Container Vulnerability Response

A rule is activated on its "Valid from" date. After activation, it automates the exception process for container vulnerable items (CVITs).

Approve exception requests for container vulnerable items or remediation tasks that can't be remediated immediately. You must assess these requests for risk and then approve them for deferral until they can be remediated.

Assess exception rule requests from users so that you can approve or reject these requests.

As a false positive approver, you can approve false positive requests from other users.

Before you run Container Vulnerability Response in your ServiceNow AI Platform instance, you must configure it.

Limit the duration of an exception requested and add a questionnaire to the exception or false positive request using the Container Vulnerability Response module. By default, an exception is requested using the ServiceNow Container Vulnerability Response module. You can also request an exception using the GRC: Policy and Compliance Management integration.

Container vulnerable items (CVITs) are automatically created during third-part vulnerability integration imports.

With the Container Vulnerability Response application, you can use the state model to see the status of a remediation task, at any given time. Knowing how each state relates to and affects each other helps you to determine when and how to remediate your container vulnerable items (CVITs).

Create a rule to automatically request an exception for a specific condition for a group of container vulnerable items (CVITs), such as a rule with a condition that is based on the vulnerability severity of these CVITs. With this rule, you can defer new and existing CVITs automatically if they match the approved rule condition.

Vulnerability calculators automate the calculation of initial values for the fields on container vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.

If you determine that the issue associated with an application remediation task can be immediately closed without further analysis, you can use the Close feature. Starting with v2.10 of Container Vulnerability Response, the Close button has been removed for an container remediation task.

Configure the keys that generate Container Vulnerability Response findings.

You can configure the keys that generate Container Vulnerability Response findings (container vulnerable items) to help you determine how and when they are created from imported container vulnerability data.

This Platform Analytics Solution contains prepackaged Platform Analytics content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.This Platform Analytics Solution provides an exposure on how vulnerabilities are managed through the various charts.

Use auto-close rules to close older container vulnerable items (CVITs) automatically based on the filter conditions that you set.

Vulnerability administrators can edit the remediation target notification or add new ones, specifying when to send the notification, who receives the notification, and what content is in the notification.

You can create rules to automatically group container vulnerable items (CVIT) into remediation tasks (CVUL) based on filter conditions. These rules automatically group CVITs as they're imported or manually created.

Analytics and Reporting Solutions contain prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. This Platform Analytics Solution permits you to track the volume, performance, and progress of vulnerabilities from initial analysis and detection to containment, or remediation. You can filter reports by assignment group, exploits, risk rating, or state.

Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.

When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an container vulnerable item (CVIT) that cannot be remediated according to the policy.

Starting with Vulnerability Response v15.0, use the flow designer to approve exception requests for exception management, exception rules, and false positive management. If you are deploying Vulnerability Response (VR) for the first time, the flow designer is enabled by default.

Create a rule to automatically request an exception for a specific condition for a group of container vulnerable items (CVITs), such as a rule with a condition that is based on the vulnerability severity of these CVITs. With this rule, you can defer new and existing CVITs automatically if they match the approved rule condition.

Learn about terms and concepts that are unique to Container Vulnerability Response.

The ServiceNow Container Vulnerability Response application imports container vulnerable items (CVITs) and according to the rules enables you to remediate container vulnerabilities. Vulnerability data is pulled from internal and external sources, such as the National Vulnerability Database (NVD) or third-party integrations.

Request an exception for a container vulnerable item (CVIT) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.

Reference topics containing information about tables, roles, and properties installed with the Container Vulnerability Response.

You can request to defer the remediation of a container vulnerable item (CVIT) for a specified period. For example, as a developer, you can request an exception if a patch is not available for a machine. Approvers who have access can approve requests from other users.

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Container Vulnerability Response.

Run the Automated Test Framework (ATF) test suite after you install or upgrade the Container Vulnerability Response application.

If you determine that the issue associated with a container vulnerable item (CVIT) is of low risk and can be immediately deferred without further analysis, you can use the Defer feature.

Define reason choices to be available to any user who requests an exception.

Delete an exception rule that is not required anymore. For example, you can delete a rule if you don't want to defer a container vulnerable item (CVIT) during ingestion.

Domain separation is supported in Container Vulnerability Response. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

Request an extension for a deferred container vulnerable item before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred remediation task (VUL) before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Request an extension for a deferred exception rule before it reaches its deferred until due date. As a remediation owner, you’re no longer required to wait until the deferred due date to make this request.

Before you run the Vulnerability Response and Configuration Compliance for Containers application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store. Install the application on your ServiceNow AI Platform instance, and complete a few installation steps in the Setup Assistant.

Before you run the integration on your instance, complete the installation and configuration steps so that the Prisma Cloud Compute product properly integrates with Vulnerability Response and Container Vulnerability Response. This application is available as a separate subscription.

Several types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.

Extend the capabilities of Container Vulnerability Response by integrating with other applications.

Request policy exceptions using the GRC policy exception management capability in the Policy and Compliance Management application from within Container Vulnerability Response.

When discovery is enabled, information is received from the Information Technology Operations Management (ITOM) team. If the ITOM Discovery is enabled, you can see Kubernetes Namespaces, Kubernetes Clusters, and Kubernetes Services when you open a container vulnerable item (CVIT). Else, you can see Prisma payload information.

The Prisma Cloud Compute integration enables you to scan container images to detect vulnerabilities.

The Prisma Cloud Compute Configuration form is accessed from within the Prisma Cloud Compute Integration module.

Install and configure the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute application. Import data from Prisma Cloud Compute. You can use the imported data to prioritize and remediate vulnerabilities for your docker images and hosts.

You can prepare for the Vulnerability Response Integration with Palo Alto Networks Prisma Cloud Compute by performing setup tasks.

Validate that Container Vulnerability Response still works after you make any configuration change such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Request an exception to defer a container remediation task for a specified period if it can’t be resolved immediately.

Mark a container vulnerable item (CVIT) or remediation task as a false positive if the warning given by the scanner is not actually an issue. For example, if a CVIT has been decommissioned but the scanner is still raising an issue related to it, mark it as a false positive.

Monitoring remediation is a process that begins with reviewing status and ends with closing container vulnerable items (CVITs). Container Vulnerability Response offers tools and procedures to make that process more productive and efficient.

Reopen an exception rule that has been rejected, but you want to resubmit. Reopening the rule moves it to the Draft state.

Container Vulnerable items (CVITs) and remediation tasks (VULs) can be marked as false positives. Approvers with write access can approve such requests from other users.

You can clear the Assigned to and Assignment group fields on container vulnerable items directly from the container vulnerable item and remediation task records that you determine might be incorrectly assigned to you or your groups.

Cancel an approved rule to be able to update it. For example, before you can modify any dates or add a condition to an approved rule, you must cancel it so that the remediation task (VUL) is deleted, and the container vulnerable items (CVITs) move to the Open state.

Using the aggregated reports framework, you can create reports for the data that involves complex and long-running on-the-fly queries for better performance.Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.

Import container vulnerability data with the Wiz Container Vulnerabilities Integration that is included with the Vulnerability Response Integration with Wiz.

You can request an exception for container vulnerable items (CVITs) that can't be remediated or deferred immediately. By automating the VI deferral process, you can defer the matching CVITs based on the rule when the system identifies them.