

**Note**  
Re-evaluation does not reflect changes to proprietary component configuration. If you have added or updated proprietary component patterns, you must perform a new scan for those changes to take effect.

| Change Type | Re-evaluate Report | New Scan Required |
| --- | --- | --- |
| Policy changes | Yes | Not required |
| Waiver changes | Yes | Not required |
| Latest Sonatype threat intelligence (Release 189+) | Yes | Not required |
| Proprietary component configuration changes | No | Yes |
| New or changed application dependencies | No | Yes |
| Source code changes | No | Yes |

The _Re-Evaluate Report_ button is not a new scan of your application. It evaluates the existing scan data against the current policy, waivers, and the latest Sonatype threat intelligence data. It does not fetch new source code or detect new or changed components.

Re-evaluation uses the components captured in the original report and evaluates them against the current policy set, waiver data, and available component intelligence.

A new scan is required to detect new or changed application components.

### Quick Re-evaluate vs. Re-evaluate

If Automated Waivers are enabled, Lifecycle provides two re-evaluation options.

| Option | Behavior |
| --- | --- |
| Quick Re-evaluate | Evaluates the report against current policy, waiver data, and available component intelligence. Automated waiver processing is skipped. |
| Re-evaluate | Performs the same evaluation and also processes automated waivers, including applying or removing automated waivers where applicable. |

**Note**  
The behavior of Quick Re-evaluate and Re-evaluate differs only when Automated Waivers are configured.

If you need to re-scan :

- Wait for your next CI build, if you're integrating with CI/CD tools like Jenkins.
- Re-scan the application manually using the Sonatype IQ CLI.
- Trigger a scan using the Source Control Evaluation REST API:

```
curl -u admin:admin123 -X POST \
    -H "Content-Type: application/json" \
    -d '{"stageId":"source","branchName":"main"}' \
    "http://localhost:8070/api/v2/evaluation/applications/<applicationInternalId>/sourceControlEvaluation"
```

- Enable Default Branch Monitoring to automatically re-scan the default branch daily.

**Note**  
Triggering a manual scan using the REST API against the source stage may pause Default Branch Monitoring for 7 days.

### SCM Requirements (Maven)

For Maven projects using Source Control Evaluation:

- A `pom.xml` must be present and discoverable in the repository.
- The IQ Server must have valid credentials or token to clone the repository.
- Source Control Evaluations must be enabled at the organization or application level.