Associate a remediation task to an existing change request

As a Appsec Manager or Security Champion, avoid creating duplicate change requests (CHG) as you work to resolve your remediation tasks by associating a remediation task (APP-VUL) to a change request that is already available in your instance.

Before you begin

Roles required:

From Vulnerability Manager Manager Workspace: sn_vul.app_sec_manager.

From ITRem Owner workspace: sn_vul.app_sec_champion or sn_vul.app_developer, and itil role.

About this task

As a remediation owner, you can associate remediation tasks that are assigned to you or your assignment group to existing change requests directly from the remediation task records. The following image illustrates the basic flow for associating a change request to an existing APP-VUL (VG).

Note:

You can associate an existing change request to a APP-VUL in any state (Open, Under Investigation, Awaiting Implementation, Closed, and Deferred). When you associate a change request to an existing VUL, only the active VIs are added to the change request.

Before you begin, to avoid creating duplicate change requests, you might prefer to view any existing change requests already associated with a APP-VUL. To easily track the number of change requests that are related to a specific APP-VUL, refer to the CR count column on the Remediation Tasks list. If not displayed, click the settings icon () in the upper right. Move the CR count column from Available to Selected and click OK.

To automatically populate the new column, for customers with existing data in this table, run the scheduled job: Populate new CR Count Column.

Procedure

1. To associate a remediation task to an existing change request, navigate to All > Application Vulnerability Response > Remediation Tasks.
2. Locate the remediation task you are working with.
3. Optional: Navigate to All > Application Vulnerability Response > Remediation Overview to view the Remediation Overview dashboard and locate a APP-VUL assigned to you or your assignment group.
4. In the Number column, click a APP-VUL record to open it.
   The APP-VUL record is displayed.
5. With the open record displayed, if not already displayed, scroll to the Change Requests related list and select it.
   Any change requests associated with the APP-VUL are displayed along with the Add button. In the following figure, there are no change requests already associated with this APP-VUL.
6. To associate the APP-VUL with an existing CHG, click Add.
   The Add Existing Change Request to Remediation Task form is displayed.
7. In the form, click the search icon.
   A list view of existing change requests is displayed in a new window as shown in the following figure.
8. Select an item from the displayed list, or, alternatively, click the filter () and enter conditions to limit your search results.
9. For the Add CIs to CR check box, choose one to continue.
   Note:

   This check box is displayed only for existing change requests in the New state.

   Table 1.

   Option	Description
   Add CIs to CR check box selected	Default is selected. If the check box is selected, any configuration items (CI) that belong to active vulnerable items in this remediation task are added to this change request. When selected, the state of the change request is synched to the APP-VUL. For more information, see State synchronization between change requests and remediation tasks.
   Add CIs to CR check box cleared	Clear the check box if you do not want the CIs from the active vulnerable items from this remediation task added to the new change request. When disabled, the state of the change request is not synched to the APP-VUL, and the APP-VUL remains in its current state.

10. With the change request number you want displayed in the Search for Change Request field, click Submit.
    The APP-VUL is displayed. At the top of the record, the blue confirmation message is displayed indicating that the change request you selected is successfully associated to the APP-VUL.

    Note:

    For a APP-VUL in the Open state with the Assignment group and Assigned to fields unassigned (empty), the current logged-on user is automatically assigned to the APP-VUL after you click Add. In addition, the Add CIs to CR check box must be selected. At the top of the APP-VUL, a blue confirmation message is displayed that indicates that the current user is assigned.

What to do next

Review the APP-VUL record. In the Change Request column on the Change Requests related list, click link for the new CHG to view CR record. On the open CHG record, you can monitor the state of the change request. The affected configuration items (CI)s and the remediation tasks are displayed on the Affected CIs and remediation tasks related lists.