DIfference between Third party Vulnerability and NVD

[dharmeshCDS]

Hello, I want to understand what exactly is the difference between the Third party vulnerability entries and NVD, what kind of data are stored, is Third party vulnerability is alternative to NVD? Or does it store the actual instance of Vulnerability instance found by scanner?

NOTE: I know that Third party vulnerability entry table stores the vulnerability definition found by third party scanners, I want to know what exactly does it mean?

Your help is greatly appreciated, thanks!

[Hemanth M · Accepted solution]

Hi @dharmeshCDS 

Simply put:
The NVD is the universal, vendor-neutral dictionary of vulnerabilities (CVEs).

A Third-Party Vulnerability Entry is how a specific scanning tool (like Qualys/enable/apid7) defines and detects that same vulnerability. this is maintained by NIST (National Institute of Standard and Technology)

What is an NVD Entry?:It provides the standardized, industry-wide definition of a vulnerability, known as a CVE (Common Vulnerabilities and Exposures).

What is a Third-Party Vulnerability Entry?: It is the scanner-specific rule used to detect a vulnerability.

Is it an alternative to NVD? : No, it is complementary. A single Third-Party Entry (like a Tenable Plugin) will usually link directly to one or more NVD Entries (CVEs) inside ServiceNow.

An Example (Log4j):
Imagine your Qualys scanner finds the famous Log4j vulnerability on "Server A".

1)NVD Entry: ServiceNow imports the CVE from the NVD. This just says, "Log4j has a remote code execution flaw.

2)Third-Party Entry: ServiceNow imports the Qualys QID XYZ is Qualys's specific rule to check if a server has Log4j. This QID record is linked to the CVE (NVD entry).

3)Vulnerable Item (VIT): This is the actual intersection of a vulnerability being found on a specific asset/CI ur environment ServiceNow creates a VIT record that essentially says: "Server A failed the check for QID XYZ." 

Hope it helps!

[Hemanth M]

Hi @dharmeshCDS ,

If this response helped, please close the loop by accepting the solution. If not, please ask a follow up question.