--- sourceDocument: Yokohama Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Creating rules for application vulnerable items in the Software Bill of Materials Workspace # Creating rules for application vulnerable items in the Software Bill of Materials Workspace {#ariaid-title1} * Release version: Yokohama * * Updated January 30, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Creating rules for application vulnerable items in the Software Bill of Materials Workspace To manage application vulnerable items (AVITs) effectively in the Software Bill of Materials (SBOM) Workspace, you must first create rules that define when AVITs are generated. AVITs represent vulnerabilities linked to third-party components within your applications, helping you assess and maintain application integrity. This capability requires both the SBOM Response and Vulnerability Response applications to be installed and activated. Show full answer Show less ## Key Features * **AVIT Creation Rules:** Users with the `snsbomresp.manageavirule` role can define rules that automatically create AVITs when imported SBOM data matches specified conditions, enabling proactive vulnerability tracking. * **Viewing and Tracking AVITs:** AVITs created in the SBOM Workspace can be viewed alongside other vulnerable items in the Vulnerability Manager Workspace, with options to filter specifically for SBOM AVITs using defined conditions. * **Integration with Known Vulnerability Lists:** AVITs can be assigned remediation tasks based on recommendations from authoritative sources like the National Vulnerability Database (NVD). * **Automated Remediation Workflow:** Remediation tasks (AVULs) are automatically created and assigned according to your configured assignment and remediation task rules, streamlining vulnerability resolution. * **Reopening Closed AVITs:** Closed AVITs can reopen automatically if the vulnerability is detected again through scans or subsequent SBOM uploads, unless specific substates or system properties prevent reopening. ## Practical Application for ServiceNow Customers By setting up AVIT creation rules in the SBOM Workspace, you enable your instance to detect and track vulnerabilities in third-party components automatically. This setup allows for centralized visibility and management of application vulnerabilities, supporting efficient remediation through integrated workflows in the Vulnerability Manager Workspace. Automatic reopening of AVITs ensures ongoing vigilance for recurring vulnerabilities, while integration with known vulnerability databases and customizable assignment rules help prioritize and streamline remediation efforts. Ensure the `snsbomresp.reopenavitsifdetected` system property remains activated if you want the system to reopen relevant AVITs automatically, supporting continuous risk monitoring. Before you can see application vulnerable items (AVITs) in the Software Bill of Materials (SBOM) Workspace, you must set up the conditions under which AVITs are created. ## AVITs in the SBOM Workspace {#vr-sbom-config-sbom-response__section_djm_b1z_yxb} If you've installed and activated the SBOM Response application, AVITs are created for SBOM files if any of the imported data matches the conditions of your existing AVIT creation rules. The SBOM Response and Vulnerability Response applications are required to set up rules for creating application vulnerable items (AVITs) automatically and remediating them with the Application Vulnerability Response workflow. See [Exploring Software Bill of Materials](https://www.servicenow.com/docs/prNIE5vlBZS39JUHt~U2ew "Identify the components used in your organization's applications from Software Bill of Materials (SBOM) files you upload into your instance. Understand any risks associated with using open-source software to help you determine your potential exposure, view license compliance, and fix vulnerabilities.") for more information. As a user with the sn_sbom_resp.manage_avi_rule role, you must add AVIT creation rules in the SBOM Workspace before you can create AVITs for the vulnerabilities that are found in your ingested SBOM data. AVITs enable you to evaluate the integrity of the third-party components in your applications. An AVIT is created in your instance when an application is matched to a component that has an associated vulnerability. In the SBOM Workspace, you can view only SBOM AVITs. However You can view SBOM AVITs along with other types of vulnerable items in the Vulnerability Manager Workspace in Vulnerability Response. You can view all the AVITs that have been created in the SBOM Workspace in the List Module. The list module also includes all the NVD and CWE entries and Application Vulnerabilities. You can also assign AVITs for remediation based on recommendations from known vulnerability lists such as the National Vulnerability Database (NVD). A scheduled job is triggered, and if the conditions of your creation rules match the ingested data, AVITs are created. You can track and remediate AVITs by setting up customized rules. See [Create an application vulnerable item rule in the Software Bill of Materials Workspace](https://www.servicenow.com/docs/V58VE8Vzyn2abPxEt8ULEw "Set up the conditions under which application vulnerable items (AVITs) are created automatically in the AVI Creation Rules module in the Software Bill of Materials (SBOM) Workspace.") for information about how to create a rule. ## SBOM AVITs in Vulnerability Manager Workspace in Vulnerability Response You can view any SBOM AVITs that are created in the SBOM Workspace in the Vulnerability Manager Workspace if you have access to it. Note: To view only SBOM AVITs from the Application Vulnerable Items list in the Vulnerability Manager Workspace rather than all AVITs, set the condition \[Source\] \[is\] \[SBOM\] AND \[Scan type\] \[is\] \[SBOM-SCA\] on the Application Vulnerable Items \[sn_vul_app_vulnerable_item\] table. To view the table, navigate in your instance to All and enter sn_vul_app_vulnerable_item.list in the filter navigator. For more information about the Vulnerability Manager Workspace, how to view watch topics, application remediation efforts, and application remediation task rules for AVITs that are configured from the Vulnerability Response application in the Vulnerability Manager Workspace, see [Use watch topics in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/dVvIm8DTz9AasZGjE2sTkw "Use watch topics in the Vulnerability Manager Workspace to view vulnerabilities and misconfigurations that are filtered from your imported data from the criteria that you set. Use this information to determine how the vulnerabilities and misconfigurations in each watch topic can impact your environment."). Remediation tasks (AVULs) are created from AVITs and assigned automatically to groups for remediation based on your assignment rules. For more information about how to create these rules, see the following topics: * [Create or edit Vulnerability Response assignment rules](https://www.servicenow.com/docs/GlO3nQhUlSKJUl4iWsDYQQ "After you complete your initial assessment of assignment rules using Setup Assistant, you can create rules to automatically assign vulnerable items based on filter conditions. These rules assign vulnerable items as they are imported or manually created.") * [Create or edit Vulnerability Response remediation task rules](https://www.servicenow.com/docs/Qaxt9UP1e2bVWy_nzPEcIA "After you complete your initial assessment of remediation task rules using Setup Assistant, you can create rules to automatically group vulnerable items based on filter conditions. These rules automatically group vulnerable items as they are imported or manually created. Use the filter to limit the vulnerable items grouped by this rule, such as selecting all vulnerable items with exploits.") and [Create a remediation effort in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/qeFLgYQHV~ZSkuWVfkUiPQ "A remediation effort record is a static list of records that you create from a watch topic in the Vulnerability Manager Workspace."). {#vr-sbom-config-sbom-response__ul_ob5_3xy_yxb} ## Reopening application vulnerable items in SBOM Response {#vr-sbom-config-sbom-response__section_sty_t1s_tcc} A Closed application vulnerable item (AVIT) for a component with an associated vulnerability is re-opened automatically and visible in the SBOM Workspace if the following conditions exist: * The AVIT with the associated vulnerability is detected again by a third-party integration's vulnerability scans or the component with the vulnerability is part of a subsequent SBOM upload. * You have not deactivated the Reopen AVITs if detected (sn_sbom_resp.reopen_avits_if_detected) system property. This system property is activated by default. * The substate of the Closed AVIT is not one of the following: Mitigation Control in Place, Not Affected, or False Positive. AVITs with these substates are not reopened by the system property. {#vr-sbom-config-sbom-response__ul_k2z_r1s_tcc} Deactivate this system property only if you do not want Closed AVITs to reopen automatically.