--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules # Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Vulnerability Response Workspaces and updates to remediation tasks and remediation task rules ServiceNow's Vulnerability Response Workspaces provide a modern, workspace-based experience for managing vulnerabilities, replacing parts of the classic Core UI. These workspaces are designed to streamline how vulnerability managers, analysts, and IT remediation teams monitor, assess, assign, and remediate vulnerabilities using specialized interfaces tailored to their roles. Show full answer Show less The workspaces improve focus and efficiency by enabling managers to monitor critical vulnerabilities and assign remediation efforts, while IT teams access IT-centric details and remediation tasks in one place, facilitating more effective vulnerability resolution. ## Key Features * **Vulnerability Response Workspaces:** Include Vulnerability Manager Workspace (for monitoring and prioritizing vulnerabilities), IT Remediation Workspace (for IT teams to remediate assigned vulnerabilities), and Vulnerability Assessment Workspace (for vulnerability analysis, especially zero-day vulnerabilities). * **Watch Topics:** These define filtered segments of vulnerable items that managers want to monitor closely. They provide dashboards with trends, remediation progress, and critical vulnerability statistics to support informed decision-making and rapid response. * **Remediation Efforts:** Created by vulnerability managers to bundle vulnerabilities from watch topics into actionable remediation work assigned to IT teams. * **Remediation Tasks:** Automatically generated lists of actions IT teams take to remediate vulnerabilities within remediation efforts. These tasks are assigned based on existing assignment groups and managed in the IT Remediation Workspace. * **Remediation Task Rules:** Formerly called Vulnerability Group Rules, these rules now mainly serve legacy purposes. They are less central in the new workspace workflow, with watch topics and remediation efforts providing improved monitoring and assignment capabilities. ## Practical Usage and Benefits * Vulnerability managers use watch topics to filter and monitor the most critical vulnerabilities dynamically, enabling targeted remediation efforts and improved prioritization. * Remediation efforts consolidate vulnerabilities into focused groups for assignment, improving clarity and reducing overload for IT remediation teams. * IT remediation teams access all relevant IT-centric information and remediation tasks in a dedicated workspace, allowing efficient tracking and resolution of vulnerabilities without sorting through unrelated records. * Vulnerable items can only belong to one remediation effort at a time, preventing duplication of work, while they can appear in multiple remediation tasks if needed. * The life cycle of remediation tasks remains consistent with previous versions, with tasks transitioning to inactive once all associated vulnerabilities are resolved. * Existing remediation task rules and assignment rules from previous versions are preserved and accessible, supporting smooth upgrades and incremental adoption of the workspace model. * Configuration requires setting up users, groups, and assignment rules to ensure vulnerabilities and remediation tasks are assigned appropriately within your organization. ## Key Outcomes * Improved ability for vulnerability managers and analysts to focus on and monitor critical vulnerabilities using watch topics and dynamic filtering. * More efficient assignment and tracking of remediation efforts and tasks, reducing complexity and enhancing collaboration between security and IT teams. * Enhanced visibility into remediation progress with dashboards and data visualizations integrated into the workspaces. * Streamlined vulnerability remediation workflows that support large volumes of vulnerability records without performance issues seen in previous versions. * Greater flexibility for organizations to gradually transition from legacy remediation task rules to the more powerful workspace-driven approach. Remediation tasks bundle records (VITs, AVITs, CVITs or CTRs) in the Vulnerability Response Workspaces. ## Key terms for the Vulnerability Response Workspaces {#vr-ws-overview__section_f1d_cdv_4qb} Vulnerability Response Workspaces, or workspaces : Vulnerability Response supports the Vulnerability Response Workspaces. You can either use the classic Core UI experience or the workspaces. Classic (legacy) UI : Refers to the Core UI experience. You still perform some actions and view a few lists in the classic environment. Vulnerability Manager Workspace : In this workspace, managers monitor targeted vulnerabilities and select the VIs and test results that they care the most about to assign to IT. IT Remediation Workspace : In this workspace, IT teams can focus on the most important vulnerabilities that are assigned to them by security. IT-centric information that includes impacted, distinct configuration items (CIs), Solutions, and remediation progress is easily available for remediation owners in this workspace. Vulnerability Assessment Workspace : In this workspace, vulnerability analysts can perform vulnerability assessment during the zero-day vulnerability analysis. After a zero-day vulnerability is identified, they can assess the potential impact and risk associated with the vulnerability. The analysts can analyze the affected system,applications, or network components to understand the severity and possible attack vectors within the organization. Watch topic : Watch Topics define a segment of the vulnerable items that vulnerability managers and analysts want to monitor in the Vulnerability Manager Workspace. Watch topics show a focused overview set of reports that pertain to a segment of VIs and test results with trending, CI, and vulnerability-related statistics. The dashboards on these topics can be used to monitor trends. The dashboards can also help managers: * View remediation progress on critical items * Determine the existence of vulnerabilities on critical systems * See when a new exploit comes out * Drive rapid response for resolving a particular set of vulnerabilities {#vr-ws-overview__ul_ihz_45g_crb} Remediation effort (RE) : Remediation efforts are created by vulnerability managers when they determine it is time for IT to fix the vulnerabilities listed in a watch topic. Vulnerability managers and analysts can choose how they want to create remediation tasks, by assignment group and vulnerability, for example. Remediation tasks are contained in the remediation effort. Remediation task (VUL) : IT teams use remediation tasks to remediate the vulnerabilities assigned to them by security. Remediation tasks are lists of the actions that are required to fix vulnerabilities. Remediation tasks are created automatically when security managers create remediation efforts. ## Development of the Workspaces {#vr-ws-overview__id_vyw_hbw_mqb} In previous versions of Vulnerability Response, you had two options to monitor a set of records (VITs, AVITs, CVITs, or CTRs) as a security and vulnerability analyst: * The Overview dashboard, which summarizes all VIs * Remediation tasks {#vr-ws-overview__ul_xbf_v1w_tqb} Vulnerable items were sorted into remediation tasks automatically according to your pre-defined remediation task rules. Remediation tasks were designed to support IT teams with remediating manageable chunks of vulnerable items. This automation made it possible to group very large numbers of records automatically for bulk assignment and remediation. However, vulnerability analysts and managers found monitoring the whole set of records from remediation tasks challenging. In addition to performance problems with large groups, creating functional remediation task rules that filtered out only the vulnerabilities you that you found most critical can be difficult. The Vulnerability Response Workspaces: * Help security managers filter out, monitor active VIs and test results over time, and drive remediation for the vulnerabilities they determine are the most important. * Provide IT teams with IT-centric information in one location that they can use to fix the vulnerabilities assigned to them by security. {#vr-ws-overview__ul_on1_k2c_5qb} ## Updates to remediation tasks in the workspaces {#vr-ws-overview__section_cks_5fw_tqb} In the Vulnerability Manager workspace, vulnerability analysts and managers use Watch Topics and Remediation Efforts as two new methods for monitoring and assigning VIs for remediation. Vulnerability groups are renamed, Remediation Tasks. This change applies to labels on lists, records, and rules in both the legacy UI and the workspaces. Remediation tasks are set up so that IT teams can work with them in the IT Remediation Workspace. The following list illustrates how as a vulnerability manager or vulnerability analyst, you might monitor vulnerabilities and test results, filter them, and assign them: 1. In the Vulnerability Manager Workspace, managers monitor imported vulnerabilities and misconfigurations on watch topics. Managers and analysts use watch topics to monitor a dynamic set of filtered records over time that they think are the most critical. 2. With watch topics, security managers can determine when and what kind of VIs to hand off to IT teams in Remediation Efforts (REs). These REs are static lists of the VIs that security wants to IT teams to fix.From remediation efforts, managers have four options for how to bundle records into Remediation Tasks (VULs, AVULs, CVULs, or CRGs). Remediation tasks are automatically assigned to IT teams based on the assignment groups that are originally associated with the records. 3. IT teams work on remediation tasks in the IT Remediation Workspace without having to sort through all of the records.A remediation task transitions through the same states as the remediation task does in previous versions of Vulnerability Response. When all the records in a remediation task are closed, the remediation task is closed and is set to Inactive. Remediation progress is updated on data visualizations on the watch topics and on the IT remediation Home page. {#vr-ws-overview__ol_syq_q2w_mqb} ## Updates to remediation task rules in the workspaces {#vr-ws-overview__section_sxd_4cc_5qb} Vulnerability Group Rules are called Remediation Task Rules. This change applies to the labels on lists, records, and rules in both the legacy UI and the workspaces. Table names, for example, \[sn_vul_m2m_vul_group_item\], are not changed. If you have created vulnerability groups rules in a previous versions of Vulnerability Response, they are still available to you labeled as remediation task rules. However, in the workspaces, remediation task rules are no longer used as the primary method of organizing a large volume of records into remediation tasks. You might prefer to leave your remediation task rules inactive as you get used to the workspaces. You might prefer instead to incrementally start using the Vulnerability Response Workspaces. 1. If you are upgrading from a previous version of Vulnerability Response your existing remediation task rules are preserved. They are still available to you in the workspaces. The default group rule, Vulnerability, is inactive by default. 2. Configure assignment rules, and, perhaps if you want, risk rules, and then perform an import. 3. As a vulnerability manager or analyst, you can pick segments to monitor from the watch topics in the Vulnerability Manager Workspace. You can use watch topics as standalone features. Pick any subset of records and use the dashboard on them to monitor trends. With them, you can decide where and when to focus remediation efforts. 4. As a vulnerability managers or analyst, you create remediation efforts from watch topics when you decide it is time to remediate a subset of records. A remediation task is also created automatically to hand off to IT when you create a remediation effort. 5. Over time, as a vulnerability manager or analyst, you might discover some routine patterns that you can handle with remediation tasks rules automatically. {#vr-ws-overview__ol_s51_g3c_5qb} To view your remediation task rules, navigate to respective Remediation Task Rules modules in Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, and Configuration Compliance from the All menu. ## More on assignment rules, remediation task rules, remediation efforts, and vulnerable items in the Vulnerability Response Workspaces {#vr-ws-overview__section_nqy_pj4_1qb} * Remediation Task records are displayed on lists and records in both the classic environment and in the workspaces. * A remediation task transitions through the same states as a vulnerability group. When all the records in a remediation task are closed, the remediation task transitions to the Inactive state. * To help your teams with remediation, a vulnerable item can only be in one remediation effort. Once it is in a remediation effort, a vulnerable item won't be added to any other remediation efforts that you create. * If you delete a remediation effort, the remediation effort becomes inactive and any active VIs are available for new remediation efforts. * A record (VIT, AVIT, CVIT or CTR) can be in multiple remediation tasks. * Remediation tasks are assigned automatically to IT teams based on the assignment group that is associated with a vulnerable item in a remediation effort. If you create a remediation task on-demand, you select the assignment group. * If you are an upgrading from a previous version of Vulnerability Response, your assignment rules have been preserved in the legacy UI. * If you are an upgrading from a previous version of Vulnerability Response, your current users and groups are inherited and accessible to you in the workspaces. {#vr-ws-overview__ul_gkr_wst_qqb} For more information about the life cycles of remediation efforts, see [Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces](https://www.servicenow.com/docs/TajiM~CxfZaBqB1i5BkMLQ "The states of records and their associated remediation tasks (RTs) are impacted if records are deferred, resolved, reopened, and transferred to other remediation efforts (REs)."). ## Configuration and setup for the Vulnerability Response Workspaces {#vr-ws-overview__section_jjv_wj4_1qb} For more information on assignment rules and remediation task rules, see [Configure the Vulnerability Response Workspaces](https://www.servicenow.com/docs/r1YSEQ1bNRSLUqyZa1DR4g "Before you can use the workspaces, confirm you've completed the following setup tasks.") and . If you are a new customer and you've not already added them, you must set up users and groups so that vulnerable items and remediation tasks are assigned to the remediation groups that you want. Vulnerability Response assignment rules are used to assign work to groups.