Example of a vulnerability calculator rule script?

Go to solution
Christoph4
Tera Contributor

‎08-02-2024 07:15 AM - edited ‎08-02-2024 07:16 AM

Hello,

 

I would like to use a script rule to calculate risk ratings for VITs.

 

Does someone has an example of a script to get me started? I'm not sure how the function should look like and which objects are available and what to return.

Labels:
Preview file
137 KB
0 Helpfuls
  • 969 Views
1 ACCEPTED SOLUTION

Go to solution
andy_ojha
ServiceNow Employee
ServiceNow Employee

‎08-02-2024 07:58 AM - edited ‎08-02-2024 07:59 AM

Hey there,

 

Here is an example of getting started with an 'Advanced' Vulnerability Calculator Rule (Scripted).

  • You have access to the current vulnerable item record (and can dot-walk to reference fields like Vulnerability, Third-Party Entry, CMDB) -- essentially your typical inputs
  • Then you can use those inputs in whatever calculation you need (mapped ranges, weighted, case statements, if statements
  • You'd finish by setting the Risk Score on the target Vulnerable Item record (current.risk_score =xxx)
  • You can also set other values with this method on the Vulnerable Item - though would avoid that if possible and stick to using this to only set Risk Score 

 

andy_ojha_0-1722610597326.png

 

Also - if you have not already, check out the VR Process Guide on Page 34 - it walks through approaching the Vulnerability Risk Scoring with a few simplified methods (non-scripted).   This may be something to consider before venturing down the path of Advanced/scripted.

 

 

 

 

View solution in original post

1 REPLY 1

Go to solution
andy_ojha
ServiceNow Employee
ServiceNow Employee

‎08-02-2024 07:58 AM - edited ‎08-02-2024 07:59 AM

Hey there,

 

Here is an example of getting started with an 'Advanced' Vulnerability Calculator Rule (Scripted).

  • You have access to the current vulnerable item record (and can dot-walk to reference fields like Vulnerability, Third-Party Entry, CMDB) -- essentially your typical inputs
  • Then you can use those inputs in whatever calculation you need (mapped ranges, weighted, case statements, if statements
  • You'd finish by setting the Risk Score on the target Vulnerable Item record (current.risk_score =xxx)
  • You can also set other values with this method on the Vulnerable Item - though would avoid that if possible and stick to using this to only set Risk Score 

 

andy_ojha_0-1722610597326.png

 

Also - if you have not already, check out the VR Process Guide on Page 34 - it walks through approaching the Vulnerability Risk Scoring with a few simplified methods (non-scripted).   This may be something to consider before venturing down the path of Advanced/scripted.