Can risk ratings on VITs or VULs be manually overridden?

[LeslieC]

Hello!
Can the risk score on a vulnerability item or Remediation Task be manually changed? We do have risk rules set up but it doesn't work perfectly. Also, in some cases, our SIRT team will deem a vulnerability a higher risk than has been calculated. Is there a role or particular access level that allows this?

Thanks,

Leslie 

[Steven16]

Have you tried various options and weighed scores related to your risk calculator to get the table of criticality and ratings that are relevant to your business assets.

[LeslieC]

Hi Steven,

Thanks for the response. We have done this. This would be for rare cases - one-offs, so to speak. 

[Chris McDevitt · Accepted solution]

I think it is a bit more complicated than that.... because you could rerun the Risk Scoring; that manual score would be overwritten.

Here is what I have implemented in the past:

• Add a priority flag to the Third-Party table and use that as part of your Risk Scoring
  • Grant the ability to set this flag
• Add your own Scoring Field (Hide OOB) use a BR to populate it (and check to see if it populated already before the setting is)
  • Grant the ability to set this field

Of course, there are a few ways to solve this.... 

• Tune your Risk Scoring
• Flag the Thrid-Party table (i.e., at the Vulnerability Level - Third-party)
• Set the value or a new value at the Vulnerable Item Level.