Application Vulnerability Response - Assignment Rule Question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-09-2022 11:28 AM
I am curious how others are leveraging the Assignment Rule feature in AVR to ensure the correct teams are getting the AVIT's assigned to them.
Reviewing the SNow documentation hasn't helped put a confidence level on what needs to happen/will happen when we enable this module and integration.
For me, it does not make immediate sense how an Assignment Rule is derived. We have Application Service CI's (cmdb_ci_service_discovered) and they list Support 2, Support 3 as well as Service Owner. The Support 3 or Service Owner would be the respective owner/appadmin of the application that we'd want to assign the AVITs to. The Support 2 in our case would map back to the server support team which manage the availability side and not application related. I do not see reference to what the module points to out of the box for the Assignment Group piece for Assign Using, or the Configuration Item piece for Assignment Group Field.
- Labels:
-
Vulnerability Response
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-09-2022 02:28 PM
Hey AC,
The Assign using field would indicate:
- Assignmment group - a direct assignment to a group that you specify when selecting this option
- Assignment group field - as you included in your screenshot, it is 1 of 3 base groups on the cmdb_ci table. These could be customized by adding additional choices to the dictionary entry for the field
- Script - based on your use case, this may be the right solution, so that you could use a GlideRecord query to locate the cmdb_ci_service_discovered record and use the Support 2 or Service Owner field. They seem to be custom fields in your instance.
Regards,
Brad
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-10-2022 09:58 AM
thank you brad. so by default, what is an application record from Qualys WAS mapping to in ServiceNow when it gets ingested via AVR module integration run?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-10-2022 12:39 PM
Baseline there is one rule that would assign to the Configuration Item.Support Group based on the CI that is related to the AVIT record. That being said, the intention of Assignment Rules is for them to be configured per your business needs/requirements.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-13-2022 07:59 AM
How is an AVIT being mapped to a CI record? Maybe I am missing what the mapping criteria is. When the data comes from Qualys with all the web application details (variations of URLs, Qualys webapp ID etc.), how or what is bridging the gap from this Qualys info to a CMDB CI, and what CI class or table?