Application Vulnerability Response - Assignment Rule Question

AC12
Tera Contributor

I am curious how others are leveraging the Assignment Rule feature in AVR to ensure the correct teams are getting the AVIT's assigned to them.  

Reviewing the SNow documentation hasn't helped put a confidence level on what needs to happen/will happen when we enable this module and integration.

For me, it does not make immediate sense how an Assignment Rule is derived.  We have Application Service CI's (cmdb_ci_service_discovered) and they list Support 2, Support 3 as well as Service Owner.  The Support 3 or Service Owner would be the respective owner/appadmin of the application that we'd want to assign the AVITs to.  The Support 2 in our case would map back to the server support team which manage the availability side and not application related.  I do not see reference to what the module points to out of the box for the Assignment Group piece for Assign Using, or the Configuration Item piece for Assignment Group Field.

 

find_real_file.png

find_real_file.png

5 REPLIES 5

Brad W1
ServiceNow Employee
ServiceNow Employee

Hey AC,

 

The Assign using field would indicate:

  1. Assignmment group - a direct assignment to a group that you specify when selecting this option
  2. Assignment group field - as you included in your screenshot, it is 1 of 3 base groups on the cmdb_ci table. These could be customized by adding additional choices to the dictionary entry for the field
    find_real_file.png
  3. Script - based on your use case, this may be the right solution, so that you could use a GlideRecord query to locate the cmdb_ci_service_discovered record and use the Support 2 or Service Owner field. They seem to be custom fields in your instance.

Regards,

Brad

AC12
Tera Contributor

thank you brad.  so by default, what is an application record from Qualys WAS mapping to in ServiceNow when it gets ingested via AVR module integration run?

Brad W1
ServiceNow Employee
ServiceNow Employee

Baseline there is one rule that would assign to the Configuration Item.Support Group based on the CI that is related to the AVIT record. That being said, the intention of Assignment Rules is for them to be configured per your business needs/requirements.

AC12
Tera Contributor

How is an AVIT being mapped to a CI record?  Maybe I am missing what the mapping criteria is.  When the data comes from Qualys with all the web application details (variations of URLs, Qualys webapp ID etc.), how or what is bridging the gap from this Qualys info to a CMDB CI, and what CI class or table?