Combined Application Vulnerability Response release notes for upgrades from Xanadu to Yokohama

Consolidated page of all release notes for Application Vulnerability Response from Xanadu to Yokohama.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Application Vulnerability Response release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Yokohama.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Application Vulnerability Response to Yokohama

Before you upgrade to Yokohama, review these pre- and post-upgrade tasks and complete the tasks as needed.

Release	Release notes
Xanadu	For information about the new features of Vulnerability Response, see Vulnerability Response release notes. For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Xanadu release, see the Vulnerability Response Compatibility Matrix and Release Schema Changes [KB0856498] article in the Now Support Knowledge Base.
Yokohama	For information about the new features of Vulnerability Response, see Vulnerability Response release notes. For more information about the released versions of the Application Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Xanadu release, see the Vulnerability Response Compatibility Matrix and Release Schema Changes [KB0856498] article in the Now Support Knowledge Base.

New features

Between your current release family and Yokohama, new features were introduced for Application Vulnerability Response.

Release	Release notes
Xanadu	Customize the calculation of Age and Age closed parameters of a application vulnerable item Starting with v24.0.6 of Vulnerability Response, the Age and Age Closed durations of am Application Vulnerable item can be configured to be calculated from the date in the Created, Opened, or First Found fields. Open the search results in the Vulnerability Manager Workspace or IT Remediation Workspace rather than the Classic UI Starting with v24.0.6 of Vulnerability Response, automatically open your search results in the Vulnerability Manager Workspace or IT Remediation Workspace rather than the Classic UI, by adjusting the application scope in the unified navigation bar to Vulnerability Manager Workspace or IT Remediation Workspace respectively. These application scopes are available to you based on your assigned role. Vulnerability Manager Workspace access to the sn_vul.app_read_all role Starting with v24.0.6 of Vulnerability Response, as a user with the sn_vul.app_read_all role, you can view the application vulnerable items in the Vulnerability Manager Workspace. IT Remediation Workspace access to the sn_vul.app_read_assigned role Starting with v24.0.6 of Vulnerability Response, as a user with the sn_vul.app_read_assigned role, you can view the application vulnerable items assigned to you and your assignment groups in the IT Remediation Workspace and remediate them. Navigate to the List page in the Vulnerability Manager Workspace or IT Remediation Workspace by selecting the links from the All menu Starting with v24.0.6 of Vulnerability Response, when you enable the 'sn_vul_cmn_ws.navigate_to_workspace' system property, selecting predefined filter links in the Application Vulnerability Response module from the 'All' menu will automatically open these links in the List page in the Vulnerability Manager Workspace or IT Remediation Workspace based on your role. Hide the record count on the lists in the Vulnerability Manager Workspace and IT Remediation Workspace Starting with v24.0.6 of Vulnerability Response, you can hide the record count on the lists in the List page in the Vulnerability Manager Workspace and IT Remediation Workspace, by adding the table names to the glide.ui.list.seismic.omit.count system property. Enable automatic refresh for the Home page dashboard in the Vulnerability Manager Workspace Starting with v24.0.6 of Vulnerability Response, when creating and editing filters in the Application Vulnerabilities tab on the Home page of the Vulnerability Manager Workspace, you can configure the widgets to refresh automatically. Otherwise, you can manually refresh the widgets by selecting the Refresh button on the Application Vulnerabilities tab. Re-evaluating remediation properties for all records in the Vulnerability Manager Workspace Starting with v24.0.6 of Vulnerability Response, you can evaluate the remediation properties for all the Application Vulnerable Items from the Application Vulnerable Items list by selecting the All items in the Record selection field of the Re-evaluate remediation properties modal in the Vulnerability Manager Workspace. New Properties module Starting with v24.0.6 of Application Vulnerability Response, a new Properties module has been added to the navigation menu under the Administration section. This module enables direct modification of the values, offering a user-friendly method to manage and update system properties directly from the interface. View, classify, and assign software license information you upload with your SBOM files Use the License administration module in the SBOM Workspace to help you determine your over-all license compliance and risk exposure to the open-source and vendor-supplied software components you use in your application development. View all the licenses that are used in your organization in the License administration module. Classify existing licenses as: "Permitted", "Restricted", "Banned", or "Unclassified", and create new licenses. For unassigned or missing licenses, you can manually assign licenses to components used by your applications. Closed application vulnerable items in the SBOM Workspace reopen automatically A Closed application vulnerable item (AVIT) for a component with an associated vulnerability is reopened automatically and visible in the SBOM Workspace if the following conditions are met: The Reopen AVITs if detected (sn_sbom_resp.reopen_avits_if_detected) system property is activated. This system property is activated by default. The AVIT with the associated vulnerability is detected again by a third-party integration's vulnerability scans or the component with the vulnerability is part of a subsequent SBOM upload. The substate of the Closed AVIT is not one of the following: Mitigation Control in Place, Not Affected, or False Positive. AVITs with these substates are not reopened by the system property. Deactivate the system property only if you do not want Closed AVITs to reopen automatically. Reevaluate the remediation properties for application vulnerable items in the Vulnerability Manager Workspace Select the application vulnerable items conditionally for reevaluating the following remediation properties in the Vulnerability Manager Workspace: Assignments Remediation tasks Remediation target date Exceptions (Vulnerability Response v24.0.6) Risk score Software Bill of Materials enhancements for CycloneDX SBOM files The following enhancements were made to support SBOM files in CycloneDX format: Import additional information in CycloneDX SBOM files with the (sn_sbom_core.collect_properties) property. This property is deactivated by default. Activate the property to import information that is generally not supported. Any information imported from these properties is uploaded to the SBOM Component Property [sn_sbom_comp_property] table for the following: Uploaded SBOM files Metadata Individual vulnerabilities Components View imported component data for declared and concluded licenses for SBOM files in versions 1.4 and later of CycloneDX in two new license fields: Declared Concluded SBOM parsing support is enhanced for the following CycloneDX versions and component types: Version 1.5: Platform, Data, Device driver, Machine Learning model Version 1.6: Cryptographic Enhancements to SBOM Response for PaCE The Policy as Code Engine (PaCE) application is available for SBOM Response. Determine if components are stale or abandoned with the Run PaCE policies for SBOM Response scheduled job. The scheduled job is deactivated by default. View components that are identified as stale or abandoned as Non-compliant in the PaCE interface that is available in the SBOM Workspace. Upload SBOM files to the ServiceNow AI Platform® from your GitHub repositories Determine if SBOM files generated in your CI/CD (continuous integration and continuous delivery/deployment) pipelines have been successfully queued in your ServiceNow AI Platform instance. Protect your environments from potentially harmful components during software development cycles with GitHub Actions that you initiate from your GitHub environment. Obtain any required GitHub Actions for SBOM upload in the GitHub Marketplace. Enhancements to Bill of Materials records for the Veracode Vulnerability Integration Veracode is mapped to the Source field for records in the Bill of Materials [sn_sbom_doc] table for the Veracode SBOM files that you upload. Remediation Task Rules for Container Vulnerability Response Define and group container vulnerable items automatically based on the remediation task rules. GitHub Secrets Scanning Ingest secrets detected in your organization’s code along with the application security testing results, enabling ease of accessibility for developers to mitigate these results. Enhanced processing performance of scheduled job The Rollup application vulnerable item values to vulnerability and group scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task. Quick Start Tests for Application Vulnerability Response After upgrades and deployments of new applications or integrations, run quick start tests to verify that Application Vulnerability Response works as expected. If you customized Application Vulnerability Response, copy the quick start tests and configure them for your customizations. Set the Veracode integration to update SCA findings You can select the scan that takes precedence for the final updates for SCA findings data imported from Veracode. On the Veracode configuration page, ‘Default’ is the set value until you change it. You must select the Include SCA findings check box and choose one from the list: Agent – the agent scan results make the final updates to SCA finding Upload – the upload scan results make the final updates to SCA finding Default – the last scan processed, either the agent or upload scan, makes the final updates to SCA findings Note: If you do not select the Include SCA findings check box on the configuration page, the scan you selected from the list is not used, and the last scan that is processed makes the final updates. Add and delete support for applications in Veracode imported from the ServiceNow AI Platform Set the value for the [sn-vul-veracode.app-mark-unseen-apps-inactive] system property to ‘true’ to prevent errors if the Platform requests applications already deleted by Veracode. If this property is set to ‘true’ (activated), the successful import of the Application List Integration marks any unseen applications in the Platform as ‘inactive’. Application Penetration testing enhancements New workspace that permits you to use the penetration testing workflow in the Next Experience UI. Alignment of penetration testing for mobile application security with the recognized standards of the Mobile Application Security Verification Standard (MASVS) via a questionnaire in the penetration testing workflow.
Yokohama	Enhancements to Application Vulnerability Response The Unassign workflow is supported for application vulnerable items (AVITs) and remediation tasks (AVULs). Streamline application vulnerability assignments with the Unassign UI action from the more actions menu on an AVIT. Reassign incorrectly assigned AVITs, clarify ownership for reassessment, and maintain accurate triage records in workspace views. You have the option to send unassign requests for approval prior to clearing the Assigned to and Assignment group fields on records. SBOM document upload via Github Action Upload valid Software Bill of Material (SBOM) documents to ServiceNow platform with the help of GitHub Action. Create application remediation tasks manually in the Vulnerability Manager Workspace With the sn_vul.app_sec_manager role, you can create application remediation tasks manually by selecting some or all the records in the Application vulnerable items’ lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. Create application remediation tasks manually in the IT Remediation Workspace With the sn_vul.app_security_champion role, you can create application remediation tasks manually by selecting desired records in the Application vulnerable items’ lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating application remediation tasks. Manual Ingestion of vulnerabilities for application vulnerability response Import AVITs from external sources via a standardised template (e.g., CSV, Excel) and manage Penetration test findings lifecycle. Now, you can ingest vulnerability data, including details such as affected application, vulnerability description, severity, remediation recommendations, including other necessary details. This enhancement allows you to simplifies the process of consolidating vulnerability data from diverse sources into a centralised Penetration test workspace. Penetration Test Workspace Monitor your penetration test requests and findings as well as your team's overall progress in the Penetration Test Workspace. Prioritize tests that need your attention, track findings, and view assignments with the following data visualizations on the dashboard: Important items. Penetration test requests that are critical and by state. Reported findings. Overall remediation progress based on assignment. Enhancements to Penetration Test Assessment Requests Along with Full Penetration, Focused, and Re-test, the following assessment types are included for Penetration Test Assessment Requests forms in the Penetration Test Workspace: Emergency Release - Supports emergency releases that are required for rapid software updates to address critical issues like security vulnerabilities. Bug Bounty Program - Rewards ethical hackers to find and report security vulnerabilities. Release Approvals - Ensure that all necessary checks are completed before deploying new software. One-off reviews - Assess specific projects outside regular development and release cycles to evaluate performance and implement improvements. Executive Interest - Report on senior management's engagement and support for critical projects within the organization. Enhancements to the Release Approval and Release Notes fields help you ensure quality and security for your pen test findings. The following states have been added to the Release approval field: Not Applicable (Default). Approved. Denied. You can add details to justify your release approvals in the Release notes field. Associate CWEs for manual AVIT creation from Penetration Test Assessment Requests On the Penetration test findings tab on Penetration Test Assessment Requests, you have the option to associate Common Weakness Enumerations (CWE)s or Common Vulnerabilities and Exposures (CVE)s in the Vulnerability field for manually created AVITs. Create change requests in Application Vulnerability Response Users with the sn_vul.app_sec_manager and sn_vul.app_sec_champion roles as well as users with the sn_vul.app_developer role who have the ITIL role can create change requests from remediation tasks in the Application Vulnerability Response application. Create change requests to expedite your investigation for application vulnerabilities (AVIT)s that require manual intervention. Create change requests with prepopulated information for scanned applications that are classified as configuration items (CI)s. The change request workflow in Application Vulnerability Response is similar to the workflow supported in Vulnerability Response. For more information about the Vulnerability Response change request workflow, see Change management for Vulnerability Response. Note: Change requests are supported for Application Vulnerability Response only if the discovered application is associated with a configuration item (CI). You must set Product model to False in the Use Product Model [sn_vul.use_product_model] system property to associate a discovered application with a CI. Enhancements to the Software Bill of Materials Workspace You can delete multiple BOM entity records and their related components with bulk edit from the Software Bill of Materials SBOM SBOM Workspace. Any Application Vulnerable Items (AVIT)s that are associated with deleted BOM entities automatically transition to Closed. View risk score details of a vulnerable items in the Work notes section Starting with v25.0.3 of Application Vulnerability Response, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of an application vulnerable item in the Work notes section. Additionally, the work notes are updated only if there’s a change in the risk score.

Changes

Between your current release family and Yokohama, some changes were made to existing Application Vulnerability Response features.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Removed

Between your current release family and Yokohama, some Application Vulnerability Response features or functionality were removed.

Release	Release notes
Xanadu	The Close button has been removed for a remediation task in the classic UI, Vulnerability Manager Workspace, and IT Remediation Workspace.
Yokohama	No updates for this release.

Deprecations

Between your current release family and Yokohama, some Application Vulnerability Response features or functionality were deprecated.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Activation information

Review information on how to activate Application Vulnerability Response.

Release	Release notes
Xanadu	Install Application Vulnerability Response by requesting it from the ServiceNow Store. Application Vulnerability Response is included as a part of the Vulnerability Response application. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Yokohama	Install Application Vulnerability Response by requesting it from the ServiceNow Store. Application Vulnerability Response is included as a part of the Vulnerability Response application. The Software Bill of Materials applications require a separate subscription. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Additional requirements

If any additional requirements were introduced or changed for Application Vulnerability Response we have noted them here.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Application Vulnerability Response we have noted them here.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Accessibility information

Review details on accessibility information for Application Vulnerability Response, such as specific requirements or compliance levels.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Localization information

If there are specific localization considerations for Application Vulnerability Response we have noted them here.

Release	Release notes
Xanadu	No updates for this release.
Yokohama	No updates for this release.

Highlight information

If there are specific highlight considerations for Application Vulnerability Response we have noted them here.

Release	Release notes
Xanadu	Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. Integrate with supported third-party scanners to import vulnerability data. Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. Prioritize, remediate, and manage application vulnerable items (AVI)s. Each application vulnerability represents a vulnerability entry in the CWE or third-party libraries. Identify the components used in your organization's applications and determine your potential exposure to risks associated with using open-source software from Software Bill of Materials (SBOM) files that you upload into your instance. See Application Vulnerability Response for more information.
Yokohama	Monitor your penetration test requests and findings, as well as your team's overall progress in the Penetration Test Workspace. Reevaluate the risk score, assignments, remediation target date, exceptions, and remediation task for a specific set of application vulnerable items in the Vulnerability Manager Workspace. Integrate with supported third-party scanners to import vulnerability data. Compare application vulnerability-related data and determine if application vulnerabilities are found in an application. Prioritize, remediate, and manage application vulnerable items (AVIT)s. Each application vulnerability represents a vulnerability entry in the Common Weakness Enumeration (CWE) or third-party libraries. With the sn_vul.app_sec_manager role, create application remediation tasks manually in the Vulnerability Manager Workspace. With the sn_vul.app_security_champion role, create application remediation tasks manually in the IT Remediation Workspace. See Application Vulnerability Response for more information.