Application Vulnerability Response

Create change requests from remediation tasks in the Application Vulnerability Response application to expedite your investigation for application vulnerabilities (AVIT)s that require manual intervention.

Platform Analytics Solutions contain prepackaged Platform Analytics content for use with other ServiceNow AI Platform products. This Platform Analytics Solution presents important metrics for analyzing your Application Vulnerability Management process.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.

Track the volume, performance and progress of application vulnerabilities from initial analysis and detection to containment or remediation.

This dashboard presents important metrics for analyzing your Application Vulnerability Management process, such as viewing remediation target attainment rates.

Application vulnerabilities are vulnerabilities on your custom software applications that are scanned throughout the application’s development life cycle.

As a Appsec Manager or Security Champion, avoid creating duplicate change requests (CHG) as you work to resolve your remediation tasks by associating a remediation task (APP-VUL) to a change request that is already available in your instance.

Enable Application Vulnerability Response integrations to perform regular updates.

Automatically assign application vulnerabilities based on application tags, or any of the assignment groups in the Configuration Item [cmdb_ci] or platform assignment groups, to reduce the mean time to assignment.

Application vulnerability calculators automate calculating initial risk values for the fields on application vulnerable items (AVIs). Risk calculations offer insight into prioritizing remediation. The condition for each calculator is evaluated in order, and the first matching calculator is used.

Take steps to prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.

When data is imported from a third-party integration, Application Vulnerability Response automatically uses application data to search for matches in the Configuration Management Database (CMDB). It does this using Lookup Rules. These rules identify applications for the application vulnerable item (AVI) record to aid in remediation.Update with VR CI LOOKUP RULES changes.

Before you run Application Vulnerability Response in your ServiceNow AI Platform instance, you must configure it.

You can create rules to automatically assign application vulnerable items (AVIs) based on filter conditions. These rules assign AVIs as they are imported or manually created.

An application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item (AVI) Risk Score, can contain Risk Rules. Risk calculations offer insight in prioritizing remediation.

The CI Lookup Rules module contains rules that define what fields have matching data in the Configuration Management Database (CMDB). These rules are used to identify applications and application releases and add them to the application vulnerable item (AVI) record to aid in remediation.

Create a rule to request an exception automatically for application vulnerable items (AVI)s that meet specific conditions.

You can create rules to automatically group application vulnerable items (AVI) into remediation tasks (AVUL) based on filter conditions. These rules automatically group AVIs as they're imported or manually created.

Application Vulnerability Response severity mapping transforms third-party source severity fields to recognizable fields within Vulnerability Response.

Drive the remediation of high-risk vulnerabilities in a timely manner by setting up a remediation target rule at the application vulnerable item (AVI) level.

You can manage how the Source states on application vulnerable items (AVIs) imported by the Veracode Vulnerability Integration and Fortify Vulnerability Integration are mapped in your instance after import.

An example rule based on a known vulnerability for an exception rule.

Calculators, and Assignment Rules use conditions during import, created using the condition builder. Changes to their criteria can affect performance since each record is evaluated using these filters.

Vulnerability Response includes support for third-party integrations.

Before you can successfully remediate vulnerabilities with Application Vulnerability Response (AVR), you must assign users to user groups.

Monitoring remediation is a process that begins with reviewing status and ends with closing application vulnerable items (AVITs). Application Vulnerability Response offers tools and procedures to make that process more productive and efficient.

Reference topics containing information about tables, roles, and properties installed with the Application Vulnerability Response application.

A example of a remediation task rule example using the condition builder.

Configure remediation tasks (AVULs) to help analysts and remediation specialists organize application vulnerable items (AVI) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that AVIs are automatically assigned into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.

Applications are stored during import under Administration Discovered Applications in Application Vulnerability Response.

Application Vulnerability Response offers a state model for the status of your application vulnerable items (AVIs), at any given time. Knowing how each state relates to and affects each other helps you to determine when and how to remediate your AVIs.

Application Remediation Target Rules define the expected timeframe for remediating application vulnerable items (AVIs), providing a timeframe for remediating the vulnerability itself. For example, if an application vulnerable item contains a critical risk rating then the vulnerability on that item needs to be fixed within 15 days.

Use Common Weakness Enumeration (CWE) records downloaded from the CWE database for reference when deciding whether a vulnerability must be escalated. Update common weakness records from the Common Weakness Enumeration database on a regularly scheduled basis. You can also update the default script or write your own scripts, as needed.

Identify the repositories that you want updated regularly. You can execute a scheduled job to update National Vulnerability Database (NVD) records on a nightly or weekly basis. If it is not already running, you can enable the job

When an application vulnerable item (AVI) has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the AVI record is updated with a status. This information can help you proactively monitor upcoming remediation activities.

You can view vulnerability data imported from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE), or third-parties to decide whether to escalate a remediation task.

Application vulnerable items (AVITs) are automatically created during third-part vulnerability integration imports.

Customize the parameters and weights for the risk rule so that you can generate risk scores that use the vulnerability and asset data that are unique to your organization. By selecting the fields that are included in the risk rule, you can define an effective risk scoring framework.

Vulnerabilities are created automatically when records are downloaded from the National Vulnerability Database (NVD), Common Weakness Enumeration (CWE) or third-party integrations. NVD and CWE are stored under Libraries in Vulnerability Response or under Vulnerabilities in Application Vulnerability Response.

Add users to the approver groups so that you can request an exception.

Approve exception requests for application vulnerable items that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.

If you determine that the issue associated with an application remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for an application remediation task.

Use auto-close rules to close older AVITs automatically based on the filter conditions that you set.

Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.

Create an application remediation task (AVUL) from another application remediation task record and add application vulnerable items (AVITs) manually.

Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.

When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an application vulnerable item (AVIT) that cannot be remediated according to the policy.

Starting with Application Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Application Vulnerability Response (AVR) for the first time, the flow designer is enabled by default.

Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance.

The Application Vulnerability Response (AVR) feature of the ServiceNow Vulnerability Response application imports application vulnerable items (AVITs) and, according to rules, allows you to remediate application vulnerabilities. Vulnerability Response is available by separate subscription.

The Application Vulnerability Response (AVR) product ingests the weaknesses and vulnerabilities detected by your application security testing tools and provides a single pane of glass to understand the security posture of all the applications in your environment.

Request an exception for an application vulnerable item that cannot be remediated immediately. For example, as a developer, you can request an exception if a patch is not available for a machine.

You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models) on discovered application records.

The following terms are used in Application Vulnerability Response.

You can request to defer the remediation of an application vulnerable item and a remediation task for a specified period.

Starting with v20.0, you can defer remediation with the Awaiting Implementation state that is available for application vulnerable items (AVI)s and remediation tasks as they move through their life cycles. You can only transition records to this state manually by selecting Awaiting Implementation from AVI and remediation task records in the Under Investigation state.

After you identify the data that you want to import, the data is retrieved from the Vulnerability Response Integration with Black Duck, processed through a set of data sources, and transformed in your instance.

Import the project information from the Black Duck integration instance to make sure that the vulnerability integrations run sequentially. A successful integration helps you to identify and ingest the application vulnerable items (AVIs).

Import the Vulnerability Response integration with Black Duck project versions to the Discovered Applications [sn_vul_release] table so that the Black Duck Vulnerability integrations run sequentially. A successful integration helps you to identify and ingest the application vulnerable items (AVIs).

Import the application vulnerable items (AVIs) from the Vulnerability Response integration with Black Duck so that the integration runs sequentially. A successful integration helps you to identify and ingest the AVIs.

The Vulnerability Response integration with Vulnerability Response Integration with Black Duck uses the data that is imported from the Black Duck Software Composition Analysis (SCA) tool to help you determine the impact and priority of the flaws in your code.

Plan and execute the pre-integration tasks for the Vulnerability Response Integration with Black Duck so that your integration is successful. The Vulnerability Response Integration with Black Duck assumes that you’re familiar with the Black Duck Software Composition Analysis (SCA) application and APIs.

Verify the success of your integration runs, locate any issues, and confirm your remediation decisions by viewing the Vulnerability Integration Runs related list.

Do the following setup steps prior to configuration so that you can ensure that your configuration is complete.

Before you run the Vulnerability Response Integration with Black Duck on your instance, you must complete the installation and configuration steps so that the Black Duck Software Composition Analysis (SCA) tool properly integrates with the Application Vulnerability Response application.

Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the module. By default, an exception is requested using the ServiceNow Application Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Fortify product properly integrates with the Application Vulnerability Response feature of Vulnerability Response. This application is available as a separate subscription.

Before you run the integration on your instance, the installation and configuration steps must be completed so the GitHub product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

Establish authenticated communication between ServiceNow and Tenable.was using API keys so the platform can retrieve application and vulnerability data.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

As a App-sec Manager or Security Champion, you can create change requests from remediation tasks in the Application Vulnerability Response application.

Initiate a penetration test assessment request for your web applications, mobile applications, or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.

Create penetration test findings aligning testing with recognized standards of MASVS questionnaire into the penetration testing workflow. These findings are manually created Application Vulnerability Items (AVIs).

You can define the reason choices to be available to any user who requests an exception.

Request an extension for a deferred application vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

Configure optional modifications specifically for the Fortify Vulnerability Integration.

A successful Fortify Vulnerability Integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Fortify Vulnerability Integration assumes that you are familiar with the Fortify product and API.

The Fortify Vulnerability Integration uses data imported from the Fortify product to help you determine the impact and priority of flaws in your code.

Perform the following steps to integrate your GitHub Apps using the JWT bearer token for the GitHub Application Vulnerability Integration.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

The GitHub Application Vulnerability Integration imports Static application security testing (SAST) and Software Composition Analysis (SCA) data to help you view vulnerability alerts in the repositories in your GitHub environment.

Prepare for the integration by performing these tasks. The GitHub Application Vulnerability Integration assumes that you are familiar with the GitHub product and API.

View details for import information for the GitHub Application Vulnerability Integration.

Import application assets from Tenable WAS Vulnerability Response Integration using the Assets Export APIs and create import queue entries for transformation.

Import vulnerability findings and associated metadata using Tenable WAS Export Findings APIs.

Include Closed application vulnerable items (AVIs) during the Black Duck vulnerable item integration imports because by default, they aren’t created during the integration imports. If you want to create them, you must change the system property.

By default, Closed application vulnerable items (AVITs) are not created during Fortify Vulnerable Item integration imports. If you want to create them, you must change a system property.

Use a template file to upload the application vulnerabilities. To access and download the template, navigate to All Manual AVIT Ingestion Upload File UI .

Before you run the integration on your instance, you must complete the installation and configuration steps so that the Black Duck Software Composition Analysis (SCA) tool properly integrates with Application Vulnerability Response.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Fortify product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

Before you run the integration on your instance, the installation and configuration steps must be completed so the GitHub Application Vulnerability Integration properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs.

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Application Vulnerability Response.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration application properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

The following source states from the Invicti Vulnerability Integration and their target states in your instance are listed in the following table.

A successful integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Invicti Vulnerability Integration assumes that you are familiar with the Invicti product and API.

The Invicti Vulnerability Integration uses application data imported from the Invicti product to help you determine the impact and priority of flaws in your code.

If your initial import failed, or you do not want to wait for the scheduled initial import, you can perform a full data import independent of the daily scheduled job.

Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace.

Analyze your team's progress and data visually and drive business outcomes with the help of the components on your personal dashboard.

Penetration testing in Application Vulnerability Response enables application owners to assess the security posture of their application. It is the manual testing of an application by the ethical hacking team.

Application owners can request penetration test assessment for their applications, and monitor the progress of the ethical hacking team until the request is resolved.

The Penetration Test Workspace in Application Vulnerability Response permits you to request for penetration test assessment requests and track them using the workflow. It enables application owners to assess the security posture of their applications. It is the manual testing of an application by the ethical hacking team.

Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.

Configure the sprint duration and capacity for the ethical hacking team so they can manage the sprint capacity for penetration test assessments.

You can configure the sprint duration and estimated effort for penetration testing assessment types. This provides the scheduling functionality for application owners, helping them determine a tentative time frame for their penetration test assessment requests.

Create a penetration test assessment request by replicating a request in Closed state. Active application vulnerable items (AVITs) are copied to the new request.

Create an application vulnerability entry for the vulnerability specified for the penetration test finding. Application vulnerabilities are vulnerabilities on the custom software applications.

Create penetration test findings based on the penetration test assessment request. These findings are manually-created Application Vulnerability Items (AVIs).

Create penetration test assessment requests directly from the list of existing requests. You can also copy existing requests in the Closed state on this list to create requests.

Initiate a penetration test assessment request for your web applications or APIs. These requests are submitted to the ethical hacking team, who then proceed to test these applications and manually report the penetration test findings.

Get an overview of your penetration test requests and manual findings on your personal Penetration Test Dashboard. View your team's progress in the Penetration Test Workspace. The dashboard provides you with an overview of penetration test findings and tests that need your attention. Track test findings and view assignments as well.

Attach application vulnerable item findings to an existing penetration test request using the manual ingestion process.

For testing a mobile application, there are certain standards developed by the OAS community to help testers identify the bugs in their products. Navigate to the assessment workspace to create the questionnaire of your choice. Publish them to be able to view in the assessment request form.

Request an exception to defer a application remediation task for a specified period if it can’t be resolved immediately.

Set the start time for the Vulnerability Response Integration with Black Duck imports. You can set the integrations ahead of time so that you get better performance and faster import runs.

Import data from the Fortify scanner, to map Application Vulnerable Items (AVIs), thereby enriching the data in your instance.

Import applications, findings and associated application vulnerabilities from the Tenable Web application and manage them in ServiceNow Vulnerability Response.

You can clear the Assigned to and Assignment group fields on Application Vulnerability Response vulnerable items directly from the application vulnerable item and remediation task records that you determine might be incorrectly assigned to you or your groups.

Post creation of the assessment questionnaire, you can use these questionnaires for testing purpose.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

After you identify the data that you want to import, the data is retrieved from the Veracode application, processed through a set of data sources, and transformed in your instance.

Configure optional modifications specifically for the Veracode Vulnerability Integration.

A successful Veracode Vulnerability Integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Veracode Vulnerability Integration assumes that you are familiar with the Veracode product and API.

View details for scan summary information for the Veracode Vulnerability Integration.

The Vulnerability Response Integration with Veracode application uses data imported from the Veracode product to help you determine the impact and priority of flaws in your code.

If the integration run is successful, review the count of individual detections and the penetration test findings created or updated.

Verify whether the vulnerability integration run was successful, partially successful, or a failure.

Using the aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.

Import application vulnerability response data that includes application, Software Composition Analysis (SCA) and secrets data with the Application Vulnerability Response Integration with Wiz.