Understanding vulnerability groups

Vulnerability groups represent a set of vulnerable items to remediate. Grouping vulnerable items has many advantages. You can move vulnerable items through the remediation states, mark them under investigation, defer them, mark them resolved in bulk by using groups. You can create conditions to automatically group all items with specified vulnerabilities, departments, locations, and any other data related to the vulnerable item. Vulnerable items can belong to more than one vulnerability group giving you the flexibility to actively work with one group and monitor another. It all depends on your organizational needs. For example, you could group by department, and also create a group containing all currently exploitable vulnerabilities.

From a vulnerability group, the group of vulnerable items may be assigned to a user, deferred until later, used to create a Change Request, and so on.

Starting with version 10.0, when a group is formed based on a specific vulnerability, that vulnerability is listed on the VG form.

When it is determined that a new vulnerable item can be added to a group, the vulnerability item is included in the Vulnerable Items list of the vulnerability group. Conversely, the vulnerability group appears in the Vulnerability Group list of Vulnerable Items.

When updating the state of a vulnerability group, associated vulnerable items can have their state updated to match this vulnerability group. See Vulnerability group and vulnerable item states for more information on state changes.

You can create security incidents and change requests from vulnerability groups, as needed.

Refreshing vulnerable items automatically

When the Automatically refresh vulnerable items check box is selected, new VIs matching the vulnerability group filter criteria are automatically added to the group. Vulnerable items in the group that no longer match the filter criteria are automatically removed from the group.

By default, when the group leaves the Open state, the check box is cleared. If you want vulnerable items to continue being added to the group, regardless of state, disable the Set auto refresh vulnerable items business rule.

Refreshing vulnerable items manually

For manually created vulnerability groups with a Filter Group or Condition filter, when you click the Re-scan vulnerable items related link on the Vulnerability Group page, any vulnerable items that match the filter criteria are added. Items no longer matching the criteria are removed. This action allows an immediate update of the list of vulnerable items and is used whether the Automatically refresh vulnerable item check box is selected or not.

Manually created vulnerability groups using Condition or Filter Group filter types are refreshed once an hour.

Understanding vulnerability group rules

For example, you can group your vulnerable items by the cost center of the vulnerable CI, or by the attack vector of the vulnerability. You can have one group rule for low severity vulnerabilities or low risk CIs. You can have another group rule for critical servers, and vulnerabilities with exploits — vulnerable items that expose the company to more risk.

A different set of rules can be used for vulnerable items that expose the company to more risk. The VGR name is appended to the VGR Group by values to make the short description of the new vulnerability group. See Create a Vulnerability Response group for more information on available fields.

When a new vulnerable item is created, imported, or reopened after being closed, the vulnerability rules are evaluated against it. A VI is only evaluated once, automatically, unless it is reopened after being closed or the rules are reapplied manually.

The following process is used for each new or reopened VI:

More than one VGR can be defined, to group different kinds of vulnerabilities. Since each vulnerability is compared with the VGR conditions before putting it in a group, too many rules may have a performance impact.

By default, VGRs use the assignment group set by the Assignment Rules on the vulnerable item when grouping the items, and assigns the vulnerability group to match the vulnerable items.

As part of the default group rule, the assignment of these vulnerability groups is controlled by the rules in the Assignment Rules module. For more information on assignment rules, see Vulnerability Response assignment rules overview.

When a group rule is deleted, from the form or list view, you have the option to delete all Open groups created by that rule. Groups not in the Open are excluded.

Reapplying vulnerability group rules

When you want to change a vulnerability group rule, use the Reapply button on the vulnerability group rule page to rerun the changed rule on all active Open vulnerability groups created by that rule. It deletes and recreates vulnerability groups based on the changed rule automatically.