Vulnerability query using, Vulnerable Item (VI), a Remediation Task, and Server Name

[MuraliKris]

I am trying to create a query using the tables Server CI (CMDB Class), Remediation task and Vulnerability Item, and looking for an output with server name, OS, vulnerability item and remediation task number (VULXXX). I can create a relationship between CMDB CI and vulnerability item but not able to get the remediation task number, wondering whether this is possible with the Tenable VR module?

[william_tran]

Yes, this is possible. The piece you're missing is the join table between Vulnerable Items (VITs) and Remediation Tasks: sn_vul_m2m_vul_group_item, label "Remediation Task Item". It has two reference fields:

• sn_vul_vulnerable_item → the VIT
• sn_vul_vulnerability → the Remediation Task (the table is named sn_vul_vulnerability for legacy reasons; its label is "Remediation Task")

Build your report directly on sn_vul_m2m_vul_group_item and dot-walk for the columns you need:

• sn_vul_vulnerable_item.cmdb_ci.name — server name
• sn_vul_vulnerable_item.cmdb_ci.os — OS
• sn_vul_vulnerable_item.number — VIT number
• sn_vul_vulnerability.number — Remediation Task number (VUL prefix)

Filter on the dot-walked CI class if you want to restrict the output to servers only.

One thing to be aware of: the VIT-to-Remediation-Task relationship is many-to-many, so the same VIT can appear under more than one task number. Your output will have one row per VIT/task pair, not one row per VIT. Worth confirming that's what you want before publishing the report.

This is scanner-agnostic, so Tenable, Qualys, Rapid7 all populate through the same VIT and Remediation Task tables.

If this helped, please mark it as helpful or accept as solution so others running into the same issue can find it.

[MuraliKris]

I couldn't find the table sn_vul_m2m_vul_group_item from the search

[william_tran · Accepted solution]

Have you tried searching by the label? `Remediation Task Items`

This is a core table that should be installed with VR.

https://***YOUR_INSTANCE***.service-now.com/now/nav/ui/classic/params/target/sn_vul_m2m_vul_group_item_list.do%3Fsysparm_filter_pinned%3Dtrue%26sysparm_query%3D%5EORDERBYDESCsys_updated_on

[MuraliKris]

Thanks @william_tran, although I couldn't get the table using the query builder, I was able to use the link and create filters to get the required result.

Thanks for your help.