Vulnerability Response

You must activate the scanners after installing the Qualys Vulnerability Integration because the scanners are deactivated by default in the Vulnerability Response application.

A rule is activated on its "Valid from" date. After activation, it automates the exception process for vulnerable items (VIs).

Common Vulnerability and Exposure (CVE) information can be related to a single third-party vulnerability. It is usually added during a third-party integration import however, you can add multiple CVEs (vulnerabilities) manually.

Modify Business Rule to add EPSS score condition to Risk Calculator.

Add users to the approver groups so that you can request an exception.

Add proof as a vulnerable item (VI) key for the Rapid7 VIs. Including the proof for specific vulnerabilities enables the Rapid7 scanner integration to create VIs for each proof received from Rapid7.

If a vulnerable item is left ungrouped, you can add it to a remediation task.

Configure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.

When you change a classification rule, rerun all the active rules on all the vulnerability entries. You can also retrofit the existing vulnerabilities, by applying the newly created classification rules to the existing vulnerabilities.

Approve or reject the exception requests for vulnerable items or remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.

Assess exception rule requests from users so that you can approve or reject these requests.

As a false positive approver, you can approve or reject false positive requests from other users.

You can automatically close stale detections and vulnerable items (VIs) associated with retired CIs using the Auto-Close rules module.

If the Configuration Management Database (CMDB) changes the life cycle stage status of a configuration item (CI) to retired, you can choose to automatically close the associated vulnerable items (VIs) and detections.

Edit the JSON string in the autoPromoteFields [sn_sec_cmn.autoPromoteFields] system property so your configuration item (CI) lookup rules auto-promote all the Security Operations CMDB CIs to matching entries in the [cmdb_ci] table.

Starting from Vulnerability Response (VR) v17.1, you can automatically resolve any duplicate vulnerabilities on an asset.

Configure the Wiz Application Vulnerabilities, SCA, and Secrets Integrations.

Configure the integrations that are included with the AWS Integration for Security Exposure Management application to import the data that you want.

The following filters are available for the AWS Inspector Host Vulnerability and Container Vulnerability Integrations. These filters control which findings are retrieved from AWS Inspector.

Install the required applications for the integration.

AWS Inspector data mapping tables.

Reference information for the AWS Integration for Security Exposure Management, including data field mappings, severity mappings, tables, script includes, and supported AWS regions.

Complete the following setup steps in your AWS Management Console environment before you install and configure the AWS Integration for Security Exposure Management Integration in your ServiceNow AI Platform instance.

AWS Integration for Security Exposure Management connects your AWS environment to your ServiceNow AI Platform, enabling you to import security findings from AWS Inspector and AWS Security Hub.

The following filters are available for the AWS Security Hub Host Vulnerability, Container Vulnerability, and Test Results Integrations. These filters control which findings are retrieved from AWS Inspector.

AWS Security Hub data mapping tables.

Integrations, roles, dependencies, and REST messages used for the AWS Integration for Security Exposure Management.

Use the bulk edit option to request an exception for multiple vulnerable items (VITs) instead of manually selecting each item.

Use bulk edit to mark multiple vulnerable items (VITs) as false positive. If multiple VITs are selected, a remediation task is formed with these items.

Select a group of vulnerable items and submit a bulk exception.

Edit vulnerable items in bulk to save time by selecting fields and running an asynchronous bulk edit job in the background.

On the Vulnerability Integration form, the Report processor is a reference to a script include that extends the VulnerabilityReportProcessorBase script include. The functionality contained in this script is called by the VulnerabilityIntegrationController and defines the means by which the data returned by the integration script are processed.

The Vulnerability Integration form contains the integration factory script and, when the Custom Report Processor report processor strategy is selected, the Processor factory script. These fields are used to provide the logic to actually instantiate the object defined by the script include reference fields, Integration script, and Report processor, respectively.

The Report processor strategy field on the Vulnerability Integration form is used to select the method to process the data returned by the vulnerability integration script when the vulnerability integration process is executed.

On the Vulnerability Integration form, the integration script is a reference to a script include that extends the VulnerabilityIntegrationBase script include.

Sometimes, it is preferable be return an attachment from retrieveData(). The logic to create and/or retrieve an attachment is implementation-specific, but after the attachment is known, its information can be returned.

Vulnerable items represent one configuration item (CI) with a given vulnerability. Vulnerable items are imported from third-party sources, or using the SAM NVD information (link) to compare vulnerability entries to software records retrieved from the Software Asset Management module.

Multiple call (or multiple page) integration scripts are a bit more complicated. They require multiple calls to a data source to retrieve data.

If not already installed, download and run the NVD integration and run the CWE scheduled job as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product. The Vulnerability Response Integration with NVD is available on the ServiceNow Store.

The data retrieved from Qualys is processed through a set of data sources and transforms.

The Qualys Cloud Platform overview is an executive view into vulnerability activity. By providing trends, reports, and drill-downs into specific data, an administrator or analyst can quickly pinpoint areas of concern. The charts are populated with data after vulnerable items and the Qualys knowledge base data have been retrieved.

The Qualys product sensors collect the data and automatically send it to the Qualys application, which continuously analyzes and correlates the information. It easily integrates with Vulnerability Response as the Qualys Vulnerability Integration to map vulnerabilities to CIs and business services to determine impact and priority of potentially malicious threats.

Single call (single page) integration scripts are the simplest types of integrations. They require one call, often to an external source of data, to retrieve data. Only retrieveData() is required to be implemented for single page/single call integrations.

Vulnerability integrations provide the ability for customers and vendors to enrich the vulnerability data on their instance by retrieving data from external systems and vendors. This ability can simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.

The ServiceNow Vulnerability Response application imports and automatically groups vulnerable items according to rules that permit you to remediate vulnerabilities quickly. Vulnerability data is pulled from external sources, such as the National Vulnerability Database (NVD) and third-party integrations, and processed with applications developed by ServiceNow.

The Vulnerability Response overview dashboard (Vulnerability Management) provides an executive view into vulnerabilities and vulnerable items, helping the Vulnerability Admin pinpoint areas of concern quickly. The Vulnerability Response remediation dashboard (Vulnerability Remediation) allows a remediation specialist to focus on the remediation tasks and vulnerable items they own.

With Vulnerability Response Orchestration workflows and activities you can interact with and retrieve data from Windows or UNIX-based systems and environments using workflow orchestration. By enriching data, you can shorten the remediation life cycle.

After you install and configure the Microsoft Defender Integration for Security Exposure Management, configure the Microsoft Defender for Cloud integrations.

The Microsoft Defender for Cloud integrations included with the Microsoft Defender Integration for Security Exposure Management application import cloud misconfiguration findings, compliance data, and container image vulnerabilities.

Configuration Compliance imports policies, tests, authoritative sources, and test results from third-party integrations and stores them in modules for viewing.

The Tenable compliance test uniqueness key determines how the system identifies incoming compliance test records during ingestion and whether they are treated as new records or updates to existing ones.

Configure the uniqueness key for Tenable compliance tests to control how the system identifies configuration test records during ingestion and prevent records from being overwritten when multiple tests share the same control identifier.

Configure the Tenable test result granularity to ensure the system imports results at a more detailed level based on your selected configuration keys. In addition to the default keys, you can configure additional keys based on your requirements to increase granularity. Granular imports allow teams to manage their respective assets independently and prevent data from being overwritten when multiple records share common identifiers.

Use the Rapid7 vulnerability import run status dashboard to verify the success of your integration runs, locate any issues and inform your remediation decisions.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

Take steps to help prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.

A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The CISA Known Exploited Vulnerability integration assumes that you are familiar with the Cybersecurity & Infrastructure Security Agency (CISA).

The Vulnerability Response integration with the CISA Known Exploited Vulnerabilities (KEVs) catalog ingests data to help you effectively prioritize and remediate these vulnerabilities.

Enable your users to run scan coverage reports from the CISO dashboard. With these reports, your users can see what the organization's scan coverage is over a period of time.

Monitor the automated and formulated CISO indicators so that you can manage the vulnerability data in your instance.

Vulnerability Response remediation is a phased process consisting of verifying import completion, triaging new vulnerabilities, and monitoring progress to completion. Approached in this way, remediation becomes manageable, timely, and in many ways, automated.

Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they are imported using CI Lookup Rules. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.

Setup Assistant walks you through setting up Vulnerability Response and certain third-party integrations for your environment. Setup Assistant provides almost everything you need to install and set up your environment so that you can use Vulnerability Response.

The Vulnerability Response application is available from the ServiceNow Store. The application supports other ServiceNow applications and third-party integrations that you also download from the ServiceNow Store. More options also are available to extend the basic setup.

If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v23.0 of Vulnerability Response, the Close button has been removed for a remediation task and the closure of a remediation task is driven by the scanner.

You can define distinct questionnaire for a distinct collection of vulnerabilities or remediation tasks by filtering the vulnerabilities or remediation tasks respectively in the VR Questionnaire Configuration section of Settings for VR Exception Management form.

Customize the base system scheduled job to update CVE records with EPSS data.

Configure the scheduler to synchronize the state of Jira issues with application vulnerability item, container vulnerability items and tasks in the sn_vul_agile_manifest table.

Starting with Vulnerability Response v20.0, you can customize risk reduction request's questionnaire for a set of filtered vulnerable items or remediation tasks.

Assessment templates contain the questions that will be prompted during the request process (such as, when requesting an exception). The above-mentioned preconfigured templates are provided with smart assessment. You can also create your own templates as required.

Enable the auto-close manual detections to close stale manual detections automatically.

Configure Connection and Credential aliases to authenticate vendors. In advisory parsing, third-party vendors are authenticated.

Configure Connection and Credential aliases to authenticate vendors. In advisory parsing, third-party vendors are authenticated.

Configure a Common Security Advisory Framework (CSAF) vendor other than Red Hat with API support.

Configure a Common Vulnerability Reporting Framework (CVRF) vendor other than Cisco with API support.

When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a vulnerable item (VI) or remediation task (RT) that cannot be remediated according to the policy.

To analyze the performance of a specific facet in a business process that is recorded in a ServiceNow table, create an aggregation specific to the facet and create a report for this aggregation.

Configure your Qualys Vulnerability Integration to authenticate with Qualys using OAuth instead of Basic Authentication.

Configure the scheduler to run and automatically create the Jira issues for the records that have been created in the sn_vul_agile_tool_manifest table.

Configure the scheduler to update the Jira issues automatically for the records that have been added in the sn_vul_agile_tool_manifest table.

After you install the Vulnerability Solution Management application, configure the vulnerability solution providers by using the Setup Assistant.

If you are using multiple scanners on the same asset to detect vulnerabilities, multiple vulnerable items (VIs) might be created. You can identify these duplicate VIs to ensure that the duplicate vulnerabilities are not assigned to the remediation owners.

When a list action: Create Jira Issue is triggered, records that match the rule configuration criteria should be considered for “Create Jira Issue” and those records should be ingested into the sn_vul_agile_tool_manifest table with the mapping selected in the configuration rule.

Create an agile issue manually using form action. If the record is matched with any configuration rule condition, then a pop-up box will be populated with values that are selected in the configuration rule and if it does not match any criteria then the user will be allowed to select values for pre-defined fields.

Use auto-close rules to close older detections automatically based on the filter conditions that you set.

The CI Lookup Rules module contains rules that are used to find the matching record for host information received during third-party vulnerability integration imports. The host information is matched with the discovered items, unmatched configuration item classes, and the Configuration Management Database (CMDB).

Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation.

A new processor or a background job, Aggregated Reporting Framework Processor is shipped with the base system, which executes the scheduled jobs that are related to the Aggregated Reports Framework table. This enables the entire subsystem to run in the background, and it allows better utilization of system resources when they’re available.

If you require imported data to be in a specific domain, the user assigned to run the integrations must belong to that domain.

Create groups so that the underlying rules of this group can classify the table records based on the conditions. The rules can be used to select any field in the corresponding table.

Create a rule to automatically request an exception for a specific condition for a group of vulnerable items (VIs), such as a rule with a condition that is based on the vulnerability severity of these VIs. With this rule, you can defer new and existing VIs automatically if they match the approved rule condition.

Create a rule to filter or exclude detections from getting converted into vulnerable items (VITs) during ingestion.

Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.

Vulnerability scans for single or multiple vulnerable items can be run using the Create Scan Record for Vulnerabilities workflow activity included in the base system. When the input is passed to the activity, it creates a scan record.

Vulnerability Response severity mapping transforms third-party source severity fields to recognizable fields in Vulnerability Response.

Background jobs in vulnerability response products are designed to run for long periods of time to perform multiple processes on your records. The background job processors are shipped with the base system that run via the system user and create records in the global domain.

Set up remediation target rules after completing your initial assessment in the Setup Assistant. Vulnerability managers can set up a remediation target rule at the vulnerable item level to drive the remediation of high-risk vulnerabilities in a timely manner. When the remediation date for a vulnerable item is approaching, the system sends a notification to the users or groups specified in the rule.

Use the following script to create a rule that assigns vulnerable items for remediation based on the business services they impact.

Use the following script to create a catch-all assignment rule for vulnerable items that uses ML recommendations from Predictive Intelligence to automatically assign them for remediation.

After you complete your initial assessment of assignment rules using Setup Assistant, you can create rules to automatically assign vulnerable items based on filter conditions. These rules assign vulnerable items as they are imported or manually created.

A vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the vulnerable item Risk Score, can contain Risk Rules.

After you complete your initial assessment of remediation task rules using Setup Assistant, you can create rules to automatically group vulnerable items based on filter conditions. These rules automatically group vulnerable items as they are imported or manually created. Use the filter to limit the vulnerable items grouped by this rule, such as selecting all vulnerable items with exploits.

Create a vulnerability solution so that you can track vulnerability solutions that are not covered by third-party solution content.

Creating a remediation task manually is done when you want to group vulnerable items by something other than the Remediation Task Rules criteria. For example, you can create tasks for a particular manager, or for active, new exploits, such as ransomware that include different vulnerabilities. You can also use it to group ungrouped vulnerable items.

When used with Vulnerability Solution Management, the Common Security Advisory Framework (CSAF) enables automation security notifications through a machine-readable JSON format.

Activate the ENISA EUVD integration to ingest vulnerability data from the European Union Vulnerability Database (EUVD) into your ServiceNow instance.

Activate the JVN Integration to ingest vulnerability data from the Japanese Vulnerability Notes (JVN) database using scheduled or on-demand integration runs.

The Central Vulnerability Database supports integration with trusted global vulnerability data sources, including the National Vulnerability Database, European Union Vulnerability Database (EUVD), and Japanese Vulnerability Notes (JVN), to enrich and normalize vulnerability records.

Roles required to view, configure, and execute the EUVD and JVN integrations and to access related vulnerability data.

Lists the available release versions and application dependencies required to run the Integrations for Central Vulnerability Database.

The Common Vulnerability Reporting Framework (CVRF) offers a standardized framework for the creation of vulnerability report documentation. It’s an XML-based language that simplifies the sharing of crucial security-related information among diverse stakeholders across multiple organizations. By utilizing the CVRF format, information exchange and processing can be expedited.

When migrating to the InsightVM integration type from the Data Warehouse integration type, you can deduplicate existing data warehouse vulnerable items as long as they belong to the same source data as your Rapid7 InsightVM data.

If you determine that the issue associated with a vulnerable item (VIT) is of low risk and can be immediately deferred without further analysis, you can use the Defer feature.

If you determine that the issue associated with a remediation task (VUL) is a low priority and can be immediately deferred without further analysis, you can use the Request Exception feature.

Bring more focus to reporting and related lists in Vulnerability Response by defining service classifications. In addition, reducing the number of requested service classifications can improve the performance of Vulnerability Response data gathering.

Delete an exception rule that is not required anymore. For example, you can delete a rule if you don't want to defer a vulnerable item (VI) during ingestion.

Deactivate or delete a classification rule if it is no longer needed or relevant.

Use configurable detection keys to choose between Asset ID and Configuration Item, with validations, UI controls, and a schedule job to update existing detections.

Errors are logged while creating detections, or creating and updating vulnerable items, while processing the attachments. If a vulnerability integration process fails, errors are logged in the 'Vulnerability Integrations Log' tab.

If you do not use vulnerability calculators, disable the default calculator, in addition to any others you have defined. Vulnerability calculators run every time a vulnerable item record is created or updated, and can impact initial import performance.

Assets are automatically matched to configuration items (CIs) in the Configuration Management Database (CMDB) when they’re imported using the CI Lookup Rules. Records for unmatched CIs are automatically created during third-party vulnerability integration imports and included in Discovered Items. However, for cloud assets that aren’t present in CMDB Cl, the record is created in the cloud resource class.

Domain separation is supported in Vulnerability Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

For precise execution and results, the following precautions and settings are required for domain separation in Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, and Configuration Compliance.

Enable auditing for fields you specify in the Vulnerable Item [sn_vul_vulnerable_item] table. This method of auditing is useful when you want to audit fields that you cannot audit by default.

You can create, enable, or, modify the delete vulnerability item (VI) and remediation task (RT) delete rules. Use auto delete to remove older records from the VI and RT tables.

Overview of the EPSS integration with Vulnerability Response.

You can view software vulnerabilities returned from third-party entries to determine remediation. Use this information to match the vulnerable software entries to a Software Asset Management discovery model.

View the library of Common Weakness Enumeration (CWE) records from the National Vulnerability Database (NVD) to understand how they relate to the Common Vulnerability and Exposure (CVE) records. Then use this information to match the vulnerable software entries to a Software Asset Management discovery model.

When Common Vulnerability and Exposures identifier (CVE-ID) records are downloaded from the National Vulnerability Database (NVD), they are compared to the software in your company network as identified by the Software Asset discovery model. When a CVE-ID matches vulnerable software or configuration item in your network, a vulnerable item is created. You use the information in the CVE-ID record to decide whether to escalate the vulnerable item for remediation.

Starting with Vulnerability Response v15.0, if you are deploying Vulnerability Response (VR) for the first time, the flow designer for approving exception requests in exception management is enabled by default. If you are an existing VR user, the default option is workflow.

Define the conditions to filter out matching vulnerable items, remediation tasks, or exception rules for an approval level.

Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default.

Define the levels of users and user groups that are going to approve the exception requests.

Exclude the relationship between a third-party vulnerability and a solution because it is not relevant to the CI you are remediating, or it is not a concern in your environment. Manually exclude solutions using either a third-party vulnerability or solution record.

Request an extension for a deferred vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Filter decommissioned configuration items (CIs) while running the CI lookup rules. To filter decommissioned CIs when running the Security Operations CMDB CI lookup rules, set the filterOutDecommissionedCI [sn_sec_cmn.filterOutDecommissionedCI] system property to true.

Filter by site for Rapid7 InsightVM integration types as well as Rapid7 Nexpose data warehouse integration types.

To visualize and analyze the data specific to an aggregation that you created, generate a report by providing a condition for the aggregation in the condition builder.

Only users added to the False Positive Approver group can approve false positives for vulnerable items (VIs) and remediation tasks (VULs). Granting a false positive is a single-level approval process.

The Vulnerability Response Health dashboard is a tool designed to empower organizations with comprehensive insights into the implementation and usage of their Vulnerability Response applications.

You can modify the threshold values for the SecOps VR Health dashboard data based on your preferences.

To ignore some configuration item (CI) classes, for example Load Balancer [cmdb_ci_lb], when running CI Lookup Rules, set the ignoreCIClass [sn_sec_cmn.ignoreCIClass] system property.

Import additional metadata for vulnerability items (VI) to filter vulnerabilities based on the impact on a kernel or service.

Import a CSAF file to view data in the CSAF format. Importing is a one-time activity.

Import CSAF data by configuring the vendor URL in the Setup Assistant.

Import a CVRF file to view data in the CVRF format. Importing is a one-time activity.

Import CVRF data by configuring the vendor URL in the Setup Assistant.

Import CSAF data from advisories by configuring the vendor URL with import type as API.

Import CVRF data from advisories by configuring the vendor URL with import type as API.

A generic framework for solution intelligence integration is available to support ingestion of data in different file formats from solution vendors. These formats speed up information exchange and processing and facilitate the sharing of critical security-related information in a standardized reporting format.

Manually ingest vulnerabilities by uploading a template with vulnerabilities data.

Before you run the Qualys Vulnerability Integration in your instance, you must install and configure the Qualys Vulnerability Integration application. This application is available as a separate subscription.

After you complete the set up steps for the integration so that it properly integrates with Vulnerability Response, get entitlements, download, and install the application on your ServiceNow AI Platform instance.

Remove if the plugin goes away.Before you can use the Solution Management for Vulnerability Response feature of Vulnerability Response in your instance, you must complete the installation of the Vulnerability Solution Management application. This application is available as a separate subscription in the ServiceNow Store.

Before you can use the Performance Analytics for Vulnerability Response application, you must get entitlement and download the application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and complete a few installation and configuration steps. The PA application is not installed as part of the Vulnerability Response application. It is available as a separate subscription.

Before you run the Vulnerability Response application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and activate it.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Cybersecurity & Infrastructure Security Agency (CISA) Known Exploited Vulnerability advisor integrates with Vulnerability Response. This application is available as a separate subscription.

Before you run the integration on your instance, the installation and configuration steps must be completed so the NIST National Vulnerability Database (NVD) product properly integrates with Vulnerability Response. This application is available as a separate subscription.

Before you can run the Shodan Exploit Integration in your instance, download and install it from the ServiceNow Store. This application is available as a separate subscription.

Several types of components are installed with activation of the Vulnerability Response application, including tables, user roles, and scheduled jobs.

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Vulnerability Response.

Jira issues are created on the Jira platform if the records created in the Application Vulnerable Item, Container Vulnerable Item, Application Remediation Task and Container Remediation Task match the rules created in the agile tool configuration.

Before you run the integration on your instance, the installation and configuration steps must be completed so the Jira product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

A successful Jira Vulnerability integration requires planning and the execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Jira Vulnerability Response integration assumes that you are familiar with the Jira product and API.

The Atlassian Jira integration with Vulnerability Response enables you to leverage different issue-tracking and agile management tools for tracking efforts of vulnerability remediation.

The template provides columns that must be filled with vulnerability and configuration item (CI) data. After the template is populated and uploaded, the data is processed.

If your initial import failed, or you don’t want to wait for the scheduled initial import, you can perform a full data import independent of the daily or weekly scheduled job.

If your initial import failed, or you do not want to wait for the scheduled initial import, you can perform a full data import independent of the daily scheduled job.

Manually ingest vulnerabilities into the Vulnerability Response application so that you can remediate them quickly without having to wait for scanner results.

Use the Migration assistant for Unified Security Exposure Management tool to migrate to the Unified Security Exposure Management (USEM) platform for a smooth and secure transition.

The Migration assistant for Unified Security Exposure Management is a centralized utility that guides and automates the migration from Vulnerability Response applications to Unified Security Exposure Management (USEM). USEM provides a unified foundation that consolidates data models, streamlines features, and enhances performance and scalability across all Security Exposure Management applications.

An assignment group is usually allocated to a vulnerable item by using assignment rules. These rules are configured by the vulnerability administrator to allocate the correct assignment groups that are based on the data received from third-party scanners.

Vulnerability Assignment Recommendations uses ServiceNow Predictive Intelligence and machine learning to recommend assignment groups for vulnerable items (VIs) and remediation tasks (VULs, or RTs). You can reduce the time that you spend on identifying the owners for unassigned or incorrectly assigned vulnerability findings. Also, you can see a system-generated confidence score that evaluates if the recommended assignment group is suited to resolve the vulnerability.

Request Vulnerability Assignment Recommendations so that you can view assignment group recommendations. You can request recommendations if a matching assignment group is not available or is incorrect for a vulnerable item (VI).

Enable Vulnerability Assignment Recommendations to reduce the time that you spend on identifying the owners for vulnerability findings that are unassigned or incorrectly assigned.

Install Vulnerability Assignment Recommendations so that you can reduce the time that you spend on identifying owners for vulnerability findings that are unassigned or incorrectly assigned. This application is available as a separate subscription in the ServiceNow Store.

Use Vulnerability Assignment Recommendations to view assignment group recommendations for a remediation task (VUL).

Use Vulnerability Assignment Recommendations to view the assignment group recommendations for multiple vulnerable items (VIs) using a bulk edit. When multiple VIs are selected, a prediction is performed on a random sample of the selected VIs.

Create and train a solution definition model for Vulnerability Response by using Predictive Intelligence. You can use this model to predict the assignment group for a vulnerable item (VI) or remediation task (RT) based on existing data.

Set additional filters to limit the number of records that are displayed on a screen. Filtering records in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.

View, assign, or edit the fields on remediation task (RT) records assigned to your group. Navigate through vulnerabilities, vulnerability items, and solutions records and related lists to view solutions, deployment metrics, and items to address.

Open the Vulnerability Response Mobile app and add a ServiceNow AI Platform instance with Vulnerability Response to your mobile device.

Search for remediation tasks that match specific search criteria that you select.

The following checklist includes the set up tasks that you are required to complete in your ServiceNow AI Platform instance and on your mobile device prior to using the Vulnerability Response Mobile app.

View, assign, or edit the fields on remediation tasks records that are assigned to you. Navigate through records and related lists to view solutions, deployment metrics, and items to address.

As a remediation owner, you can access the Vulnerability Response (VR) application on your ServiceNow AI Platform instance with your Android or iOS mobile device.When decided, copy all mobile to Madrid for June. Make a list of where it gets referenced in existing docs for weaving it in by mention. ("Action available in the mobile app.")

Monitoring vulnerability remediation involves viewing trends, managing risk, and monitoring assignment groups. You can review high risk issues, assignment group workloads, deferrals and, reoccurring vulnerabilities. Vulnerability Response offers tools, reports, and procedures to make that process more productive and efficient.

The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.

Review and implement proposed remediation solutions provided by the Microsoft Security Response Center Solution Integration.

The Vulnerability Response integration with the Microsoft System Center Configuration Manager (SCCM) supports patch management and deployment for critical vulnerabilities across your assets.

Set up your account in the Microsoft Azure portal to access the Microsoft Threat and Vulnerability Management (MS TVM) API remotely. You need this account to access the MS TVM tenant to gather information for machines, vulnerabilities, and security recommendations.

Determine the type and scope of data that you want to import with the integrations with data retrieval settings.

Data is retrieved from the ServiceNow Microsoft Threat and Vulnerability Management (MS TVM) application, processed through a set of data sources, and transformed in your instance.

Install, activate, and configure the Microsoft TVM integrations for the Microsoft Defender Integration for Security Exposure Management with the Setup Assistant.

The Integration Run Status module displays the status of Microsoft Threat and Vulnerability Management integration runs in a graphical format. Use this chart to monitor integration performance and identify issues.

The Microsoft Threat and Vulnerability Management integrations are included with the Microsoft Defender Integration for Security Exposure Management application available with a subscription from the ServiceNow Store.

Migrate your existing data from the standalone Microsoft Defender for Cloud Integration application to the unified Microsoft Defender Integration for Security Exposure Management application.

Prepare for the integration installation and configuration by performing setup tasks.

REST messages for the Microsoft Threat and Vulnerability Management (MS TVM) Vulnerability Integration enable API calls to MS TVM for retrieving vulnerability data, security recommendations, and asset information.

Split detections from Microsoft Threat and Vulnerability Management scanners to create a unique vulnerable item (VIT) for each detected vulnerability instance. This split enables the assignment of VITs to various remediation teams, enhancing the management and tracking of vulnerabilities.

Confirm your Microsoft Threat and Vulnerability Management (MS TVM) integration runs successfully and locate any issues.

Configure the Vulnerability Response integration with Microsoft Threat and Vulnerability Management (MS TVM) application, after you install it using the Setup Assistant.

Use the Vulnerability Integration Runs related list to verify the success of your integration runs, locate any issues, and inform your remediation decisions.

Configure optional modifications specifically for the NVD integrations.

A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The NVD integrations assume that you are familiar with the NIST National Vulnerability Database (NVD).

Unified Security Exposure Management (USEM) enriches CVE entries with SSVC (Stakeholder-Specific Vulnerability Categorization) decision values from the National Vulnerability Database (NVD). These values provide additional risk signals that you can use to analyze and prioritize vulnerabilities. This enrichment is available only in USEM.

The NVD integrations use data from the NIST National Vulnerability Database to help you determine the impact and priority of flaws in your code. Run this integration as part of your initial setup of Vulnerability Response and before importing vulnerability data into your instance with a third-party scanner product.

Configure optional modifications and streamline some of the data specifically for the Qualys integration.

You can manage patches and patch deployments for critical vulnerabilities for large groups of your assets with Patch orchestration with Vulnerability Response. Vulnerability Response Patch Orchestration and the patch orchestration integrations are available on the ServiceNow Store.

Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Security Advisory Framework (CSAF) data format.

Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Vulnerability Reporting Framework (CVRF) data format.

Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Vulnerability Reporting Framework (CVRF) or Common Security Advisory Framework (CSAF) data format.

Add the prefix, SITE, to your Rapid7 InsightVM site tags to highlight them among your list of tags.

Customize the filtering parameters for your scheduled queries with the Qualys Vulnerability Integration to help you further refine the vulnerability data you import with the supported Qualys integrations.

The Qualys Appliance Transform map is used to transform Qualys Appliance data into appliance records. This is used to update the appliance records that would initially be created from the Asset Group Import. Changes to this transform alter how appliance records are updated with appliance details.

The Qualys Asset Group Appliance Transform map is used to transform Qualys Asset Group data to create scanner appliance records. Changes to this transform alter how scanner appliances are created and modified.

After you have installed the Qualys application, configure it using the Setup Assistant.

The Qualys dynamic search list transform map is used to transform and import Qualys Dynamic Search Lists. Changes to this transform alter how Dynamic Search Lists are processed and inserted into the system.

The following roles, integration jobs, and tables are installed with the Qualys Vulnerability Integration.

The Qualys Integration Run Status module is a graphical view of the status of Qualys integration runs.

The Qualys Host Detection Integration is enhanced to include more fields from Qualys. These fields help in filtering the non-exploitable Linux vulnerabilities. This enhancement improves the integration at the detection level and at the vulnerable item (VI) level.

When the kernel metadata, service metadata, and configuration metadata are imported, some values are also retrieved. The values 0, 1 and Not available are processed in the back-end and converted to No, Yes and Empty respectively.

A successful integration requires planning and careful execution of pre-integration tasks. It is essential that you prepare for the integration by performing these procedures. The Qualys Vulnerability Integration assumes that you are familiar with and run Qualys Cloud Platform scans in your environment.

Qualys REST messages are used to make calls to the Qualys API.

The Qualys static search list transform map is used to transform and import Qualys Static Search Lists. Changes to this transform alter how Static Search Lists are processed and inserted into the system.

Some commonly encountered issues, along with workarounds are discussed.

Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.

When the questionnaire for False Positive or Request Exception is raised but not filled copmpletely.

Validate that Vulnerability Response still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Customize the filtering parameters for your scheduled queries with the Rapid7 Integration for Security Operations to help you further refine the vulnerability data you import with the Rapid7 InsightVM product.

Configure the Rapid7 Vulnerability Integration after the application is installed and activated on your ServiceNow AI Platform.

Rapid7 Nexpose sensors collect the data and automatically send it to the Rapid7 Nexpose or Rapid7 InsightVM products, which continuously analyze and correlates the information.

A successful integration requires planning and careful execution of pre-integration tasks. Prepare for the integration by performing these tasks. The Rapid7 Vulnerability Integration assumes that you are familiar with and run Rapid7 data warehouse or Rapid7 InsightVM product scans in your environment.

The Rapid7 data warehouse Integration is one of the integration types that is included with the Rapid7 Vulnerability Integration Rapid7 Vulnerability Integration.

The Rapid7 InsightVM Integration is one of the integration types that is included with the Rapid7 Vulnerability Integration Rapid7 Vulnerability Integration.

The ServiceNow Rapid7 Vulnerability Integration uses data imported from the Rapid7 data warehouse or the Rapid7 InsightVM products to help you determine the impact and priority of potentially malicious threats.

Request an exception to defer a remediation task for a specified period if it can’t be resolved immediately.

Request an exception for a vulnerable item (VI) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.

Mark a vulnerable item (VI) or remediation task (VUL) as a false positive if the warning given by the scanner is not actually an issue. For example, if a configuration item has been decommissioned but the scanner is still raising an issue related to it, mark it as a false positive.

Solutions are known remediations that are imported into your Rapid7 Vulnerability Integration from either the Rapid7 data warehouse or Rapid7 InsightVM. Rapid7 data warehouse imports both solutions and superseding solutions. With Rapid7 InsightVM, you get solutions as part of the Rapid7 Vulnerable Item Integration - API.

When new data is received on a discovered item, the discovered item is not immediately re-evaluated. On receiving new data, the reevaluate_ci option is set to true by default.

Reapply the configuration item (CI) lookup rules on selected discovered items from the discovered item list view select actions. If the CI changes after you reapply the rules, the discovered items are updated with the new CI and impacted detections. Vulnerable items are also updated.

Reapply the configuration item (CI) lookup rules on selected discovered items like os and netbios.

Whenever configuration items (CIs) are updated through a deduplication task, the discovered items (DIs) that are related to those CIs are also updated. The vulnerable items (VIs) and detections are also updated with the CI.

When a configuration item (CI) on a discovered item (DI) changes, the impacted detections and vulnerable items (VIs) are updated. The risk score, assignment rules, group rules, and remediation target rule are reevaluated.

Create a scheduled job to reconcile unmatched discovered items.

Reclassify unclassed hardware by updating the CI lookup rules.

You can review and implement proposed remediation solutions provided by the Red Hat Solution Integration in the Vulnerability Response application.