---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Triage vulnerabilities automatically

# Triage vulnerabilities automatically {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Triage vulnerabilities automatically

Automatically triaging vulnerabilities is essential for effective remediation in ServiceNow Vulnerability Response.
This process transforms imported vulnerabilities into actionable remediation tasks through automated assignment of vulnerable items (VIs), risk scoring, remediation target application, and grouping.
It streamlines prioritization, orchestration, and validation of remediation efforts to ensure vulnerabilities are addressed efficiently.
Show full answer Show less  

## Key Features

* **Automated Vulnerable Item Assignment:** Uses assignment rules to allocate VIs to appropriate teams, reducing manual workload. However, due to large data volumes, rule validation is critical to avoid misassignment.
* **CI Lookup and Grouping Rules:** Identify configuration items for VIs and group them into remediation tasks based on established rules. Ungrouped or unmatched items require manual review or rule refinement.
* **Risk Scoring:** Vulnerable items in remediation tasks can have risk scores revised using predefined calculators to prioritize remediation efforts effectively.
* **Remediation Target Rules:** Applied during VI import to define remediation goals and guide task creation. These rules are configured in the Setup Assistant.
* **Validation and Closing:** Older or undetected vulnerable items can be automatically closed to maintain data relevance. Rescanning and refreshing VIs help keep vulnerability data current.
* **Change Requests and Incident Integration:** Create Change Requests for remediation tasks and assign them to groups such as IT Operations. If Security Incident Response is enabled, remediation tasks can generate security incident records.

## Practical Steps for Customers

* Log in to your Vulnerability Response instance and verify that CI Lookup and Assignment rules function correctly.
* Validate remediation target rules to ensure accurate task creation aligned with organizational goals.
* Review ungrouped vulnerable items to identify rule gaps; adjust grouping rules or manually create remediation tasks as needed.
* Manually adjust risk scores for better prioritization where necessary.
* Close outdated vulnerable items no longer detected by integrations to focus on current risks.
* Research and determine remediation priorities based on risk, affected systems, and patch schedules.
* Create Change Requests to assign remediation tasks to the appropriate teams and update the task status to "Under Investigation."

## Benefits for ServiceNow Customers

This automated triage framework enables customers to efficiently manage high volumes of vulnerability data, prioritize remediation based on risk, and streamline collaboration between security and IT operations teams. It reduces manual effort, improves accuracy in vulnerability handling, and supports ongoing validation and closure of vulnerabilities to maintain a secure environment.  
Reviewing and triaging new vulnerabilities is necessary to ensure successful
remediation. Transform vulnerability imports into remediation tasks with automated vulnerable
item (VI) assignment, risk calculation, remediation targets, and VI grouping.

Starting with imported vulnerabilities, reconcile the assets not found in the CMDB,
prioritize the results, translate that to remediation activities that are automatically
assigned, orchestrate the remediation process, and confirm completion with a validation
scan.

New vulnerable items are usually sorted into remediation tasks upon import, based on
remediation tasks rules. Sometimes, vulnerable items cannot be grouped or do not contain a
recognized configuration item.  
An overview of the vulnerability triage process:

* Log in to your Vulnerability Response instance.
* Validate that your rules (CI Lookup, Assignment) for vulnerable item are working as expected. For information on revising CI Lookup Rules, see [CI lookup rules for identifying configuration items from Vulnerability Response third-party vulnerability integrations](https://www.servicenow.com/docs/V2zeM~heiH8M3xlmb0lGiA "When data is imported from a third-party integration, Vulnerability Response automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules are used to identify configuration items (CIs) and add them to the vulnerable item record to aid in remediation."). For information on Assignment rules, see [Vulnerability Response assignment rules overview](https://www.servicenow.com/docs/dPwJSkv0RtwDysGI8YEtOA "Define the criteria by which vulnerable items (VITs) are automatically assigned to an assignment group for remediation.").  
  Note:  
  Due to the large volume in data imports, care should be taken with automated vulnerable item assignment.
* Validate that your remediation targets are correct. See [Vulnerability Response remediation target rules](https://www.servicenow.com/docs/~mhLCqoODuWzL8ovKleZAg "Remediation target rules define the expected time frame for remediating vulnerable items (VI), much like SLAs provide a time frame for remediating the vulnerability itself. For example, if an asset contains PCI data (credit card data) then the vulnerability on that item must be fixed within 30 days according to PCI DSS.") for information on how remediation target rules work and how to revise them.
* [View ungrouped vulnerable
  items](https://www.servicenow.com/docs/SnftfnJmLQkARiW0mgwi6w "Vulnerable items that are not assigned to a group are placed in a viewable list.").
  * Looking at the ungrouped vulnerable items, consider revising your group rules and performing a rescan. See [Create or edit Vulnerability Response remediation task rules](https://www.servicenow.com/docs/dZaIsBkihCnzOQ1uNsHyag "After you complete your initial assessment of remediation task rules using Setup Assistant, you can create rules to automatically group vulnerable items based on filter conditions. These rules automatically group vulnerable items as they are imported or manually created. Use the filter to limit the vulnerable items grouped by this rule, such as selecting all vulnerable items with exploits.") for more information.
  * Manually group the vulnerable items. [Manually create a remediation task in Vulnerability Response](https://www.servicenow.com/docs/izhqPMAUewLZ7RLtVJsEjw "Creating a remediation task manually is done when you want to group vulnerable items by something other than the Remediation Task Rules criteria. For example, you can create tasks for a particular manager, or for active, new exploits, such as ransomware that include different vulnerabilities. You can also use it to group ungrouped vulnerable items.") for more information.
  * Revise risk scores for the vulnerable items in your remediation tasks. See [Vulnerability Response calculators and vulnerability calculator rules](https://www.servicenow.com/docs/9LxieqkTv4d8kuuh5JVPeg "Vulnerability calculators automate calculating initial values for the fields on vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.") for more information.
  * Close older vulnerable items not recently detected by your third-party integrations. See [Automatic closing of vulnerable items and detections](https://www.servicenow.com/docs/ocNiQE~jgIGPONRwR~BlHg "You can automatically close stale detections and vulnerable items (VIs) associated with retired CIs using the Auto-Close rules module.") for more information.
  {#vuln-automated-triage__ul_jgd_gfy_hdb}
* [View and reclassify unmatched configuration items](https://www.servicenow.com/docs/f8U~6w5zExLaDuqmsds02g "Configuration items (CIs) that are not found in the Configuration Management Database (CMDB) are placed in a viewable list of discovered items. This list offers a convenient way to reclassify unmatched CIs.").
* Research what needs to be done for remediation. This step can include:

  * Determine what to deal with now and what you can defer. This determination is often based on risk score, affected systems, and patches with change windows.  
    Note:  
    Remediation target rules belong to vulnerable items. These rules are run when the vulnerable item is imported. These rules were created previously in the Setup Assistant.
  * [Refresh vulnerable items](https://www.servicenow.com/docs/vdRVlI~yOPAqxUmcmlX2ag "The Update status related link is used to have vulnerable items inspected to see if there are any additional vulnerable items that belong to a remediation task. Use it if an update is warranted outside the scheduled job."), if necessary, and [View the remediation target status of a Vulnerability Response vulnerable item](https://www.servicenow.com/docs/3_fOcADhcP2tVh7iCUtkrQ "When a vulnerable item has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the vulnerable item record is updated with a status. This information can help the analyst proactively monitor upcoming remediation activities.").
  * Create a Change Request and assign the remediation task to an assignment group (IT Operations) for remediation.  
    Note:  
    If the vulnerability constitutes a security incident and the Security Incident Response plugin (com.snc.security_incident) is activated, you can create security incident records from the remediation tasks instead.
  * After submitting one or more change requests, move the group state to Under Investigation.
  {#vuln-automated-triage__ul_ayz_bmy_hdb}
{#vuln-automated-triage__ul_plz_dz2_ycb}