Vulnerability Management (PA) dashboard

Track the volume, performance and progress of vulnerabilities from initial analysis and detection to containment, or remediation. You can filter reports by assignment group, exploits, risk rating, or state, for example. Quickly gain insight into your vulnerability exposure and which business services are affected.

Required ServiceNow AI Platform roles

Role required: sn_vul.vulnerability_admin, sn_vul.vulnerability_analyst, and users with sn_vul.vulnerability_read (or who inherit the sn_vul.vulnerability_read role), and pa_viewer.

Use cases

For examples of how different people in your organization would use this dashboard, see these use cases.

To view the Vulnerability Management (PA) dashboard, navigate to Vulnerability Response > Overview.

See reports that show trending data over time. Reports with real-time data are listed below. View trends of important metrics on a regular schedule to analyze your overall business processes and identify areas of improvement.

For more information about how to view your PA reports with real-time scores, see View Performance Analytics for Vulnerability Response [PA] reports in real time.

The Vulnerability Management [PA] dashboard tabs

This dashboard communicates KPIs for vulnerability risk and prevalence, affected assets, remediation target adherence, and remediation progress.

On the Overview tab, you can view the Critical Vulnerable Items by Assignment Group report that is run based on the scheduled job.

This dashboard exposes vulnerability risk at the business service level. Sharing this information across the organization can assist service managers to remediate vulnerabilities promptly and proactively, and drive the organization toward a shared responsibility model of information security.

You can change the service class to technical or application services using the system property sn_vul.service_classifications.

This dashboard aggregates the vulnerability risk from the business service level to the service owners — the executives responsible for those business services. It shows which executives are assuming the most vulnerability risk and which may require the most help encouraging prompt remediation activities.

This dashboard shows the scope and composition of CIs with active vulnerabilities, and which categories of CIs need the most attention. Identify decommissioned assets with active vulnerable items and confirm that the assets have been decommissioned. View the number of vulnerable CIs that lack ownership information, so that you can proactively identify owners for these assets before a critical vulnerability affects those systems.

On the Vulnerable CIs tab, you can view the Vulnerable CIs Without Owners and Retired or Stolen CIs with Active VIs reports in real-time.

This dashboard help you understand where your organization is taking risk due to potentially excessive deferrals and reconsider remediation options.

You can view Deferred Vulnerable Items by Reason, Expiring Deferral Requests, Exceptions for Critical Vulnerable Items by Assignment Group, and Exception Requests by Requester reports.

This dashboard helps you understand the progress of your remediation actions, and which support teams need the most assistance with their completion.

On the Remediation tab, you can view Unassigned Vulnerable Items report in real-time.

Indicators

• Vulnerability Response indicators

  There are a number of indicators used to measure and track the progress of your vulnerability remediation in the Vulnerability Response application.

  The collect records option for the indicators is disabled by default for the Vulnerability Response application. This option is disabled so that certain reports can be viewed in real-time. Trending information used by these indicators is still available if you prefer to enable collect records manually and view the records that make up the scores.

• Distinct Vulnerabilities

  Distinct Vulnerabilities with count_active_vi > 0. Goal is to minimize.

• Non-Deferred Overdue Critical Vulnerable Items

  It is the count on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• % Vulnerable Items Met Remediation Target

  ([[Closed Vulnerable Items > Remediation Target = Target Met]] / [[Closed Vulnerable Items]]) * 100. Goal is to maximize.

• Unassigned Vulnerable Items

  All active Vulnerable Items where both the Assignment Group and Assigned To fields are empty. Goal is to minimize.

• Critical Vulnerable Items (Services)

  It is the count on data source Active VIs (Services), which is using the table: sn_vul_analytics_business_services_vi. Goal is to minimize.

• High Overdue Vulnerable Items (Services)

  It is the count on data source Active VIs (Services), which is using the table: sn_vul_analytics_business_services_vi. Goal is to minimize.

• Unassigned Remediation Tasks

  All active remediation tasks where both the Assignment Group and Assigned To fields are empty. Goal is to minimize.

• Critical Vulnerable Items

  It is the count on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Vulnerable Items

  It is the count on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• New Vulnerable Items

  It is the count on data source VI.New, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Vulnerable Configuration Items

  It is the count distinct on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Summed Duration of Closed Vulnerable Items

  It is the sum on data source VI.Closed, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Non-Deferred Remediation Tasks

  It is the count on data source VG.Active, which is using the table: sn_vul_vulnerability. Goal is to minimize.

• Vulnerable Item Mean Time to Remediate

  [[Summed Duration of Closed Vulnerable Items]] / [[Closed Vulnerable Items]]

• Critical Overdue Vulnerable Items (Services)

  It is the count on data source Active VIs (Services), which is using the table: sn_vul_analytics_business_services_vi. Goal is to minimize.

• Retired Configuration Items

  It is the count distinct on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Deferral Requests

  It is the count on data source Active Deferral Requests, which is using the table: sn_vul_change_approval. Goal is to minimize.

• Vulnerable Items by Configuration Items

  It is the count on data source CIs with Active VIs, which is using the table: sn_vul_analytics_vi_ci_class. Goal is to minimize.

• Closed Vulnerable Items

  Closed Vulnerable Items is measured daily as unit #. The goal is to maximize.

• Unmatched Configuration Items

  Lists the hosts discovered by 3rd party vulnerability scanners that don't match any existing CIs in the CMDB.

• Non-Deferred Overdue Critical Remediation Tasks

  It is the count on data source VG.Active, which is using the table: sn_vul_vulnerability. Goal is to minimize.

• Vulnerable Configuration Items Without Support Group

  It is the count on data source VI.Open, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Non-Deferred Critical Remediation Tasks

  It is the count on data source VG.Active, which is using the table: sn_vul_vulnerability. Goal is to minimize.

• Deferred Vulnerable Items

  It is the count on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• High Vulnerable Items (Services)

  It is the count on data source Active VIs (Services), which is using the table: sn_vul_analytics_business_services_vi. Goal is to minimize.

• Distinct Configuration Items with Active Vulnerable Items

  It is the count distinct on data source CIs with Active VIs, which is using the table: sn_vul_analytics_vi_ci_class. Goal is to minimize.

• Average Number of Vulnerable Items per Configuration Item

  [[Active Vulnerable Items]] / [[Vulnerable CIs]]. Goal is to minimize.

• Remediation Tasks

  It is the count on data source VG.Active, which is using the table: sn_vul_vulnerability. Goal is to minimize.

• Critical Deferred Vulnerable Items

  It is the count on data source VI.Active, which is using the table: sn_vul_vulnerable_item. Goal is to minimize.

• Deferral Requests (created)

  It is the count on data source Closed.Requests, which is using the table: sn_vul_change_approval. Goal is to minimize.

Breakdowns

The following breakdown names apply to the indicators on the dashboard:

• Age
• Age Closed
• Assignment Group
• CI Class
• CI Manager
• Deferral Age
• Deferral Reason
• Exception Requesters
• Exploit Attack Vector
• Exploit Exists
• Exploit Skill Level
• Remediation Target Rule
• Remediation Target Status
• Remediation Target Status (Closed)
• Risk Rating
• Service
• Service Criticality
• Service Owner
• Severity
• State

Note: Customizing the Age and Age closed calculation for vulnerable items (VIs) may lead to a sharp rise or drop in the Performance Analytics (PA) reports that include these metrics. For more information on how to customize the calculation of Age and Age closed for VIs, see the KB1703270 KB article.

Breakdown source

• Assignment Group: Applies to VI or and RT reports
• Exploit Exists: Applies to VI reports.
• Exploit Attack Vector: Applies to VI reports.
• Exploit Skill Level: Applies to VI reports.
• Remediation Target Status: Applies to VI and RT reports.
• Risk Rating: Applies to VI and RT reports.
• State: Applies to VI and RT reports.

Data visualizations

|Vulnerable Items (VIs) by CI Class|Treemap

|Average Vulnerable Items per CI|Bar

|Unmatched CIs|Single Score

|Vulnerable CIs Without Support Group|Single Score

|Retired or Stolen CIs with Active VIs|Single Score