How the de-duplication works in vulnerability response?

[VenkateshS08928]

Hi Everyone,

We have five vulnerability scanners integrated with our instance, and we are seeing duplicate detections coming in from multiple sources. Also, for some I could see there is few similar vulnerable item created for same issues.

Does ServiceNow provide any automated way to de-duplicate incoming detections or findings?

Or is this something we need to manage manually?

Also, what is the best practice for handling duplicates in Vulnerability Response? Please advise.

Thanks in advance

[Tanushree Maiti]

Hi @VenkateshS08928 

As per ServiceNow Documentation: Identifying duplicate vulnerable items from multiple scanners :

If you are using multiple scanners on the same asset to detect vulnerabilities, multiple vulnerable items (VIs) might be created. You can identify these duplicate VIs to ensure that the duplicate vulnerabilities are not assigned to the remediation owners.

This resolution is possible only if the same vulnerabilities, such as the same Common Vulnerabilities and Exposures (CVEs) are detected. The vulnerability combination depends on the scanners being used. For example, Qualys and Tenable have their own vulnerability type, that is, third-party entries (TPEs), and other scanners such as Microsoft Defender for Endpoint detect vulnerabilities based on CVEs.

Starting from v 17.1, while creating a remediation effort, you can automatically refresh duplicate vulnerable items on the created remediation tasks. To automatically refresh the duplicate vulnerable items, you must select the Automatically refresh duplicate vulnerable items for the created remediation tasks option.

Show Duplicate VIs: Identify duplicate vulnerable items reported by multiple scanners in the system. You can mark the duplicate VI as Resolved. For more information, see Automatically resolve duplicate vulnerabilities. Duplicate entries are only shown when the combination of vulnerabilities is created using CVEs. For more information, see Vulnerability Response remediation task and vulnerable item states.

Potential duplicates are identified for the following vulnerability combinations: Scanner combination Type of vulnerability

Scanner 1 and Scanner 2	CVE
Scanner 1 and Scanner 2	CVE and TPE

Also check : Automatically resolve duplicate vulnerabilities 

Vulnerability Response remediation task states 

Refer similar post :

Duplicate Vulnerable Items created from different sources (Qualys and Defender)

[Venkatesh-S]

Hi @Tanushree Maiti ,

Thanks for your response.

I need one clarification:
Suppose Scanner 1 (Qualys) identifies a vulnerability for an asset, and Scanner 2 (BitSight) identifies the same vulnerability for the same asset.

In that case, will both findings be merged into a single Vulnerable Item with two detections associated with it, or will a separate VIT be created for each source?

Please confirm

Thanks

Venkatesh S

[Tim Boswell]

See also: https://www.servicenow.com/docs/r/security-management/now-assist-for-vulnerability-response-vr/dedup...