Approval recommendations using generative AI
Summarize
Summary of Approval recommendations using generative AI
The Approval Recommendation generative AI skill in ServiceNow's Zurich release helps approvers in Vulnerability Response handle exception and false positive approval requests more efficiently. This skill provides AI-driven recommendations to approve or reject these requests, aiming to speed up decision-making, ensure consistency, and reduce manual analysis.
Show less
Approvals are commonly needed for findings such as false positives or cases where remediation is deferred due to unavailable fixes. Users submit exception requests to either delay remediation or confirm a false positive, which can require multiple review levels and be time-consuming. This AI skill supports approvers by analyzing historical data, asset and vulnerability details, and other contextual information to provide well-informed recommendations with confidence scores and explanations.
Key features
- AI-driven approval recommendations: Provides approve/reject suggestions for exception and false positive requests.
- Confidence scoring and reasoning: Offers a confidence score and supporting rationale for each recommendation.
- Data sources used: Considers historical approval decisions, questionnaire responses (if enabled), comments from previous approval levels, general request details, and detailed asset and vulnerability metadata.
- Integration with approval records: Recommendations appear directly on Change Approval (CA) records, streamlining the approver’s workflow.
Data inputs and considerations
The AI skill analyzes multiple data tables and fields to generate recommendations, including:
- Historical approvals: Counts of past approvals or rejections for similar request types.
- Questionnaire responses: Remediation owner answers related to the exception request, if questionnaires are configured.
- Comments from prior approval stages: Justifications provided in earlier review levels.
- Request details: Risk rating, duration of exception, remediation status, assignment group, justification notes, work notes, request type, and any compensating controls.
- Asset and vulnerability details: Information about hosts, containers, applications, and configuration compliance, including business criticality, environment, vulnerability severity, CVSS scores, exploit status, and patch availability.
Benefits for ServiceNow customers
- Accelerates exception and false positive approval workflows by reducing manual effort.
- Improves decision consistency and accuracy by leveraging historical and contextual data.
- Helps approvers understand the rationale behind recommendations with detailed explanations and confidence scores.
- Integrates seamlessly into the Security Exposure Management Workspace, enhancing security operations efficiency.
Next steps
To utilize this capability, customers can invoke the generative AI skill within their approval processes to generate recommendations for exception and false positive requests. This integration supports more effective vulnerability and remediation management by enhancing the approval experience.
Learn more about the how the Approval Recommendation generative AI skill arrives at its approval recommendations and the sources it uses to generate them.
Overview for the Approval Recommendation skill
The Approval Recommendation generative AI skill provides exception and false positive approvers in Vulnerability Response with recommendations to help them make faster, more consistent decisions while reducing manual analysis effort.
A finding (vulnerable item) is a vulnerability detected on an asset. Some findings don't require immediate remediation, for example, false positives or cases where a fix isn't yet available. From these types of findings and remediation tasks, users submit exception requests and ask for approval to defer remediation or indicate that a finding is a false positive. Users can request to defer the remediation of a finding or remediation task for a specified period.
For example, an analyst might request a deferral for a finding that will be fixed with an upcoming patch that isn't currently available. A false positive might be a warning given by a scanner that is not actually an issue, for example, if a configuration item has been decommissioned but the scanner is still raising there is issue related to it.
- A recommendation to approve or reject the request.
- A confidence score.
- Supporting reasoning.
Sources and input parameters used for the recommendations
- See the following table for asset (configuration item) and vulnerability details.
- Historical Approval data - Count totals for how many times similar request types for false positives and deferrals from a finding type (VIT, CVIT, AVIT, CTR) have been approved or rejected on records on the Change Approval [sn_sec_exception_change_approval] table.
- Questionnaire responses (optional configuration) - If questionnaires are activated and available for exception requests, the questions and the remediation owner's answers are considered from records on the [sn_smart_asmt_question_instance] table. If questionnaires are not activated, this data is not considered.
- Comments (justifications) from previous approvals - If multiple approval levels are configured, comments provided by approvers at earlier levels on records on the Change Approval [sn_sec_exception_change_approval] table are considered when generating a recommendation at the next level.
- General request details - The following fields on records on the Change Approval [sn_sec_exception_change_approval] table are considered:
- Risk rating
- Until date (how long the exception is being requested for)
- Remediation status (in-flight, no target)
- Assignment group
- Reason / justification notes (why a request is submitted)
- Work notes
- Request type
- Compensating control (if available)
Asset and Vulnerability details
| Application | Source table | Description |
|---|---|---|
| Vulnerability Response (Host) | Configuration item (CI) [cmdb_ci] table records for Host assets | Total number of assets, business criticality, environment, internet-facing, and external-facing status. |
| Container Vulnerability Response (CVR) | Discovered Item (Container) [sn_vul_container_image] table records for Container assets | Total number of assets, business criticality, environment, internet-facing, and external-facing status status. |
| Application Vulnerability Response (AVR) | Discovered Item (Application) [sn_vul_app_release] records for Application Vulnerability Response | Total number of applications, business criticality, active/inactive status. |
| Configuration Compliance CC | Test Results [sn_vulc_result] table for Configuration Compliance | Total number of assets, business criticality, environment, internet-facing, and external-facing status status. |
| Application | Vulnerability details |
|---|---|
| Vulnerability Response (Host VR) | Total counts of vulnerabilities, normalized severity, CVSS scores, CISA exists, active exploit, preferred solution, EPSS percentile. |
| Container Vulnerability Response (CVR) | Total counts of container vulnerabilities, normalized severity, CVSS scores, CISA exists, active exploit, preferred solution, EPSS percentile. |
| Application Vulnerability Response (AVR) | Total counts of application vulnerabilities, normalized severity, CVSS scores, active exploit, preferred solution, EPSS percentile, and if threat exists. |
| Configuration Compliance (CC) | Test result data is used instead of vulnerability data. Total counts of tests, test source category, test subcategory, criticality, and technology. |
The Approval Recommendation generative AI skill provides its suggestions and is visible on approval request records (CA)s. For more information about how to invoke the agent and get the recommendations, see Generate approval recommendations with generative AI.