Create and edit a classification rule
Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation.
Before you begin
Role required: sn_vul.manage_classification_rule
About this task
When created, these rules classify the vulnerabilities as belonging to either a platform or an application. You can configure these rules to replace the value of a specific field on the vulnerability entry.
Use these rules to move the calculation upstream to the Third-Party Vulnerabilities Entry table to enable the reuse of content.
Procedure
-
Navigate to All > Vulnerability Response > Administration > Classification Rules.
-
To view a classification group, click that group.
-
On the Classification Rules context menu, click New.
-
On the form, fill in the fields.
|
Field |
Description |
|---|---|
|
Name |
Name of the new classification rule. |
|
Active |
Option to activate the rule. |
|
Description |
Description of the new classification rule. |
|
Execution order |
Order in which the rule should be executed. |
|
Advanced view |
Option to view additional fields on the tabbed sections. |
|
When this condition is met | |
|
Condition type |
Type of condition for the rule. Choices are as follows:- Filter: Basic filter conditions for determining whether to use the rule or not.
|
|
Condition |
Condition for the rule. Define conditions based on the column selected on the required vulnerability entry column. You can add multiple conditions to refine the rule. This field appears only when Filter is selected from the Condition type field.Note: When defining multiple conditions or templates, you can select only from a parent and a child table. You cannot select from two or more child tables. |
|
Filter group |
Group of filters. The group is defined when a set of conditions is used repeatedly in multiple places. Click the lookup using the list icon ([Omitted image "lookup_list_icon.png"] Alt text: Lookup list icon) to select the filter group. For more information, see Create and define filter groups in Security Operations. This field appears only when Filter group is selected from the Condition type field. |
|
Script |
Script that is evaluated to determine when to apply this rule. You can write your code and set the response as either true or false. This field appears only when Script is selected from the Condition type field |
|
Set these values | |
|
Classification |
Classification of the rule. To select an option, click the bulb icon ([Omitted image "bulb_icon.png"] Alt text: Bulb icon). The list displays the options for Platform and Application. Alternatively, you can enter your own classification that is not in the list. |
|
Classification type |
Type of classification. This field shows the filtered list of classification types based on your selected value for the Classification field. |
|
Value type |
Type of the value that is assigned by using this rule. Choices are as follows:- Template: Select a template. You can use a required template.
|
|
Template |
Another condition for the rule apart from the Classification and Classification type fields. Select a combination of fields and values that you want to set when the rule is evaluated. This field appears only when Template is selected from the Value type field. |
|
Script value |
Script to set values on the current record. This field defines what values to set on the fields in vulnerability entries. This field appears only when Script is selected from the Value type field. |
Example
Use VR classification rules to add the logic to upstream tables like Vulnerability and Discovered Items and calculate it. You can reuse the output multiple times, thereby improving the performance of rules such as assignment rules. For example, classify the Third-Party Entry (TPE) as Java and reuse the output in the assignment rules multiple times. Sample assignment rule:
VI.TPE.Classfication Type | IS | Java---
title: Create and edit a classification rule
description: Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/vulnerability-response/create-classification-rule.html
release: brazil
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 3
breadcrumb: [Create and edit a classification group, Vulnerability Response remediation overview, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---
# Create and edit a classification rule
Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation.
## Before you begin
Role required: sn\_vul.manage\_classification\_rule
## About this task
When created, these rules classify the vulnerabilities as belonging to either a platform or an application. You can configure these rules to replace the value of a specific field on the vulnerability entry.
Use these rules to move the calculation upstream to the Third-Party Vulnerabilities Entry table to enable the reuse of content.
## Procedure
1. Navigate to **All** > **Vulnerability Response** > **Administration** > **Classification Rules**.
2. To view a classification group, click that group.
3. On the Classification Rules context menu, click **New**.
4. On the form, fill in the fields.
<table id="table_z5k_bwb_glb"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Name
</td><td>
Name of the new classification rule.
</td></tr><tr><td>
Active
</td><td>
Option to activate the rule.
</td></tr><tr><td>
Description
</td><td>
Description of the new classification rule.
</td></tr><tr><td>
Execution order
</td><td>
Order in which the rule should be executed.
</td></tr><tr><td>
Advanced view
</td><td>
Option to view additional fields on the tabbed sections.
</td></tr><tr><td class="sub-head" colspan="2">
When this condition is met
</td></tr><tr><td>
Condition type
</td><td>
Type of condition for the rule. Choices are as follows:- **Filter**: Basic filter conditions for determining whether to use the rule or not.
- **Filter group**: Set of multiple conditions that are used together. The rule is evaluated based on the conditions defined in the filter group.
- **Script**: Scripted condition used to determine when to apply this rule.
This field appears only when the **Advanced view** option is selected.
</td></tr><tr><td>
Condition
</td><td>
Condition for the rule. Define conditions based on the column selected on the required vulnerability entry column. You can add multiple conditions to refine the rule. This field appears only when **Filter** is selected from the **Condition type** field.**Note:** When defining multiple conditions or templates, you can select only from a parent and a child table. You cannot select from two or more child tables.
</td></tr><tr><td>
Filter group
</td><td>
Group of filters. The group is defined when a set of conditions is used repeatedly in multiple places. Click the lookup using the list icon \(\[Omitted image "lookup\_list\_icon.png"\] Alt text: Lookup list icon\) to select the filter group. For more information, see [Create and define filter groups in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/create-filter-group.md). This field appears only when **Filter group** is selected from the **Condition type** field.
</td></tr><tr><td>
Script
</td><td>
Script that is evaluated to determine when to apply this rule. You can write your code and set the response as either true or false. This field appears only when **Script** is selected from the **Condition type** field
</td></tr><tr><td class="sub-head" colspan="2">
Set these values
</td></tr><tr><td>
Classification
</td><td>
Classification of the rule. To select an option, click the bulb icon \(\[Omitted image "bulb\_icon.png"\] Alt text: Bulb icon\). The list displays the options for Platform and Application. Alternatively, you can enter your own classification that is not in the list.
</td></tr><tr><td>
Classification type
</td><td>
Type of classification. This field shows the filtered list of classification types based on your selected value for the **Classification** field.
</td></tr><tr><td>
Value type
</td><td>
Type of the value that is assigned by using this rule. Choices are as follows:- **Template**: Select a template. You can use a required template.
- **Script**: Select a pre-existing script, or write your own custom script.
This field appears only when the **Advanced view** option is selected.
</td></tr><tr><td>
Template
</td><td>
Another condition for the rule apart from the **Classification** and **Classification type** fields. Select a combination of fields and values that you want to set when the rule is evaluated. This field appears only when **Template** is selected from the **Value type** field.
</td></tr><tr><td>
Script value
</td><td>
Script to set values on the current record. This field defines what values to set on the fields in vulnerability entries. This field appears only when **Script** is selected from the **Value type** field.
</td></tr></tbody>
</table>5. To create the new rule, click **Submit**.
## Example
Use VR classification rules to add the logic to upstream tables like Vulnerability and Discovered Items and calculate it. You can reuse the output multiple times, thereby improving the performance of rules such as assignment rules. For example, classify the Third-Party Entry \(TPE\) as Java and reuse the output in the assignment rules multiple times. Sample assignment rule:
```
VI.TPE.Classfication Type
| IS | Java
```
| title | Create and edit a classification rule |
| description | Create rules to automatically classify the incoming vulnerabilities to the correct teams for remediation. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/vulnerability-response/create-classification-rule.html |
| release | brazil |
| product | Vulnerability Response |
| classification | vulnerability-response |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 3 |
| breadcrumb | Create and edit a classification groupVulnerability Response remediation overviewVulnerability ResponseUnified Security Exposure ManagementSecurity Operations |