Unified Vulnerability Response Dashboard
The Unified Vulnerability Response dashboard provides a comprehensive view of an organization's vulnerabilities and risks. The vulnerabilities related to infrastructure, cloud, applications, and containers can be viewed in a centralized dashboard for better visibility and remediation.
Watch this four-minute video to learn about the Unified Vulnerability Response Dashboard.[Omitted video] Description: Unified Vulnerability Response Dashboard
Required ServiceNow AI Platform roles
The following roles are associated with this solution. They’re required for viewing, editing, and sharing the reports:
- sn_vul.app_sec_manager
- sn_vul.vulnerability_admin
- sn_vul.vulnerability_analyst
- sn_vulc.admin
- sn_vul_container.vulnerability_admin
- sn_vul_container.vulnerability_analyst
- sn_vul.app_developer
- sn_vulc.vulnerability_analyst
Access the Unified Vulnerability Response Dashboard
To open the dashboard, navigate to either:
- All > Vulnerability Response > Vulnerability Manager Workspace and select the Dashboards icon. Depending on your role, the default dashboard is displayed. To view the Unified Vulnerability Response Dashboard, select the drop-down next to the dashboard name.
- Workspaces > Platform Analytics Workspace > Dashboards > Unified Vulnerability Response Dashboard.
Unified Vulnerability Response dashboard
Use cases
For examples of how different people in your organization would use this dashboard, see these use cases.
| Users | Dashboard use |
|---|---|
| - Vulnerability Managers - Vulnerability Analysts | - Provides real-time visibility of the risks present in infrastructure, applications, configurations, and containers. Enables Vulnerability Managers and Vulnerability Analysts to prioritize and remediate the vulnerabilities in a timely way. - Provides an Attack Surface Overview of critical assets, which can be used to track the remediation progress and efforts. - Provides an overview of risks across business units \(BUs\). You can use filters to select BUs and compare the progress to reallocate resources, as necessary. Role-level access must be provided to the BU head. - Provides visibility into the potential impact by BUs. You can use the Common Vulnerability and Exposure \(CVE\) filter to identify exposures across the organization. - Provides visibility into the EPSS scores attained by vulnerable entries that exist in the CISA KEV catalog for Application, Host, and Container vulnerable items. |
Unified Vulnerability Response Dashboard tabs
This dashboard lets you see the vulnerabilities or issues that are present in hosts, cloud, configurations, applications, and containers. You can view the vulnerabilities based on the business unit, assignment group, risk rating, criticality, and whether an exploit exists for the vulnerabilities.
The Asset Overview tab provides the overall status of configuration items (CIs) in the system.
Asset Overview tab
The Vulnerability Overview tab provides a status on the types of vulnerabilities such as host, application, container.
Vulnerability Overview tab
The Assignment Overview tab provides a status on the assignment of the vulnerabilities.
Assignment Overview tab
The Exception Management tab provides a status on the deferred vulnerabilities.
Exception Management tab
The Service Level Agreement (SLA) tab provides a status on the service level agreement attained by different assignment groups.
Service level Agreement SLA tab
The Exclusion overview tab provides a status of exclusion rules you have created, as well as those affecting detections that are internet-facing and have available exploits.
Exclusion overview tab
The Vulnerability Intelligence tab provides a status on the EPSS scores attained by vulnerabilities having the CISA KEV flag true and EPSS Score >= 0.9 for Application, Host, and Container Vulnerable items.
Vulnerability Intelligence tab
Filters
You can filter the widgets based on the following:
- Business unit
- Assignment group
- Risk rating
- Criticality of assets
- Internet facing
- Exploit exists
When a filter is selected, the data in all widgets gets updated. However, if a filter is not applicable for a widget, a cross symbol is shown next to the filter name.
Note: Only Business unit and Assignment group filters are available in Tokyo. All the filters are available from Utah onwards.
Indicators
Scanned assets
Formula indicator for assets scanned in the last 60 days. Contains scanned discovered item assets, scanned application release assets, scanned discovered container image assets as contributing indicators.
Assets - Exploit exists
Formula indicator for assets where exploit exists in the vulnerabilities. Contains Host assets - Exploit exists, Application assets - Exploit exists, Container assets - Exploit exists as contributing indicators.
Infra Asset - Internet Facing
Indicator for fetching the count of assets, which are internet facing.
Discovered items based on Cloud Resource type
Indicator for fetching the count of assets having an asset category such as cloud.
Base Images
Indicator for fetching the count of base images.
CISA KEVs Asset Type
Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV (BOD 22-01) flag set to true. Contains CISA exists CVR, and CISA exists Vul Items as contributing indicators.
CISA Exists Vulnerable Items – Unassigned
Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV (BOD 22-01) flag set to true and the vulnerable items are unassigned. Contains Unassigned Container Vul Items, Unassigned Host Vul Item as contributing indicators.
CISA Exists Vulnerable Items - Target Missed
Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV (BOD 22-01) flag set to true and the vulnerable items have missed the target. Contains CISA exists Vul Items, CISA exists CVR as contributing indicators.
Active Host VITs
Count of active host vulnerable items (VITs).
Active Application VITs
Count of active application vulnerable items (AVITs).
Active Container VITs
Count of active container vulnerable items (CVITs).
New VITs
Count of VITs that opened on a day.
New AVITs
Count of AVITs that opened on a day.
New CVITs
Count of CVITs that opened on a day.
New Test Results
Count of test results (TRs) that were created on a day.
Closed AVITs
Count of VITs closed on a day.
Closed VITs
Count of AVITs closed on a day.
Closed CVITs
Count of CVITs closed on a day.
Closed Test Results
Count of TRs closed on a day.
Open Config Issues - Test results
Count of all open test results, which are in failed state.
Organization Risk Score
Risk score of an organization from the Rollup Application Risk Score table.
Unassigned Application Vul Item
AVITs with no assignment group or assigned to.
Unassigned Host Vul Item
VITs with no assignment group or assigned to.
Unassigned Container Vul Items
CVITs with no assignment group or assigned to.
Unassigned Config Issues
TRs with no assignment group or assigned to.
Deferred VITs
VITs in deferred state.
Deferred AVITs
AVITs in deferred state.
Deferred CVITs
CVITs in deferred state.
Host SLA - Closed
Average age closed of closed VITs.
Application SLA - Closed
Average age closed of closed AVITs.
Container SLA - Closed
Average age closed of closed CVITs.
Test Result SLA - Passed
Average age closed of passed TRs.
Host SLA - Closed (Critical & High)
Average age closed of closed critical and high VITs.
Application SLA - Closed (Critical & High)
Average age closed of critical and high AVITs.
Container SLA - Closed (Critical & High)
Average age closed of closed critical and high CVITs.
Test Result SLA - Passed (Critical & High)
Average age closed of passed critical and high TRs.
Aggregate MTTR
Average age closed of closed VITs, AVITs, CVITs, and TRs.
SLA Missed
Average age closed of closed and target missed VITs, AVITs, CVITs, and TRs.
Vulnerabilities With EPSS Scores >= 0.9
Count of vulnerability entries with EPSS scores greater than or equal to 0.9.
Breakdowns
- VIT type (unified)
- Internet Facing (unified)
- Risk Rating (unified)
- Exploit Exists (unified)
- Discovered Item Cloud Resource Type (unified)
- CISA Exists (unified)
- CMDB class (unified)
- Business Unit (unified)
- Business Criticality (unified)
- Deferred Reason (unified)
- Assignment group (unified)
- Remediation Status (unified)
Data visualizations
| Title | Type | Description |
|---|---|---|
| Attack Surface Overview | Single score Image omitted: single-score.png Single score | Number representing the aggregated score of an organization's security. |
| CMDB CI Count | Single score Image omitted: single-score.png Single score | Number of CIs in the organization that are registered and tracked in the Configuration Management Database \(CMDB\). Provides a breakdown of the following CIs:- Scanned CIs: Number of scanned CIs - Exploit: Number of exploits available - Internet Facing: Number of internet facing CIs |
| Cloud Resource | Single score Image omitted: single-score.png Single score | Number of CIs with asset category such as cloud. Provides a breakdown of the following cloud assets:- AWS - Azure - GCP |
| Docker Image | Single score Image omitted: single-score.png Single score | Number of docker images including the number of base images. |
| Applications | Single score Image omitted: single-score.png Single score | Number of applications in the organization. |
| Title | Type | Description |
|---|---|---|
| CISA KEVs | Pie Chart | Number of vulnerabilities associated with the CISA catalog and CISA flag as true. Provides a breakdown based on the following:- CISA Vulnerability: Types of vulnerabilities with CISA flag as true - Host CIs - Internet Facing: Internet facing CIs - Unassigned VITs: Unassigned VITs with CISA flag as true - VITs missed target: VITs that missed target with CISA flag as true |
| Active Vulnerabilities by Criticality | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Number of active VITs, AVITs, and CVITs based on criticality. |
| Vulnerability creation and closure trend | Multiple Line Image omitted: line-multiple.svg Multiple Line | Number of new and closed vulnerabilities for all applications. Provides a trend for the last three months. |
| Misconfiguration by cloud platform | Multiple Line Image omitted: line-multiple.svg Multiple Line | Number of configuration issues based on risk rating for each cloud asset. |
| Cloud Compliance | Table | List of resources with the asset category as cloud along with the following details:- Resource name - Class - Vulnerability issues: Number of issues present in the resource that are aggregated based on the risk rating. - Configuration issues: Number of resources with configuration issues along with the risk rating. - Cloud account: Cloud account ID. - Cloud region: Location of the cloud resources. - Cloud provider: Name of the cloud provider. |
| Title | Type | Description |
|---|---|---|
| Unassigned VITs | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Number of vulnerabilities that aren’t assigned to any group or individual along with the risk rating. |
| MTTR by Assignment Group - Top 10 | Multiple Line Image omitted: line-multiple.svg Multiple Line | Mean time taken by an assignment group to identify and remediate the security vulnerabilities or issues. The top 10 assignment groups are displayed that have the highest mean time for remediation. |
| Top 10 Assignment Groups missing SLA \(Critical & High Vulnerability\) | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Top 10 assignment groups that missed the target date of remediation of critical and high vulnerabilities. |
| Title | Type | Description |
|---|---|---|
| Deferred VITs | Stacked Bar |
Stacked Bar|Number of vulnerabilities in the deferred state based on risk rating.|
|Critical and High Deferred VITs by Assignment Group|Stacked Bar
Stacked Bar|Number of vulnerabilities with critical and high risk ratings in the deferred state that is categorized based on the assignment groups.|
| Title | Type | Description |
|---|---|---|
| Host Vulnerability: SLA attainment by assignment group | Multiple Line Image omitted: line-multiple.svg Multiple Line | Time taken by an assignment group to remediate host vulnerabilities. Provides a trend for the last 10 months. |
| Compliance Issues: SLA attainment by assignment group | Multiple Line Image omitted: line-multiple.svg Multiple Line | Time taken by an assignment group to remediate compliance issues. Provides a trend for the last 10 months. |
| Application Vulnerability: SLA attainment by assignment group | Multiple Line Image omitted: line-multiple.svg Multiple Line | Time taken by an assignment group to remediate application vulnerabilities. Provides a trend for the last 10 months. |
| Container Vulnerability: SLA attainment by assignment group | Multiple Line Image omitted: line-multiple.svg Multiple Line | Time taken by an assignment group to remediate container vulnerabilities. Provides a trend for the last 10 months. |
| Title | Type | Description |
|---|---|---|
| Exclusion rules | Table | List of all exclusion rules you have created. |
| Exclusion rules v/s Internet facing | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Exclusion rules impacting detections which belong to internet facing assets. |
| Exclusion rules v/s Exploit exists | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Exclusion rules impacting detections that are vulnerable to existing exploits. |
| Title | Type | Description |
|---|---|---|
| Vulnerabilities with EPSS Score>= 0.9 | Table | Complete list view of all vulnerable entries \(CVEs or TPEs\) that have an EPSS score greater than or equal to 0.9 along with the following details.- ID: CVE ID of the vulnerability - EPSS Score - EPSS Last Modified - CISA KEV BOD 22-01: Indicates if the entry exists in the CISA KEV BOD \(Binding Operational Directive 22-01\) - Total VIs: Total count of VIs that exist for this vulnerability entry. - Total Container VIs: Total count of container VIs that exist for this vulnerability entry. - Severity |
| External Facing Host Vulnerable Items With EPSS Score >= 0.9 | Single score Image omitted: single-score.png Single score | Number indicating the aggregate count of external facing host vulnerable items with an EPSS score greater than or equal to 0.9. Provides single scores sorted by severity of risk rating. |
| External Facing Host Vulnerable Items By Risk Rating | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Number of external facing host vulnerable items by risk rating. The stack bars are categorized by EPSS Score >=0.9 and CISA KEV =True. |
| Vulnerable Items With EPSS Score >= 0.9 By Risk Rating | Stacked Bar Image omitted: stacked-column-bkdown-icon.png Stacked Bar | Number of vulnerabilities with EPSS score greater than or equal to 0.9 sorted by risk rating. Provides a breakdown by host vulnerable items, application vulnerable items, and container vulnerable items. |
Scheduled jobs for data collection
Data collection jobs automatically collect scores for automated indicators and breakdowns. The following scheduled jobs are run to collect scores on new data automatically.
Warning: By default, the following data collection jobs are deactivated in the base system:
- Unified Dashboard Daily Data Collection
- Unified Dashboard Weekly Data Collection
- Unified Dashboard Historical Data collection
Before enabling the jobs, refer to the KB.
| Scheduled job | Frequency | Description |
|---|---|---|
| Unified Dashboard Historical Data collection | Once | Collects scores and snapshots for existing records. |
| Unified Dashboard Weekly Data Collection | Weekly | Collects data weekly. |
| Unified Dashboard Daily Data Collection | Daily | Collects data everyday. |
| Rollup Risk scores to Organization | Daily | Collects the aggregated risk score for an organization. |
| Populate cloud compliance daily counts | Daily | Collects data for cloud compliance. |
| EPSS Daily Job | Daily | Collects EPSS data from First.org. |
A new table Rollup Application Risk Score [sn_vul_cmn_rollup_app_risk_score] is created in the Vulnerability Common Scope. This table is populated using the following rollup calculators via the scheduled jobs everyday.
| Rollup calculator name | Description |
|---|---|
| Organization Risk Score Rollup | Rolls up the risk scores for all vulnerable items and configuration issues in an organization. It provides an overall risk score for an organization. |
| Vulnerable Item Rollup | Rolls up the risk scores for all vulnerable items in an organization, to contribute to the overall risk score of an organization. |
| Application Vulnerable Item Rollup | Rolls up the risk scores for all application vulnerable items in an organization, to contribute to the overall risk score of an organization. |
| Container Vulnerable Item Rollup | Rolls up the risk scores for all container vulnerable items in an organization, to contribute to the overall risk score of an organization. |
| Test Result Rollup | Rolls up the risk scores for all test results in an organization, to contribute to the overall risk score of an organization. |
| Rollup EPSS Scores from NVDs to TPEs | Rolls up EPSS Scores from NVDs to TPEs, to contribute to the overall risk score of an organization. |