Combined Application Vulnerability Response release notes for upgrades from Vancouver to Washington DC

Consolidated page of all release notes for Application Vulnerability Response from Vancouver to Washington DC.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Application Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Vancouver to Washington DC.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Application Vulnerability Response to Washington DC

Before you upgrade to Washington DC, review these pre- and post-upgrade tasks and complete the tasks as needed.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

New features

Between your current release family and Washington DC, new features were introduced for Application Vulnerability Response.

Release	Release notes
Vancouver	Veracode and Fortify Vulnerability Integrations Two options enable you to manage how the Source states on application vulnerable items (AVIs) are mapped in your instance after import from the Veracode and Fortify integrations. The following options are found on the configuration pages for these integrations and are activated by default: Manage exceptions in ServiceNow triages application vulnerable items (AVI) with the ServiceNow Exception management workflow. AVIs transition to Open, and you request exceptions from AVI records. Deactivate the option if you want to preserve the Source states on AVIs imported from Fortify and Veracode. Manage false positives in ServiceNow triages false positives with the ServiceNow False positive workflow. AVIs transition to Open, and you request false positives from AVI records. Deactivate this option if you want to preserve the Source states on AVIs imported from Fortify and Veracode. Remediation task rules in Application Vulnerability Response Starting with v20.0, use remediation task rules to help you define how application vulnerable items (AVIs) are automatically grouped and assigned. Gather AVIs based on their vulnerabilities with the default Vulnerability rule that is included in the base system. Use this rule as a template to help you create your own rules. Create filters with the condition builder so that application vulnerable items are matched automatically to existing remediation tasks (AVULs). If a match is not found, a new task is created. Enable group-by conditions so that not all the AVIs that share data are assigned to the same remediation task. Exception Management in Application Vulnerability Response Starting with v20, manage application vulnerable items that you can't remediate immediately with enhancements to exception rules. Create exception rules to automatically defer existing and new application vulnerable items (AVI)s for a specific period. Submit a request for an extension to an exception rule if you find that records created by the rule's Deferred until date are not resolved. Defer remediation with the Awaiting Implementation state for AVIs. Let your team know that your research and work on a task is complete but a fix isn't available. Enhancements to penetration testing assessment requests Starting with v19.0, create penetration test assessment requests directly from the list of existing requests. New fields on the request form help you to more accurately scope your test requirements for sprints: You can enter the application size and the type of tests that you want. These details help you to determine the scope and effort required for the tests. The Vendor/Joint Venture Information and Business Impact tabs permit you to enter more detailed information about the third-party vendors, potential financial damage, and non-compliance. Viewing the dashboards in Vulnerability Manager Workspace Starting with version 19.0 of Application Vulnerability Response, the Application Vulnerability Management and My Application Vulnerabilities dashboards are available in the Next Experience UI from Vulnerability Manager Workspace. Request an extension for a deferred container vulnerable item Starting with version v19.0.4 of Application Vulnerability Response, you can request an extension for a deferred container vulnerable item before the due date. Extension of deferred extension rule Starting with version v19.0.4 of Application Vulnerability Response, you can request an extension for a deferred exception rule before the due date. Extension of deferred remediation task Starting with version v19.0.4 of Application Vulnerability Response, you can request an extension for a deferred remediation task before the due date. Accessing only application vulnerable items assigned to you and your group with the exception approver role For the exception approver role, sn_vul.app_exception_approver, the granular role, sn_vul.app_read_all, has been removed so that you can access the application vulnerable items and remediation tasks assigned to you and your group only. Adding work notes for a deferred application vulnerable item Starting from 20.0 of Vulnerability Response, you can add relevant information in the Work Notes field for a deferred application vulnerable item also. Quick start tests for Vulnerability Response After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response works as expected. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations.
Washington DC	Closed application vulnerable items in the SBOM Workspace reopen automatically A Closed application vulnerable item (AVIT) for a component with an associated vulnerability is reopened automatically and visible in the SBOM Workspace if the following conditions are met: The Reopen AVITs if detected (sn_sbom_resp.reopen_avits_if_detected) system property is activated. This system property is activated by default. The AVIT with the associated vulnerability is detected again by a third-party integration's vulnerability scans or the component with the vulnerability is part of a subsequent SBOM upload. The substate of the Closed AVIT is not one of the following: Mitigation Control in Place, Not Affected, or False Positive. AVITs with these substates are not reopened by the system property. Deactivate the system property only if you do not want Closed AVITs to reopen automatically. Updating application vulnerable items in bulk in the Vulnerability Manager Workspace Perform the following tasks on one or more application vulnerable items (AVITs) simultaneously using the bulk edit feature in the Vulnerability Manager Workspace: Update the state of AVITs. Request an exception in bulk. Mark AVITs as false positive in bulk. Assign AVITs to an assignment group for remediation. View list of vulnerable items in the Vulnerability Manager Workspace View the list of active vulnerable items in the Vulnerability Manager Workspace using the active records count next to the View by drop-down in the Host vulnerabilities tab on the Home page. Open active AVITs list in classic UI from the Vulnerability Manager Workspace Navigate to the Classic UI's active AVITs list using the View Classic link in the Application Vulnerabilities tab on the home page of the Vulnerability Manager Workspace. Refresh a remediation task in the Vulnerability Manager and IT Remediation Workspaces Refresh a remediation task (AVUL#) in the Vulnerability Manager and IT Remediation Workspaces to inspected if there are any additional records that belong to a remediation task. Enhancements to the Software Bill of Materials applications Upload SBOM files for the CycloneDX and SPDX standards starting with version 3.0 of SBOM Core and 3.2 of SBOM Response. XML and JSON formats are supported for CycloneDX up to and including version 1.4. JSON format is supported for SPDX up to and including version 2.3. Performance enhancements in the SBOM Workspace for the BOM Entities and Components pages. You might experience faster load times for the Home and Components modules in the SBOM Workspace. GitHub Application Vulnerability Integration version 1.1 Import application information from your GitHub repositories with the GitHub Repos Integration. Imported data is stored in the Discovered Applications [sn_vul_app_release] table. The GitHub CodeScan and Dependabot integrations require current application data that is imported by the GitHub Repos Integration. Enhancements to the (OAuth) authentication credentials on the GitHub Configuration page. Enhancements to the Veracode Vulnerability Integration version 4.2 Select Get More Details on Veracode application vulnerable items (AVITs) on the Application Vulnerable Item [sn_vul_app_vulnerable_item] table or from the list views in the Vulnerability Response Workspaces to view the following data imported from Veracode: HTTP Source request and Source response details for Dynamic Application Security Testing (DAST) scans are displayed on the HTTP Request/Response related list. Solution recommendations from Veracode are displayed on the Findings related list. HTTP Source request, Source response, and recommendations are displayed on the Details tab In the Vulnerability Response workspaces. The Description column is supported on the Application Vulnerable Item [sn_vul_app_vulnerable_item] table. Enhancements to Application Vulnerability Response AVIT Vulnerability Integrations View details such as total processing times, average times for pre- and post-integration run processes, and reports on the integration run records for the Fortify version 2.3, Invicti version 1.1, and Veracode version 4.2 Application Vulnerable Item (AVIT) Integrations. Create auto-close rules for stale AVITs Automate the closure of stale AVITs via Auto-close rules based on your required filter conditions. Analyzing the vulnerability landscape in the Vulnerability Manager Workspace Get the overall summary of the active application vulnerabilities through visual representation of risk ratings, remediation progress, assignment groups workloads, and records in remediation tasks on the Home page of the Vulnerability Manager Workspace. Acquiring the summary of a set of application vulnerabilities using filters Get the summary of a set of active application vulnerabilities by filtering those vulnerabilities on the Home page of the Vulnerability Manager Workspace. Define Vulnerability Response email notifications When links are clicked in an email notification, records open in Vulnerability Manager Workspace or IT Remediation Workspace based on the user's role. Invicti Vulnerability Integration Import Interactive Application Security Testing (IAST) and Dynamic Application Security Testing (DAST) data with the Invicti Vulnerability Integration. This data enables you to determine the impact and priority of flaws in your custom software applications. Use the following Invicti integrations to enrich your vulnerability data: Invicti Application List Application - Import applications that are scanned by Invicti. Invicti Scan List Integration - Import data about the date and time a scan was run. Invicti Application Vulnerable Item Integration - Import Invicti vulnerable item data. Import Software Bill of Materials (SBOM) files with Veracode Upload SBOM files in CycloneDx JSON format with a dedicated Veracode API. Identify the components you are using in your software projects and information about their releases, versions, and associated vulnerabilities. The integration generates SBOMs in CycloneDx JSON format and uploads them into your instance for parsing. The Software Bill of Materials applications are required. For more information, see Exploring Software Bill of Materials. Software Bill of Materials The following enhancements were made to supported applications for the Software Bill of Materials (SBOM) product: Added PURL validation for the OSV.dev integration. Invalid PURLs are ignored during file processing. If available, OSV.dev fixed version information is displayed on a related list on the AVIT record. SBOM application vulnerable items (AVITs) show component information in enhanced SBOM workspace views. Disabled Remediation Task rules for SBOM AVITs in the SBOM Workspace. You can edit rules for SBOM AVITs in the Vulnerability Manager Workspace in Vulnerability Response. Expanded SBOM Workspace access enables you to view the SBOM inventory with the SBOM Core application. Reapplying CI Lookup rules in Application Vulnerability Response Reapply your configuration item (CI) lookup rules to update existing CIs for scanned applications and product models. Create remediation tasks manually Create remediation tasks (AVULs) manually for application vulnerable items (AVITs) from remediation task records on the Group Configuration tab. Notifications on false positive and exception requests Receive notifications and reminders on false positive and exception requests change approval records by setting approval expiry and reminder dates on the approval rules. Quick start tests for Application Vulnerability Response After upgrades and deployments of new applications or integrations, run quick start tests to verify that Application Vulnerability Response works as expected. If you customized Application Vulnerability Response, copy the quick start tests and configure them for your customizations.

Changes

Between your current release family and Washington DC, some changes were made to existing Application Vulnerability Response features.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Removed

Between your current release family and Washington DC, some Application Vulnerability Response features or functionality were removed.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Deprecations

Between your current release family and Washington DC, some Application Vulnerability Response features or functionality were deprecated.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Activation information

Review information on how to activate Application Vulnerability Response.

Release	Release notes
Vancouver	Install Application Vulnerability Response by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Washington DC	Install Application Vulnerability Response by requesting Vulnerability Response from the ServiceNow Store. Application Vulnerability Response is included as part of the Vulnerability Response application. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Additional requirements

If any additional requirements were introduced or changed for Application Vulnerability Response we have noted them here.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Application Vulnerability Response we have noted them here.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Accessibility information

Review details on accessibility information for Application Vulnerability Response, such as specific requirements or compliance levels.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Localization information

If there are specific localization considerations for Application Vulnerability Response we have noted them here.

Release	Release notes
Vancouver	No updates for this release.
Washington DC	No updates for this release.

Highlight information

If there are specific highlight considerations for Application Vulnerability Response we have noted them here.

Release	Release notes
Vancouver	Use the new JSON-based API integrations that were added to the Veracode Vulnerability Integration to ingest the enhanced Veracode vulnerability data. Scope your test requirements more accurately by using the enhanced Penetration Test Assessment Request form. See Application Vulnerability Response for more information.
Washington DC	Import application information from your GitHub repositories with the GitHub Repos Integration. The Software Bill of Materials applications support SBOM files in CycloneDX and SPDX standards. Get the overall summary of active application vulnerabilities with visualizations of all or prefiltered active application vulnerabilities in the Application vulnerabilities tab on the new Vulnerability Manager Workspace landing page. Import Interactive Application Security Testing (IAST) and Dynamic Application Security Testing (DAST) data with the Invicti Vulnerability Integration. See Application Vulnerability Response for more information. for more information.