Rapid7 Vulnerability Integration and Risk Score

[Lord Omicron]

Rapid7's Nexpose scan generates a risk score for vulnerabilities. ServiceNow also has vulnerabilities risk scores.The risk score from the integration is not loaded instead, the SN risk score (default 50) is what is showing (see second image). How do you override it so that the imported risk score from the integration is what's used instead of SN's? 

The score is available in the Rapid7 Vulnerabilities import set as shown in first image but it is not mapped to any field in SN tables. I believe I can add the field mapping to the related transform map but I'd rather verify that there is an OOTB configuration available. Any insights you can provide would be much appreciated.

Thanks!

               

[abil1]

Hi Jing,

As you mentioned i have made all the "Vulnerability Calculators" as active 'false' and then ran the "Rapid7 Vulnerability Integration - API" integration, but it is not populating the value. It is populating as '0'. Please help me on this.

[jing3]

You are using Rapid7 API integration. What you had done is for Rapid 7 Datawarehouse Integration. So the approach is not valid for this integration. With the API integration, there is no transfer map, the import is done via the script, you will have to dig into the integration script for Rapid 7 Vulnerable Item API integration to figure out what need to be done ( I had not done it).

One thing to consider, one of the important value of using the integration is to use Configuration Item details on ServiceNow to evaluate Risk exposure. Curious about the reason why not taking advantage of it. 

[abil1]

Hi Jing,

Thanks for your info which was very helpful for me. Finally i found the script and updated that and now it got populated.

Regards,

Abil.