Operational Technology Vulnerability Response

Configure the system properties that are used in the auto-close stale detections process to automatically close vulnerabilities that are no longer in your environment.

Activate the scheduled job to auto-close stale detections on a recurring basis.

Activate the auto-closure integration to close the corresponding ServiceNow Vulnerability Detections.

Activate the Delta Import integration to import vulnerabilities from Claroty CTD.

Assign roles to your users so that you can control their access to the features, capabilities, and data in the Vulnerability Response for Microsoft Defender for IoT (On-premises Management Console) application.

Assign roles to your users so that you can control their access to the features, capabilities, and data in the Operational Technology Vulnerability Response application.

Add users to assignment groups so they can see the vulnerability items for their assigned site.

If you have not already done so during configuration of the Industrial Process Manager, assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites.

Assign roles to your users so that you can control their access to the features, capabilities, and data in the Vulnerability Response Integration with the Claroty CTD application.

Configure OT Vulnerability assignment rules.

Configure remediation target rules for OT vulnerable items.

Determine which OT risk factors to use when calculating the risk of a vulnerable item on an OT device.

Configure compensating controls for Operational Technology (OT).

Several types of components are installed with activation of the Operational Technology Vulnerability Response (com.sn_otvr) plugin, including user roles and a business rule.

Configure the system ID to import integration records fully after the Microsoft SGC Connections integration.

Configure the Full Import Integration to import the entire vulnerability inventory of a device from Claroty CTD.

Configure the import schedules to access the Microsoft Defender for IoT records.

Activate the scheduled jobs that import vulnerability data.

Configure the record for the Vulnerability Response for Microsoft Defender for IoT (On-premises Management Console) integration.

For remediation tasks that are created in the Industrial Workspace, update existing remediation task rules to prevent imported vulnerable items from automatically adding OT devices.

Enable Auto-Close Stale Detections to automatically close stale vulnerable detections not recently found by your third-party integrations.

Use the OT vulnerability risk rollup calculator to calculate the risk score of the OT devices at each level of the equipment model. The overall risk score is rolled up to the parent equipment model entity.

Configure Operational Technology (OT) assignment rules, remediation targets, risk calculators, and risk rollup calculation then configure integrations to create vulnerable item records.

Configure the Vulnerability Response Integration with Claroty CTD to begin importing data.

Connect to Microsoft Defender for IoT (Azure) to begin the Vulnerability Integration setup.

Connect to the Claroty CTD to begin the Vulnerability Integration setup.

Create remediation tasks associated with OT devices that are mapped to an equipment model entity.

Create one Operational Technology Vulnerability Response assignment group per site that you have in the Equipment Model Manager. This allows OT Remediation Owner users to only see vulnerable items for their site.

This section specifies how fields from the Claroty CTD API are mapped to fields in the ServiceNow tables.

Defer a remediation task to create an exception request that you can resolve later.

Use Operational Technology Vulnerability Response as an integrated solution for the industrial production process.

Integrate certified third-party applications that enhance functionality of OT vulnerability management.

Install the Operational Technology Vulnerability Response application if you have the admin role. This application includes demo data and installs the related store applications and plugins if they are not already installed.

Install the Vulnerability Response Integration with Claroty CTD (sn_clarotyctdvr). The application includes installs related ServiceNow Store applications and plugins if they aren’t already installed.

You can install the Vulnerability Response for Microsoft Defender for IoT (Azure) if you have the admin role. The application includes installs related ServiceNow Store applications and plugins if they are not already installed.

You can install the Vulnerability Response for Microsoft Defender for IoT (On-premises Management Console) if you have the admin role. The application includes installs related ServiceNow Store applications and plugins if they are not already installed.

After installing the Vulnerability Response Integration with Microsoft Defender for IoT (Azure), navigate to the Guided Setup to walk you through the application's configuration.

Use the Microsoft Defender for IoT VR Configuration form to configure the Vulnerability Response for Microsoft Defender for IoT (On-premises Management Console) application.

Operational Technology Vulnerability Response enables effective prioritization and remediation of OT device vulnerabilities at the site level. By leveraging the CMDB relationships of OT devices, vulnerable devices or items can be prioritized based on the criticality of the production process they automate.

Reference topics provide additional information about the Operational Technology Vulnerability Response application.

Starting from the Xanadu version, Operational Technology (OT) Vulnerability Solution Management is a feature available within the Operational Technology Vulnerability Response application.

List of fields displayed in a vulnerable items created for OT devices.

The Operational Technology Vulnerability Response application includes support for third-party integrations.

Find more information about the Network Intrusion Detection System (NIDS) extension class, OT extension classes, and related applications.

Run the National Vulnerability Database (NVD) integration to import data from the National Institute of Standards and Technology (NIST) NVD product. Running the NVD integration gives you the foundational Common Vulnerabilities and Exposures (CVEs) data referenced by the Microsoft Defender for IoT (Azure) vulnerabilities to help you determine the severity and details of vulnerabilities in your environment.

Run the National Vulnerability Database (NVD) integration to import data from the National Institute of Standards and Technology (NIST) NVD product. Running the NVD integration helps you determine the severity and details of Common Vulnerabilities and Exposures (CVEs) found in your environment.

Run the National Vulnerability Database (NVD) integration to import data from the National Institute of Standards and Technology (NIST) NVD product. Running the NVD integration helps you determine the severity and details of Common Vulnerabilities and Exposures (CVEs) found in your environment.

Select an expected start time for an Operational Technology (OT) remediation task by using the time slots in the equipment model entity schedules.

Set the system properties for the Vulnerability Response Integration with Claroty CTD so that you can enable the properties as needed.

User can split the Vulnerable items (VIs) from a remediation task record to create a remediation task.

You can refer to this section for questions regarding data mapping and error handling.

You may encounter errors that need troubleshooting while you’re working with the Vulnerability Response Integration with Claroty CTD.

Compensating controls in OT environments are alternative security measures when risks posed by vulnerabilities can't be patched immediately.

After you complete all required set up tasks, including importing vulnerable items from a third-party integration, you can use the Operational Technology Vulnerability Response application from the Industrial Workspace.

Run the Claroty CTD Vulnerability Integration after running the Service Graph Connector for Claroty CTD. Running the Vulnerability Integration immediately after running the Service Graph Connector ensures that the most up to date CMDB information is populated from Claroty CTD.

View Common Vulnerability Entries (CVEs) in the Industrial Workspace to access information needed for compensating controls.

View the remediation tasks created for the Operational Technology (OT) vulnerable items (VITs) in the Industrial Workspace.

View Operational Technology (OT) vulnerable items (VITs) and their respective preferred solutions or all available solutions provided by OT Vulnerability Solution Management in the Industrial Workspace.

You can use request an Operational Technology (OT) Admin to ignore a vulnerable item (VIT) as an exception.

Roles control access to features and capabilities in the Vulnerability Response Integration with Claroty CTD.

The Vulnerability Response Integration with Claroty Continuous Threat Detection (CTD) uses vulnerability data imported from Claroty CTD to enable risk-based action within the production process.

The Vulnerability Response Integration with Microsoft Defender for IoT (Azure) uses data imported from Microsoft Defender for IoT (Azure) to enable risk-based action with the production process context.

The Vulnerability Response for Microsoft Defender for IoT (On-premises Management Console) uses data imported from Microsoft Defender for IoT (On-premises Management Console) to enable risk-based action with the production process context.