Viewing patch data for the Vulnerability Response patch orchestration integration with HCL BigFix

Release version: Washingtondc

Updated February 1, 2024

3 minutes to read

Summarize

Summarized using AI

Summary of Viewing Patch Data for the Vulnerability Response Patch Orchestration Integration with HCL BigFix

This document provides guidance on how to view patch data and vulnerability information within the Vulnerability Response Workspaces of ServiceNow, specifically for the integration with HCL BigFix. It outlines the roles required, the views available, and the types of data displayed on records.

Show full answer Show less

Key Features

Roles Required: Users need the snvulpatchorch.configurepatch role to configure and schedule patches, and snvulpatchorch.readpatch for read-only access to patch information.
Viewing Options: Patch information can be accessed in both the IT Remediation Workspace and the Vulnerability Manager Workspace via Home and List views.
Patch Update Records: These records include key data such as vulnerability solution details, remediation status, and associated devices.
Performance Analytics: Subscriptions include dashboards that display patch data, including scheduled and missing patches.

Key Outcomes

By utilizing the patch data viewing features, customers can:

Efficiently track and manage vulnerabilities through comprehensive patch information.
Schedule and monitor patch deployments to ensure timely remediation of vulnerabilities.
Access critical analytics and reports to assess patch coverage and effectiveness in the Vulnerability Management and CISO dashboards.

This integration facilitates enhanced visibility and control over vulnerability management processes, ultimately contributing to improved security posture and compliance.

Patch data and patch rollup data, as well as vulnerability information and remediation status of your vulnerabilities, are displayed on records in your instance.

Viewing patch data in the Vulnerability Response Workspaces

Roles required:

sn_vul_patch_orch.configure_patch role to configure and schedule patches
sn_vul_patch_orch.read_patch to view (read only) patch information on records. This role is inherited with the sn_vul.remediation_owner and sn_vuln.vulnerability_analyst roles that are required for the IT Remediation and Vulnerability Manager Workspaces

In the IT Remediation Workspace, you can view patches:

On the Home view, where you can click scorecards to view records for Preferred solutions on VIs, Vulnerable CIs, and Preferred Patches on VIs.
On the List view, where you can view all Patch Update records (VPUs) from the Patches links, and the vulnerable items (VITs) that are assigned to you that have patches.

You can schedule patches from the following records:

From Patch Update (VPU)
Remediation task (RT)
Discovered Item (SDI) records

In the Vulnerability Manager Workspace, you can view patches:

From the Home view on watch topics, where you can view preferred and potential patches, Patch scheduled dates, and, if the patch has been downloaded all on the Vulnerable Items tab.
From the List view on remediation efforts, where you can view patch data on VI records from theVulnerable Items tab.

From the classic environment view, navigate to All > Vulnerability Response > Patches.

Patch Update records in the VR Workspaces and in the classic environment view

Patch data and patch rollup data and status are displayed on records in your instance. Patch records are included as part of the patch orchestration feature of this integration with Vulnerability Response. View Patch (VPU) records in Vulnerability Response Workspaces from the List view in the IT Remediation Workspace. Patch Update records in both the classic view and Vulnerability Response Workspaces includes the following data:

Vulnerability solution data and information from patch vendors imported by the Vulnerability Solution Management application.
Source Remediation Status that includes the total number of devices that have the a given vulnerability that can be fixed by a patch and any devices that are missing updates.
Remediation Status that includes % of VIs remediated and the total VIs that have a patch as a preferred patch.
Associated Devices, Vulnerable Items, Patch Deployments and Patch Requests on the Related Links on records in the class view. This data is displayed on tabs on records in the Vulnerability Response Workspaces.
Patch Requests that remediation owners have submitted for approval.

State rollup on vulnerable item records

For more information about state rollup to records, see Patch data and state rollup for patch orchestration in Vulnerability Response.

Records that roll up active VI counts

To avoid rolling up all the patches to all the vulnerabilities, the scheduled job only picks up changes to the active VI count. These count changes and related data are rolled up to the following records in Vulnerability Response:

VIT
RT
Vulnerability solution
Patch Update

Viewing data for patches without solutions

For more information about viewing patches without solutions, see View patches without solutions in Vulnerability Response.

Patch data on the Vulnerability Response

The Vulnerability Management (PA) and CISO dashboards are included with a subscription with the Performance Analytics for the Vulnerability Response application. If you have a subscription for Performance Analytics, but do not have a patch orchestration integration installed, the remediation tab is displayed on the CISO dashboard, but it is not populated with data.

For the Vulnerability Management (PA) dashboard, navigate to All > Vulnerability Response > Overview. Click the Remediation tab and scroll to the bottom of the page to view Patch Updates data: patches scheduled and not scheduled, patches missing their target dates, and weekly counts.

For the CISO Dashboard, navigate to All > Vulnerability Response > CISO Dashboard. With the Overview tab selected, scroll to the bottom of the page to view Patch Coverage data: Criticality, patches scheduled and not scheduled, and patches missing their target dates.

For more information about the Vulnerability Response dashboards, see Using the default Vulnerability Response dashboards, Patch orchestration with the Vulnerability Response Workspaces, and Viewing patch orchestration data on the Vulnerability Response dashboards.