Managing state mapping for deferrals and false positives in Application Vulnerability Response
Summarize
Summary of Managing state mapping for deferrals and false positives in Application Vulnerability Response
ServiceNow’s Application Vulnerability Response (AVR) allows customers to manage how states from imported Application Vulnerable Items (AVIs), via Veracode and Fortify Vulnerability Integrations, are mapped and triaged within their instance. Starting with version 20.0, customers gain enhanced flexibility to handle deferrals and false positives by configuring state mappings and workflows that align with their internal exception and false positive management processes.
Show less
Managing Deferrals (Exceptions)
When AVIs are imported, source states like Will Not Fix, Remediation Deferred, Risk Accepted, and Risk Mitigated from scanners are typically mapped to a Deferred target state with specific substates in ServiceNow. Customers can choose how these mappings behave via a configuration checkbox:
- Manage exceptions enabled (default): AVIs marked as Deferred are triaged through the ServiceNow Exception Management workflow. The AVIs are mapped to a triage target state within the Open state, and the Request Exception UI action is available on AVI records for exception requests.
- Manage exceptions disabled: Source states from scanners are preserved and mapped directly to the Deferred target state with a reason. Exception workflows are bypassed, no triage occurs, and the Request Exception UI action is not available, since the AVI is already in Deferred state.
Managing False Positives
For false positives, such as those identified by Veracode with source states like False Positive or Potential False Positive, similar configuration controls exist:
- Manage false positives enabled (default): AVIs with these source states are triaged using the Exception Management workflow as a Target triage state in Open. The False Positive UI action is available on AVI records to formally request false positive classification.
- Manage false positives disabled: Source states are preserved and mapped directly to the Closed target state with a False Positive reason. False positive workflows are skipped, and the False Positive UI action is not available, as the record is already Closed.
Practical Benefits for ServiceNow Customers
- Enables consistent triaging of scanner-imported vulnerabilities according to organizational policies.
- Provides control over whether exceptions and false positives require explicit workflow handling or direct state mapping.
- Improves clarity and traceability by using ServiceNow workflows and UI actions for managing deferrals and false positives when enabled.
- Allows flexibility to preserve external scanner states when desired, simplifying integration behavior.
You can manage how the Source states on application vulnerable items (AVIs) imported by the Veracode Vulnerability Integration and Fortify Vulnerability Integration are mapped in your instance after import.
Starting with v20.0 of Vulnerability Response, you have more options for triaging your imported AVIs with ServiceNow workflows.
- Manage exceptions in ServiceNow
- Manage false positives in ServiceNow
Use case for Exception management
AVIs are imported from these integrations with Source states. Upon import, these state are mapped to Target and Target reason states in your instance, because in some cases there are no exact matches between the source states of your scanner and the states used by your instance.
For example, source states such as Will Not Fix, Remediation Deferred, Risk Accepted, and Risk Mitigated from the Fortify on Demand Vulnerability Integration are mapped to the Deferred state with a substate of Risk Accepted or Mitigating Control in Place in your instance.
You have the following options on the configuration pages for these integrations:
| Option | Check box selected | Description |
|---|---|---|
| Manage exceptions in ServiceNow | Y (by default) | If you leave this option selected, you must request exceptions from AVI records. Imported AVIs marked for the Deferred state are triaged with the ServiceNow Exception Management workflow. AVIs with Source states that normally are mapped to a Deferred state are mapped to the Target triage state in the Open state. |
| N | If you deactivate the check box, you preserve the Source states imported from your scanner. These AVIs are mapped to the Target state as Deferred, and to a Target reason state in your instance. They are not triaged by the exception workflow, because they are not mapped to the Target triage state and Target triage reason states. The Request Exception UI action is not available on the AVI record, because the record already in the Deferred Target state. |
Use case for False positive
For false positives from the Veracode Vulnerability Integration as an aexample, source states such as False Positive or Potential False Positive are mapped to the Closed Target state with a substate of False Positive.
| Option | Check box selected | Description |
|---|---|---|
| Manage false positives in ServiceNow | Y (by default) | If you leave this option selected, you must request a False Positive from AVI records. Imported AVIs marked for the False Positive or Potential False Positive states are triaged with the ServiceNow Exception Management workflow. AVIs with Source states that normally are mapped to a Closed Target state are mapped to a Target triage state in Open. The False Positive UI action is available on the AVI record. |
| N | If you deactivate the check box, you preserve the Source states imported from your scanner. These AVIs are mapped to the Target state as Closed and a Target reason state in False Positive in your instance. They are not triaged by the false positive workflow. The False Positive UI action is not available on the AVI record, because the record is already in the Closed Target state. |