Add system note when a vulnerability is redetected

Why are we doing this work

We do not create a system note on a vulnerability when it transitions from resolved to detected due to re-appearing in a new scan. This is confusing since users expect to see a record of all the state transitions in the vulnerability notes. In the screenshot below, the vulnerability is flipping between detected and resolved.

We should update MarkResolvedAsDetected so that it also creates a system note indicating that the vulnerability re-appeared.

Relevant links

Non-functional requirements

• Documentation:
• Feature flag:
• Performance:
• Testing:

Implementation plan

In MarkResolvedAsDetected, insert Notes and SystemNoteMetadata for all of the redetected vulnerabilities. AutoResolveService can be used as an example.

• The action should be vulnerability_detected
• The comment should indicate that the vulnerability re-appeared and link to finding_map.pipeline if available

Verification steps