Create a Vulnerability Response assignment rule using ML

Use the following script to create a catch-all assignment rule for vulnerable items that uses ML recommendations from Predictive Intelligence to automatically assign them for remediation.

시작하기 전에

The Vulnerability Assignment Recommendations for Vulnerability Response application must be installed and activated. This application is available on the ServiceNow Store.

A classification solution must be defined, active, and trained. You use this model to help you predict the appropriate assignment group for vulnerable items (VI)s in cases when your assignment rules did not find a correct match for the intended recipients.

This rule might help you reduce the number of unassigned VIs after other assignment rules have already completed.

See Install Vulnerability Assignment Recommendations for Vulnerability Response and Create and train a solution definition for Vulnerability Response for more information.

Role required: sn_vul.vulnerability_admin

이 태스크 정보

You might prefer to perform this task only if you have advanced coding experience, or you have in-depth knowledge about the ServiceNow AI Platform, its Predictive Intelligence features, and how assignment rules work.

프로시저

1. Navigate to All > Vulnerability Response > Administration > Assignment Rules.
2. Select New.
3. Fill in the fields on the form, as appropriate.
   See Create or edit Vulnerability Response assignment rules for more information about these fields.
4. From the Assign using choice list, select Script.
5. In the editor, copy and paste the following script.

       /*
       * Catch-all assignment rule using ML recommendation
       * NOTE: Requires Vulnerability Assignment Recommendations for Vulnerability Response 
       * Classification Solution must be active and trained
       */
   var vitID = current.sys_id;
   getMLAssignmentRecommendation(vitID);
   
   function getMLAssignmentRecommendation(vulnerableItemSysId) {
       var ARU = new sn_vul.AssignmentRecommendationUtils();
       ARU.initialize();
       
       var viPredictionObj = ARU.getPredictionsForVI(vulnerableItemSysId);  
       /*
       *returns object containing array of predictions
       *payload structure:
       *
       {
           "predictions": [
               {
                   "sys_id": "b6ed54f3db7b23005daef4eabf9619f3",
                   "name": "Windows Server support ",
                   "confidence_score": "57.54"
               },
               ...
           ],
           "exception": ""
       }
       */
       var viPredictionArray = viPredictionObj['predictions'];
       var topPredictionObj = viPredictionArray.shift();
       
       return topPredictionObj['sys_id'];
   }

6. Select Submit.

다음에 수행할 작업

Review for more general information about assignment rules and the Reapply all vulnerability assignment rules scheduled job.