NIST state for Security Incident Response
While implementing Security Incident Response using NIST Stateful in Process Definition. Can we move back (for example) can move to Contain from Review State. Kindly provide any information.
Forum Posts
Resolved! Metrics for Vulnerability Response
I'd like to be able to deep dive into how long a vulnerable item has been in an open state before being closed. Vulnerable items from Tenable tend to reopen (along with another manually created integration we have), so I can't always go off the first...
Error while executing Reapply Risk Calculators (VIT) job : TypeError: Method "toString"
I am receiving the following error when trying to reapply vulnerability risk calculators.Error while executing Reapply Risk Calculators (VIT) job : TypeError: Method "toString" called on incompatible object (org.mozilla.javascript.NativeObject is not...
VR and Prisma Registry - Using the Auto-Close Rule Effectively
Hello, For those of you who have VR integration with Prisma Cloud, you may have noticed that the built-in Auto-Close Rules is using the last_found field, which comes from the scanTime field in Prisma's API response. We have an issue with CVITs coming...
Please upvote idea portal submission regarding multiple Exception Questionnaire options
Hi Everyone, I submitted an Idea Portal idea that asks for an enhancement to the Exception Request Questionnaire form.https://support.servicenow.com/ideas?id=view_idea&sysparm_idea_id=576f837e93b9f610f2167de86cba10d4&sysparm_idea_table=x_snc_com_idea...
Resolved! Is container VR a prereq to updating to the new ServiceNow developed WIZ integration?
We already have the WIZ developed integration installed and running, and want to update to the ServiceNow developed integration but I am confused whether container vulnerability response is a prerequisite. We are not currently licensed for Container ...
Knowledge base for SIR workspace
Hallo forum, I have currently implement Knowledge base link into the SIR workspace so that an Analysts can create new articles directly from workspace list as well. How do i get the modal working in SIR workspace for knowledge base category picker?Do...
security incident response
HI all,I have one issue related to SIR where the duplicate record are getting generated in SIR it is reported by the user that the 1st incident which is original and he is using the SIR analyst workspace and seen that the the same duplicated incide...
Remediation target is being set to 'Target Missed' for vulnerable items even the state is deferred
Remediation target is being set to 'Target Missed' for vulnerable items even the state is deferred and remediation target is not passed the current date.Can anyone assist?
Scheduled Reports with sn_vul_vulnerability table returning empty - ACL Issue?
EnvironmentServiceNow Instance with Vulnerability Response moduleUser has roles: sn_vul.admin, report_admin, report_user, and other VR-related rolesIssue DescriptionI'm experiencing an issue where scheduled reports that include data from the sn_vul_v...
Lookup Rule Suggestions
Hello, I’m reaching out to gather insights from the community on best practices for defining lookup rules in the Discovered Items table. What rules have you found most effective, or what strategies do you recommend to ensure accurate matching between...
Best practices for handling unmatched fallback CIs (unclassed hardware & incomplete IP ...)
I’m working with a client that uses Rapid7 and Microsoft TVM with ServiceNow VR. A large percentage of discovered items remain unmatched, so VR creates many fallback CIs (Unclassed Hardware / Incomplete IP Identified Device).We need clarity on what h...
Qualys Integration Runs have inconsistent data
Hello.I have a question to VR Qualys experts. We have encountered an issue where the Qualys Integration "Qualys Host Detection Integration" Reports Different data for Both "New items or Updated Items" These are successful and complete scan runs. But ...
Qualys Host detection Detection integration.
Hello All, I have discrepancies in data ingested to ServiceNow from Qualys. A complete/successful run scan is generating different data for both New items and updated Items. How can i troubleshoot this to know exactly what is wrong. Could this have ...
