• Key Performance Metrics (KPIs) for vulnerability remediation
• Highlights for areas in the business that have the highest risk
• Recommended actions to lower risk

The NVD integrations prior to v 13.0 of Vulnerability Response have been deprecated.

• Reapply the CI matching rules on discovered items with unmatched CI states on-demand.
• Reapply CI lookup rules on selected discovered items.
• The following updates occur if the link between a discovered item and a CI is changed after reapplying the lookup rules:
  • Open vulnerability detections are updated.
  • Corresponding VI-CI associations are updated for active VIs.
  • Assignment rules, group rules, risk scores, risk ratings, and remediation targets are reevaluated.
  • Discovered item status is updated accordingly. For example, discovered item status changes from Unmatched to Matched

• Assignment rules
• Group rules
• Remediation target rules
• Vulnerability calculators

• Agile Development Status
• Vulnerability Summary
• Vulnerability Explanation
• Recommendation

With Vulnerability Assignment Recommendations, view a short list of the most appropriate assignees for vulnerable items and vulnerability groups along with confidence scores for each recommendation. Reduce the time you spend chasing down ownership issues across your organization as you discover vulnerabilities and are unsure where they need to go for remediation. Vulnerability Assignment Recommendations is available with a separate subscription from the ServiceNow® Store.

The CMDB CI Class Models app dependency for this feature is installed automatically with Vulnerability Response and may take some time to install.

Import the flaws (vulnerabilities) resulting from Veracode Dynamic Application Security Testing (DAST) and prioritize and efficiently drive remediation of detected flaws from within the Vulnerability Response application. Imported flaws are automatically assigned to the right team with a risk score and a remediation target date based on the rules you define.

Imported vulnerabilities are further enriched with the CWE imported from MITRE.

Quickly gain insight into your security posture and remediation trends, and view applications with the most critical, overdue vulnerabilities with Scoreboard.

Application Vulnerability Response supports the ServiceNow Vulnerability Response Integration with Veracode.

• This feature is available starting with v 10.3 of Vulnerability Response and v 10.1 of Governance, Risk, and Compliance.
• Obtain better visibility about exceptions raised for vulnerabilities.
• Request policy exceptions for vulnerable items or vulnerability groups for a specific duration.
• Route requests through multiple approvals based on risk rating, policy, and control objective associated with an exception.

See Allow policy exception requests from other applications for more information.

• Critical and High Risk
• Exploitable
• Approaching Target
• Missed Target
• Within Past 90 Days
• Older than 90 Days
• Ungrouped
• All

New indexes have been added on the vulnerable items table to improve performance.

With auto-close stale vulnerable items, you have the option to automatically close older vulnerable items not recently detected by your third party integrations. Set a time period and choose if you want to close VIs by their last-found dates, or by dates when assets were last scanned.

After upgrades and deployments of new applications or integrations, run quick start tests to verify that Vulnerability Response still works. If you customized Vulnerability Response, copy the quick start tests and configure them for your customizations.

• Domain separation support for the Reapply Calculator feature.
• The App-Sec-Manager role has permission to cancel an Application Vulnerability Integration run.
• Performance enhancements for updates to the vulnerability entry rollup of the Vulnerability Rollup calculator.
• Domain separation support for the exception rule in Exception Management.
• The Reapply remediation target rule job works as expected when the BETWEEN operator is used in the Condition builder.
• False positive Until date validation works as expected.
• The Cancel Exception rule works as expected.
• Domain separation support for the auto-close VI feature.

For Qualys detections, if the scanner continues to find VIs that were set to Resolved but then not transitioned to Closed/Fixed by subsequent scans, these VIs move back to Open when the last found date is later than the Resolved date.

For Rapid7 detections, an option is now available on the Rapid7 configuration page in your instance to reopen resolved VIs by age. If enabled, VIs set to Resolved but then not transitioned to Closed/Fixed by subsequent scans transition back to Open after the number of days that you enter.

When enabled, (true), The Run separately attribute ensures that integrations of the same type that also have this flag enabled do not run simultaneously. Status is displayed in the Run separately column in the integrations list view.

For some third-party integrations, a series of integration runs is required to import requested data. For these types of chained integration runs, the Next integration column on the integrations List view displays the next integration scheduled to run in the series after the integration displayed in the Name column is successfully completed.