Rest API - how do i retrieve all Vulnerable Items under a remediation task?

[darst007]

Hi, I am having trouble fetching the complete list of Vulnerable Items under a remediation task (aka vulnerability group)?

Any help would be appreciated

Thanks

[Liju John1]

What Kind of scanner are you using for the vulnerability import ?

For Tenable:

You can add those IPs into into a newly created asset tag in Tenable cloud add the asset-tag to the REST method or script include in the integration run job

TenableIOVulnerabilitiesIntegration - CustomerCopy

body.filters["tag.CategoryType"]=["New_Tag"];

You might want to check out this Docs page here, it appears like the JSON filter can be specified / overridden directly on the REST Message, such that you may not even need to modify or customize the Script Include.
https://docs.servicenow.com/bundle/vancouver-security-management/page/product/secops-integration-vr/...

For Qualys

you can add the IPs OR QIDs or the asset-tags to the script include or rest message like this 

Qualys Host Detection Integration - CustomerCopy

it is better to build a custom integration for bringing the vulnerabilities separately !!

Also create a Vulnerability Group rule with your own filters to add all the VITs to Remediation Task

[darst007]

Hi Liju, apologies, i am a little bit new to RestMessageV2. Any way to fetch the required data via curl/Powershell /C#?

We're using qualys to collect data. 

[SanjivMeher]

You may need to make a Rest API call to the table sn_vul_m2m_vul_group_item. Thats where the relationships between Vulnerable item and Remediation Tasks are stored in ServiceNow.

[darst007]

Hi Sanjiv, tried REST api call via curl/Powershell - e.g. Invoke-RestMethod -Method Get -Uri "https://sn.instance/api/now/table/sn_vul_m2m_vul_group_item?sysparm_limit=1" -Headers $snowheader, however getting empty list:

result
------
{}

Am i doing something wrong?