Is it possible to import pentest data into Infrastructure VR module, instead of AVR?

[Community Alums · Accepted solution]

Hi @ankita dutta1 ,

 The pentest result became a Vulnerable Item and then follow the VR lifecycle. Except..... Normally a VR scanner is the final judge on whether or not something was truly resolved. Manually generating pentest results does not have the same mechanism. 

So the answer is yes and No, depends on your organization.

[ankita dutta1]

Ok. Thanks for the response. How about the data model requirements. Dont pentests always need to be mapped to an application? Is this possible in normal/host VR module - without customization?

[AC12]

Sandeep. forcing pentest results to fall under AVR is not in alignment with what penetration testing encompasses (the term pentest should not be only associated with application pentests).  For example a penetration test could find SMB v1 enabled on a server, this should be mapped as a VIT and tied to the CMDB CI record of the server.   Manually creating/ingesting pentest findings into ServiceNow should allow the customer to determine/dictate which of the apps (VR, AVR etc) the finding should fall under and reference corresponding CI datasets where/when applicable.