Indicator sources and indicators for the Operational Technology Vulnerability Response (PA) dashboard

  • Release version: Xanadu
  • Updated January 22, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Indicator sources and indicators for the Operational Technology Vulnerability Response (PA) dashboard

    The Operational Technology Vulnerability Response application in ServiceNow leverages indicator sources and indicators to collect data and monitor the progress of vulnerability remediation within your OT environment. These metrics enable your team to track vulnerability status, remediation tasks, and related performance goals effectively.

    Show full answer Show less

    Indicator Sources

    Indicator sources pull data primarily from two key tables:

    • snvulvulnerableitem — used by sources such as OTVI.New (new vulnerable items), OTVI.Active (active vulnerable items), and OTVI.Closed (closed vulnerable items).
    • snvulvulnerability — used by OTRT.Active to track active remediation tasks.

    When you anticipate collecting over 1 million records from these sources, it is important to override the expected record count in the indicator source settings to ensure performance and data completeness.

    Indicators

    Indicators measure various aspects of vulnerability remediation progress. By default, the collect records option is disabled to prevent performance issues related to large datasets. The primary indicators include:

    • OT Vulnerable Items: Counts active OT vulnerable items; goal is to minimize this number.
    • OT Critical Vulnerable Items: Tracks critical vulnerable items; aim is to reduce these.
    • OT Unassigned Vulnerable Items: Active vulnerable items without assignment; reducing unassigned items improves accountability.
    • OT Closed Vulnerable Items: Number of vulnerabilities closed daily; increasing this reflects remediation progress.
    • OT Deferred Vulnerable Items and OT Critical Deferred Vulnerable Items: Tracks deferred vulnerabilities; goal is to minimize deferrals.
    • OT Non-Deferred Overdue Critical Vulnerable Items: Critical vulnerabilities overdue and not deferred; should be minimized to reduce risk.
    • OT Remediation Tasks: Counts active remediation tasks; aim to reduce backlog.
    • OT Non-Deferred Overdue Critical Remediation Tasks, OT Non-Deferred Remediation Tasks, and OT Non-Deferred Critical Remediation Tasks: Track overdue and critical remediation tasks that are not deferred; minimizing these is essential for timely remediation.
    • OT Unassigned Remediation Tasks: Active remediation tasks without assignment; reducing these promotes clear ownership.
    • % Vulnerable Items Met Remediation Target: Percentage of closed vulnerable items meeting remediation goals; increasing this percentage indicates effective remediation.
    • OT Vulnerable Item Mean Time to Remediate: Average time taken to remediate closed vulnerabilities; lower values indicate faster resolution.
    • OT Summed Duration of Closed Vulnerable Items: Total duration of closed vulnerabilities; reducing this reflects improved remediation efficiency.

    Practical Considerations for ServiceNow Customers

    • Use these indicators to monitor and prioritize remediation efforts, focusing on minimizing active, critical, overdue, and unassigned vulnerabilities and tasks.
    • Adjust expected record counts for indicator sources if handling very large datasets to maintain performance and data accuracy.
    • Consider enabling data collection for indicators cautiously, balancing detail with system performance.
    • Track remediation targets and mean time to remediate to measure effectiveness and improve OT security posture.

    The Operational Technology Vulnerability Response application uses indicator sources and indicators to gather data and track the progress of your vulnerability remediation.

    Indicator sources

    The Operational Technology Vulnerability Response indicators gather data from the following indicator sources. If you expect more than 1 million records to be collected from the indicator sources, you must override the expected count in the Records collection section of the indicator source. For more information, see Review the indicator sources for a larger number of records.
    OTVI.New
    Uses the sn_vul_vulnerable_item table and collects the new OT vulnerable items.
    OTVI.Active
    Uses the sn_vul_vulnerable_item table and includes all the active vulnerable items in your OT system.
    OTVI.Closed
    Uses the sn_vul_vulnerable_item table and includes all the closed vulnerable items in your OT system.
    OTRT.Active
    Uses the sn_vul_vulnerablity table and includes all the active remediation tasks in your OT system.

    Indicators

    Several indicators are used to measure and track the progress of your vulnerability remediation in the Operational Technology Vulnerability Response application.

    The collect records option for the indicators is inactive by default for the Operational Technology Vulnerability Response application. This option is turned off to avoid the performance issues that may occur when you collect a large amount of data for each indicator.

    OT Vulnerable Items
    Number of the OT vulnerable items on the data source OTVI.Active, which uses the sn_vul_vulnerable_item table. The goal is to minimize the number of vulnerable items in your system.
    OT Critical Vulnerable Items
    Number of the OT critical vulnerable items on the data source OTVI.Active, which uses the sn_vul_vulnerable_item table. The goal is to minimize the number of critical vulnerable items in your system.
    OT Unassigned Vulnerable Items
    All active OT Vulnerable Items where both the Assignment Group and Assigned To fields are empty. The goal is to minimize the number of unassigned vulnerable items.
    OT Closed Vulnerable Items
    The OT Closed Vulnerable Items indicator is measured daily as a unit number. The goal is to maximize the number of closed vulnerable items in your system.
    OT Deferred Vulnerable Items
    Number of OT deferred vulnerable items on the data source OTVI.Active, which uses the sn_vul_vulnerable_item table. The goal is to minimize the number of deferred vulnerable items in your system.
    OT Critical Deferred Vulnerable Items
    Number of OT critical deferred vulnerable items on data source OTVI.Active, which uses the sn_vul_vulnerable_item table. The goal is to minimize the number of critical deferred vulnerable items.
    OT Non-Deferred Overdue Critical Vulnerable Items
    Number of OT non-deferred overdue critical vulnerable items on the data source OTVI.Active, which uses the sn_vul_vulnerable_item table. The goal is to minimize the number of non-deferred overdue critical vulnerable items in your system.
    OT Remediation Tasks
    Number of OT remediation tasks on the data source OTRT.Active, which uses the sn_vul_vulnerability table. The goal is to minimize the number of remediation tasks in your system.
    OT Non-Deferred Overdue Critical Remediation Tasks
    Number of OT non-deferred overdue critical remediation tasks on the data source OTRT.Active, which uses the sn_vul_vulnerability table. The goal is to minimize the number of non-deferred overdue critical remediation tasks in your system.
    OT Non-Deferred Remediation Tasks
    Number of OT non-deferred remediation tasks on the data source OTRT.Active, which uses the sn_vul_vulnerability table. The goal is to minimize the number of non-deferred remediation tasks in your system.
    OT Non-Deferred Critical Remediation Tasks
    Number of OT non-deferred critical remediation tasks on the data source OTRT.Active, which uses the sn_vul_vulnerability table. The goal is to minimize the number of non-deferred critical remediation tasks in your system.
    OT Unassigned Remediation Tasks
    All active remediation tasks where both the Assignment Group and Assigned To fields are empty. The goal is to minimize the number of unassigned remediation tasks in your system.
    % Vulnerable Items Met Remediation Target
    ([[Closed Vulnerable Items > Remediation Target = Target Met]] / [[Closed Vulnerable Items]]) * 100

    The goal is to maximize the percentage of vulnerable items that meet the remediation target in your system.

    OT Vulnerable Item Mean Time to Remediate
    [[Summed Duration of Closed Vulnerable Items]] / [[Closed Vulnerable Items]]
    OT Summed Duration of Closed Vulnerable Items
    Number of OT summed duration of closed vulnerable items on the data source OTVI.Closed, which uses the sn_vul_vulnerable_item table. The goal is to minimize the summed duration of the closed vulnerable items in your system.