Configuration Compliance

Approve requests for the removal of remediation tasks from an assignment group or an individual user in the Configuration Compliance application.

Define the criteria by which test results are automatically assigned to an assignment group for remediation.

If attachments are not appearing as expected for data sources or on a security incident after third-party integration imports, check your IP restrictions.

You can automatically close test results (TRs) associated with retired configuration items (CIs).

If the Configuration Management Database (CMDB) changes the life cycle stage status of a configuration item (CI) to retired, you can choose to automatically close the associated test results (TRs).

You can activate the Auto-Close Stale Test Results feature to automatically close older test results not recently found by your third-party integrations. Moving these test results to Closed-Stale reduces the number of active test results and remediation tasks in your instance and helps you reconcile assets in your Configuration Management Database (CMDB).

Activate Auto-Close Stale Test Results (TRs) to automatically close older test results based on filter conditions that you set.

Verifies that the XML attachment property is sufficient for large files.

As an IT remediation owner, you can create and manage change requests (CHG) directly from remediation tasks (RTs) in the Configuration Compliance application.

Starting with Configuration Compliance 11.1, you can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB.

When data is imported from a third-party integration, Configuration Compliance automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules are used to identify configuration items (CIs) and add them to the test result record to aid in remediation.

Assets are automatically matched to configuration items (CIs) using CI lookup rules, when they are imported using the host and test results integrations. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.

Starting with v12.6.3 of Qualys Integration for Security Operations, you can use the Qualys PCRS Policy Host Integration and Qualys PCRS Test Results Integration for importing test results with new sets of Qualys APIs. These integrations need a gateway URL to fetch information from Qualys.

Before you run the application in your ServiceNow AI Platform instance, you must first download and install the Configuration Compliance application from the ServiceNow Store. This application is available as a separate subscription.

This Platform Analytics Solution contains prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.This Platform Analytics Solution provides visibility into non-compliant host level and cloud control plane configurations.

There is a synchronized relationship between the State fields of remediation tasks and the State fields of change requests (CHGs) in the Configuration Compliance application.

Associate a remediation task in Configuration Compliance application to an existing change request.

You can create a change request from a remediation task in the Configuration Compliance application.

Vulnerability administrators can edit the notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.

You can request to defer the remediation of a remediation task for a specified period. Users who are a part of the approver group can approve exception requests.

Use system properties to limit the duration for which an exception is requested for a remediation task. Remediation of the remediation task is deferred for the specified period.

When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions for a remediation task that cannot be remediated according to the policy.

Starting with Configuration Compliance (CC) v13.0, if you are deploying CC for the first time, the flow designer for approving exception requests in exception management is enabled by default. If you are an existing CC user, the default option is workflow.

Add users to the approver groups so that you can request an exception for a remediation task in Configuration Compliance.

Approve exception requests for remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.

Request an exception to defer the remediation of a remediation task for a specified period if it can’t be remediated immediately.

Define the conditions to filter out matching remediation tasks for an approval level.

Use the flow designer to approve exception requests for exception management, and exception rules. If you are deploying Configuration Compliance for the first time, the flow designer is enabled by default.

Define the levels of users and user groups that are going to approve the exception requests.

Automatically create remediation tasks (RTs) to analyze results in bulk using remediation task rules. The criteria by which tasks are formed is configured so that you do not have to manually assign test results into remediation tasks.

By default, there are no restrictions on how data is retrieved from Qualys. Many records can be related to low severity vulnerabilities that a customer is not willing to remediate using their vulnerability response process. Updating the corresponding REST message/method parameters can modify this behavior.

The following reports are provided for monitoring.

The data from Prisma Cloud is imported in the Configuration Compliance module of the ServiceNow instance.

Customize the filtering parameters for your scheduled queries with the Qualys Vulnerability Integration to help you further refine the vulnerability data you import with the supported Qualys integrations.

The following roles, scheduled jobs, and tables are installed with the Qualys Integration for Security Operations.

The Qualys Integration Run Status module is a graphical view of the status of Qualys integration runs.

Resolve Qualys Knowledge Base Integration failure by reducing the payload attachment size received from Qualys to the specified limit.

Configure the Qualys test result granularity to ensure the system imports results at a more detailed level based on your selected configuration keys. In addition to the default keys, you can configure additional keys based on your requirements to increase granularity. Granular imports allow teams to manage their respective assets independently and prevent data from being overwritten when multiple records share common identifiers.

Some commonly encountered issues, along with workarounds are discussed.

Several types of components are installed with activation of the Configuration Compliance application, including tables, scheduled jobs, and user roles.

With remediation target rules, you can set the expected time frames for remediating test results. You can send notifications to users and groups when target dates are approaching and when they are past due.

From an existing remediation task in the Configuration Compliance application, identify a subset of test results that you want to move to a new Remediation Task.

The states of configuration test records and their associated remediation tasks (RTs) are impacted if test result records are deferred, resolved, reopened, and transferred to other remediation efforts (REs).

Transform maps are provided with base configurations and are sufficient usually. You can modify transform mappings depending on the needs of your organization.

The Tenable.io product of the Tenable Vulnerability Integration imports policies, controls (test results), and configuration tests for processing in the Configuration Compliance application.

Reassign the test result records in the Configuration Compliance application if the records have been incorrectly assigned to you or your group.

You can clear the Assigned to and Assignment group fields on remediation tasks and their associated test results directly from the test result records and remediation tasks that you determine might be incorrectly assigned to you or your groups.

Decommissioned configuration items (CIs) are moved to retired, archived, or deleted state in the Configuration Management Database (CMDB). Configuration Compliance contains test results (TRs) that are made up of CIs. When the state of a CI is updated to retired, the associated TRs are closed with the substate 'CI decommissioned'.

If you determine that the issue associated with a remediation task can be immediately closed without further analysis, you can use the Close feature.

You can use the configuration item (CI) lookup rules for the Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud integrations to find a correct match to commonly used resource types in the Configuration Management Database (CMDB).

Configuration Compliance automate calculating initial values for the fields on test results. The condition for each calculator is evaluated in order, and the first matching calculator is used.

Starting with v13.0 of Configuration Compliance, you can customize the criteria for the default risk rule. Use risk scores provided by third-party vendors like Qualys and Tenable for risk score calculations.

You can manage your most important configuration issues and remediate them quickly by viewing the reports on the Configuration Compliance Performance Analytics (PA) dashboard.

Activate the content pack ServiceNow Store application for the Platform Analytics Solution.

Limit the duration of an exception requested and add a questionnaire to the exception using the Configuration Compliance module. By default, an exception is requested using the ServiceNow Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.

Configure the Vulnerability Response Integration with Palo Alto Prisma Cloud application. Use the imported data from Prisma Cloud to prioritize and remediate misconfigurations on your assets.

Create rules to automatically assign test results based on filter conditions. These rules assign test results as they are imported.

You can create rules to automatically group test results based on filter conditions. These rules automatically group test results as they are imported. Use the filter to limit the test results grouped by this rule, such as selecting all test results with exploits.

Configuration Compliance calculator groups are used to group calculators based on how you want to use them.

Configuration Compliance criticality mapping provides a transform map for third-party source criticality fields to recognizable fields in Configuration Compliance severity.

You can manually create a remediation task from the Test Result list and perform remediation from the resulting remediation task.

You can manually create a remediation task from the Remediation Tasks module and perform remediation.

Customize the parameters and weights for the risk rule so that you can generate risk scores that use the test and asset data that are unique to your organization. By selecting the fields that are included in the risk rule, you can define an effective risk scoring framework.

You can define the reason choices to be available to any user who requests an exception.

Domain separation is supported in Configuration Compliance. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Import cloud configuration data with the Wiz Test Results and Issues Integrations with Configuration Compliance that are included with the Vulnerability Response Integration with Wiz.

Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Before you run Configuration Compliance in your ServiceNow AI Platform instance, you must first download and install the Configuration Compliance application from the ServiceNow Store. This application is available as a separate subscription.

Install the Vulnerability Response Integration with Palo Alto Prisma Cloud application to use the imported data from Prisma Cloud. Use this data to prioritize and remediate misconfigurations on your assets.

Several types of components are installed with activation of the Configuration Compliance plugin, including tables and user roles.

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Configuration Compliance.

If data is missing for the start date in the Qualys PC Results import, it can be modified.

Prepare for installing the Vulnerability Response Integration with Palo Alto Prisma Cloud by performing setup tasks.

Prisma Cloud is an API-based cloud infrastructure security solution. It connects to your cloud environment and monitors the resources deployed on the public cloud environments, such as Amazon Web Services (AWS), Microsoft Azure, and so on. You get complete visibility and control over risks within your public cloud infrastructure.

Prisma REST messages are used to make calls to the Prisma Application Programming Interface (API) to fetch the compliance data.

The Qualys Policy Compliance collects the data and automatically sends it to the Qualys application, which continuously analyzes and correlates the information. It easily integrates as the Qualys Integration for Security Operations to map configuration findings to CIs and business services to determine the impact and priority of potential misconfigurations.

Qualys REST messages are used to make calls to the Qualys API to fetch the compliance data.

Create unique configuration items (CIs) for assets in your environment that share IP addresses. Identify the distinct assets across your environment and automatically update the CIs on your existing discovered item, vulnerable item, and detection records to give you more details about your vulnerabilities.

Reapply configuration item (CI) lookup rules on selected discovered items from the discovered item list view select actions. The administrator might have to edit or update a lookup rule for multiple reasons. If the lookup rule changes, they can reapply them on the discovered items.

The Duplicate CI Remediator for deduplication tasks is updated with the sn_sec_cmn_src_ci.cmdb_ci property.

The default value of the property sn_sec_cmn.update_on_ci_change is true. So, when the configuration item (CI) for a discovered item is updated, the test results are updated as well.

Create a schedule job to reconcile unmatched discovered items. When a test result is created, the configuration item (CI) added to it at the time of creation might be an outdated one.

Edit an existing risk rollup calculator.

Calculator rules can be applied to all affected test results and collections on-demand. Vulnerability managers may use this feature adjust their risk calculator configuration and apply changes on-demand to import findings.

Use the Vulnerability Response Integration with Palo Alto Prisma Cloud import run status to verify the success of your integration runs and to identify any issues.

You can view, or, alternatively, create a remediation task and perform remediation.

Use this module to view summary information about each authoritative sources and citation (also known, in Qualys, as a framework). You can research the source publications that were used to create the record.

Use this module to view summary information about each authoritative source and to research the source publications that were used to create the record.

Once you have imported the results of a third-party scan into your instance, you can see your test compliance at the test group level. Use this view before an audit of that test group and any associated test records.

View Configuration Compliance test results for auditing and remediation. The test results are automatically created during third-party vulnerability integration imports.

Use this module to research detailed information about these tests. Included are the expert source citations that were used when creating them, the third-party configuration policies in which they are used, and the results obtained from the scan.

Using aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.

The ServiceNow Configuration Compliance application is a Secure Configuration Assessment (SCA) application that aggregates scan results from integrations with third-party configuration scanning applications. You can prioritize configuration compliance issues using your Configuration Management Database (CMDB). Configuration Compliance tightly integrates with the IT change management process to remediate your non-compliant configurations.

Configuration Compliance calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.

Configuration Compliance provides prioritization and test result grouping (into remediation task) to aid remediation of non-compliance issues.

Configuration Compliance criticality mapping transforms criticality fields from the source to fields in Configuration Compliance.

Configuration Compliance data is imported from third-party SCA scanner applications. They structure groups of software and hardware tests into data records to expedite conducting assessments.

Third-party integrations import configuration assessment findings, policies, tests, technologies, authoritative sources, test results along with other vulnerability data into the Configuration Compliance application.

The Configuration Compliance homepage provides an executive view into policies, CIs, tests, and test results, helping security staff pinpoint areas of concern quickly. Configuration Compliance significance charts can be added, as needed. You can also return Configuration Compliance -related information using the global search feature.

The Configuration Compliance application imports policies, tests, authoritative sources, and test results from third-party integrations and stores them in modules for viewing.

Configuration Compliance remediation is primarily a manual process augmented by scheduled jobs (integrations), remediation tasks, workflows, and change requests.

With Configuration Compliance, you can see a state model to learn what the status of the remediation task is at any given time. The remediation task states control the test result states by precedence.

Resolve issues with third-party integration import.

Use test results obtained from third-party Secure Configuration Assessment (SCA) integrations to verify compliance with security or corporate policies. Identify, prioritize, and remediate non-compliant configuration items.

Configuration Compliance calculators are used to update record values when pre-defined conditions are met. The calculators are grouped based on the criteria used to determine how the records are updated.