Vulnerability Response integrations

  • Release version: Xanadu
  • Updated August 1, 2024
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Vulnerability Response integrations

    Vulnerability Response in ServiceNow supports multiple third-party integrations that import vulnerability data and scanner detection results, reconciling them against the assets in your CMDB. When vulnerabilities match assets, they create vulnerable items (VIs) that are grouped into remediation tasks, prioritized with risk scoring, and assigned to teams. This integration ecosystem enables efficient vulnerability management aligned with business context.

    Show full answer Show less

    Different third-party integrations operate independently without deduplication of vulnerable items across integrations. Some mismatches in detection counts between scanners and ServiceNow are expected due to how deduplication is applied (e.g., by IP and port).

    Supported Integrations and Configuration

    • Native integrations include those for National Vulnerability Database (NVD), Qualys, Rapid7, Tenable, Shodan, Microsoft Threat and Vulnerability Management, HCL BigFix, Microsoft SCCM, and the Microsoft Security Response Center Solution Integration.
    • Many integrations can be installed, configured, scheduled, and launched on demand directly from the Setup Assistant, streamlining deployment.
    • Some integrations, like Rapid7, require installation via Setup Assistant but configuration outside of it.
    • The Microsoft Security Response Center and Red Hat Solution Integrations are managed through the Vulnerability Solution Management application.

    Integration Processing and Performance

    Integration data is processed via import queue entries, which must complete within a one-hour time limit to avoid timeout errors. Large payloads may exceed this limit, but starting in Vulnerability Response version 18.2.4, periodic heartbeat timestamps are sent to indicate active processing and prevent premature timeouts.

    The system monitors the “Last Record Processed” timestamp to detect stuck processes and time them out appropriately, based on configurable system properties controlling heartbeat frequency and timeout delay.

    Integration process state names were updated starting in version 17.1 for clarity (e.g., "Processing" renamed to "Retrieving"). Users can also view attachments downloaded and processed during integration runs, which show progress percentages when in the “waitcomplete” state.

    Manual Integrations and CSDM Tables

    Customers can create custom integrations not available through ServiceNow Store applications, allowing flexibility to incorporate additional vulnerability data sources.

    Vulnerability Response and related applications contribute to and consume Common Service Data Model (CSDM) tables, enhancing data consistency and integration across Security Operations and other ServiceNow products.

    Vulnerability Response includes support for third-party integrations. Included in this section are some basic guidelines for developing your own integrations.

    Third-party integrations

    Refer to the notes and text for how third-party integrations and the Vulnerability Response application create vulnerable items.

    Imported vulnerabilities from the National Vulnerability Database (NVD) and detection data from third-party scanners are reconciled with the assets in your CMDB. When an imported vulnerability matches an existing asset, a vulnerable item is created. Vulnerable items are grouped automatically into tasks for remediation, risk-scored with business context, prioritized and assigned to appropriate teams for remediation.

    Note:

    Third-party integrations are treated separately. If more than one third-party integration application is in use in your environment there is no vulnerable item (VI) deduplication across integrations. For example, VI deduplication between Rapid7 and Qualys is not available.

    However, mismatches in detection count between a third-party scanner (for example, Qualys) to VIs in your ServiceNow instance are expected, since we dedupe across IPs, ports and so on.

    For information about third-party integrations supported by Application Vulnerability Response see, Integrating Application Vulnerability Response with other applications

    Additional notes for integrations

    If multiple deployments are supported for an integration, see Create domain-separated imports for an integration.

    • You can install, configure, schedule, and launch on-demand many of the integration applications from within Setup Assistant.
    • You can install the Rapid7 Vulnerability Integration application from Setup Assistant, but configuration is not supported for this integration from within the Setup Assistant. See Install the Rapid7 Vulnerability Integration for more information.
    • The Tenable for Vulnerability Response application by Tenable is created and maintained by Tenable. See their documentation at Tenable for Vulnerability Response.
    During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.
    Note:
    The Last Record Processed field is updated based on what is defined in the following system properties:
    • sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
    • sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.
    Starting from VR v17.1, the following integration process state names have been updated:
    State name prior to V17.1 State name V17.1 onwards
    Processing Retrieving
    WaitComplete Waiting/Processing
    Note:
    You can view the attachments that are downloaded and processed. When the status of the integration run is waitcomplete, it displays the percentage of integration that is complete.

    Manually created integrations

    You can add other integrations that are not available as ServiceNow Store applications, as needed. See Manually create a vulnerability integration for more information.

    Vulnerability Response applications and CSDM tables

    The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications. See Vulnerability Response applications and CSDM tables for more information.