Vulnerable items closed and reopened by scanner

tkrishna29 · ‎05-06-2022

Hi,

Some of our Vulnerable items get closed by the scanner and got reopened by the scanner after a few days if it finds the detection. These VITs are already part of a Remediation task (a.k.a Vulnerability group). If the group is in the "Under Investigation" state, we see that when VIT got reopened, it is being assigned to the new group. For the same VIT, we will have 2 different groups and it gets confusing for the remediation owner assigned to the first group.

Is there a way I can control that behavior so that the VIT will not have a new group created and set the state of this item to "Under Investigation"?

I'm just wondering which script includes/job controls this behavior and if needed I'll work on customizing it.

Regards,

Krishna

tkrishna29 · ‎05-06-2022

Thank you, Chris. auto_refresh for the groups other than in the Open state is set to false which causes any newly opened VITs to be created in a new group.

I was thinking about implementing a solution along these lines.

Find all the open VITs in a group which is in the "Under investigation" state. Check if there is any other VUL group associated with that VIT using the same group rule. This indicates that the item is in duplicate groups (one group in the Open state and the other in the Under Investigation state). Mark the newly created group as duplicate (In description) and add the original group name in the work notes. This helps the remediation team to cancel to easily see that these VITs are related to a duplicate group.

View solution in original post

Chris McDevitt · ‎05-06-2022

Hi,

On the Vulnerable Items table there is a Business Rule:

"Link to Remediation Tasks"

Thats calls Script Include:

"VulnerableGroupRule"

Just a reminder it is not a best practice to customize Script Includes

Jane24 · ‎06-08-2022

Chris,

So, basically, if the Remediation Task status is anything other than "Open", and a VIT is reopened, it will link to a new Remediation Task, right?

If so, is there a link in Service Now documentation you can provide? My team is getting confused on a VIT linked to multiple Remediation Tasks.

Thank you

Chris McDevitt · ‎06-09-2022

Hi,

https://docs.servicenow.com/bundle/sandiego-security-management/page/product/vulnerability-response/concept/vulnerability-groups.html

Jane24 · ‎06-09-2022

Awesome! Thank you Chris!!!

Jane