Overview

ServiceNow Vulnerability Response (SNVR) integrates with our vulnerability scanner (Tenable), matches the vulnerability against asset records in our Configuration Management Database (CMDB), and assigns a VUL and VIT ticket to the appropriate team or personnel. The integration is bi-directional in that tickets will auto-close if Tenable no longer detects the vulnerability. It will also re-open if the ticket is in a closed state and the vulnerability is detected again.

Definitions and acronyms:

Configuration Management Database (CMDB) – This is our asset management database. CMDB automatically pulls in data from other data sources such as BigFix, ForeScout, and Infoblox to maintain certain data elements.

Configuration Item (CI) – Each CI represents a single asset record. This can be a computer, server, network gear, application instance, website, etc.

Vulnerability Item (VIT) – Each VIT represents a single vulnerability found on a single device. If a single device has multiple vulnerabilities, multiple VITs will be created for the device. VITs will generally be assigned to the Support Group on the CI. If there is no Support Group, it will be assigned to the Managed_By person.

Vulnerability Group (VUL) – VITs are logically grouped into VUL tickets to lessen the administrative workload. For example, if there is a Microsoft vulnerability which exists on 1000 systems, there will be a single VUL ticket created if all 1000 systems are supported by the same group.

Risk Rating – Indicates the level of risk the vulnerability adds to the system. This value is set by Tenable.

Deferral – A condition where a vulnerability exists but it is being put off for future remediation. This can happen if the patch conflicts with an application the device is running.

False Positive – A condition wherein the scanner reports that a vulnerability exists, but there is no vulnerability. This can happen if it is found that the device is not actually running the software that the vulnerability is connected to, or it is disabled.

How does SNVR match vulnerabilities to the CI?

SNVR uses a variety of data matching rules. At a high-level, it goes through the following sequence and stops when a match is found.

Mac address and hostname
Netbios/FQDN/hostname
Mac address and IP
Mac address
IP address

If not matched, it will create a placeholder record called "unmatched class" and assign to the CMDB team for follow-up.

How are vulnerability tickets assigned?

Generally speaking, SNVR uses the Support Group information on the CI record to determine ticket assignment. However for servers, tickets will be assigned to the Primary Application Support Group if it is determined to be app related. Otherwise, if it is not application related, it will be assigned to the server Support Group. If there is not a Support Group or if the value is "Unassigned Group" or "BYOD", the vulnerability will be assigned directly to the Managed_By person on the server record.

What do I need to do?

Maintain your normal system patching cadence and monitor using the Vulnerability Remediation dashboard. When vulnerabilities are remediated, the VITs will automatically close after the next scan. The VUL will also close once all the VITs within the VUL are closed. You may also view the Vulnerability Management dashboard for UCSF-wide visibility. Prioritize VITs that have a High or Critical Risk Score as they pose a greater risk to the organization.
Request a Deferral if remediation needs to be scheduled for a future date due to a system compatibility issue or other reasons that require more time.
Mark as False Positive if the vulnerability does not actually exist on the system or is not applicable. False Positive requests will route to IT Security for review.

How-To's

How to access my Vulnerability tickets

How to request a Deferral

How to mark as False Positive

How to create an Incident

How to create a Change Request

How to split a Vulnerability Group (VUL ticket)

Need Help?

If you have questions or need assistance, submit via Teams channel: Vulnerability Response Project

If you need assistance with asset management, email cmdb-questions@ucsf.edu

Training Related Documentation

ServiceNow Release Notes

Content Restricted