Vuln Resp Rescan Integrations

[Cheryl ODell]

We have recently implemented the Vuln Response Module.  I am trying to figure out how to only show active integrations when selecting the INSTANCE for a Rescan of a VIT (that is not closed).  When I try to set the INSTANCE, I see my Tenable.SC integration, but I also see our deactivated Tenable.io, Manual Ingestion (which is active), and the Microsoft Security Response Center Solution Integration and Red Hat Solution Integration which are both currently not active.

How do I get ServNow to only show the ACTIVE Instances to select from?

Thanks,

Cheryl

[Martin Dewit]

Hi Cheryl, you will most likely need to make a change to the pop-out list view of instances to automatically filter for only active integration instances. Per docs, "You are prompted to choose the instance or instances for the rescan and the scanner credentials you want to use to access the scanner". Could you possibly provide a screenshot of the instance selection for a Rescan?

[Cheryl ODell]

Thanks for the reference Martin - I did read the documentation, but couldn't find a way to "hide" the integrations that are not active.  Here is a screenshot:

Manual ingestion is active, as is the recently renamed Tenable Rescan...   Tenable.io is not active, and neither is the Microsoft or Red Hat.  Is there some setting to only show the active integrations?  I can't seem to find that setting in the documentation.

Thanks again for your help!

Cheryl

[Cheryl ODell]

I should also add - I'm trying to do this through the Vulnerability Manager or IT Remediation Owner Workspace.  It looks entirely different from the classic view; and, looks much more user friendly.  Argh - I wish the workspace would offer the same result as in the classic view:

So maybe there isn't a button for the workspace view to only show active integrations?  Really aggravating.  I don't want to tell my remediation owners to switch between views just to issue a rescan.  Thanks for any advice,

Cheryl

[Martin Dewit]

Thanks for the extra information. Since it is within the workspaces, changes to the UI are done in UI Builder. I found the Rescan Modal which has an entry for each scanner. The Tenable Rescan function shows filters which match with your first screenshot. I believe if you were to "Configure values" as Active = true it will then only show Active Integration Instances. I do not use Tenable, so I have no way to test this, but this is what would make sense to me.

1. Navigate to UI Builder
2. Under Page Collections > Open VR Record page modals (URL: now/builder/ui/pc/b25172aac157a110f87727e639effe63)
3. Open Modal - Rescan > Rescan default (URL: now/builder/ui/edit/pc/b25172aac157a110f87727e639effe63/198d6f9d770530102824914f581061ca/118d2f9d770530102824914f5810618f)
4. Scroll to find the Tenable Container and Filter 1 component > Config Tab > Data Section > Filter source > Configure Values