Vulnerability Solution Management
Vulnerability Solution Management automates the correlation of vulnerabilities in your environment with the solutions that can remediate them. It identifies the patches, configuration updates, and controls with the highest impact for your organization, eliminating the need for manual research.
Note: Vulnerability Solution Management requires a separate subscription and must be installed from the ServiceNow® Store before use. After installation, it provides access to Microsoft Security Response Center (MSRC) and Red Hat solution data from within Vulnerability Response.
For more information, see the following resources:
- Get entitlement for a Security Operations product or application.
- Install the Solution Management for Vulnerability Response application.
- Configure installed solution integrations for Vulnerability Solution Management using Setup Assistant
- Red Hat Solution Integration
Potential vs. preferred solutions
Potential solution: Any solution that could address a vulnerability. A single vulnerability often has multiple potential solutions.
Preferred solution: The single solution designated for remediating a specific vulnerability or vulnerable item (VIT). It communicates clear intent and enables precise deployment tracking across your environment.
Preferred solution selection logic
The system selects preferred solutions in the following priority order. A higher-priority selection is never overridden by a lower one:
| Priority | Source | When applied |
|---|---|---|
| 1 (Highest) | Manual selection | Explicitly set by a user on a vulnerability or VIT. Never overridden automatically. |
| 2 | Vendor solutions | Solutions from MSRC, Red Hat, CVRF, or CSAF imports. Selected automatically when no manual selection exists. |
| 3 | Latest solutions | Used when multiple highest-superseding vendor solutions exist. Requires sn_vul.populate_scanner_solutions to be set to 'true'. |
| 4 (Lowest) | Scanner bulletin solutions | Used when no vendor solution is available and only a single scanner solution exists. Requires sn_vul.populate_scanner_solutions to be set to 'true'. |
Solution supersedence
A superseding solution fully replaces a prior release — for example, a Service Pack superseding a hotfix. Solution Management tracks these chains automatically.
Key behaviors:
- If an older vulnerability is detected, any higher-superseding solution can address it.
- The system prefers the highest (most cumulative) superseding solution.
- Supersedence chains are automatically constructed during MSRC import and reflected in the related list on each solution record.
Note: Beginning with v22.0 of Vulnerability Response, solutions are no longer queued in two cases: when a vulnerable item is created, or when data has changed on an active VIT.
Scanner-sourced solutions (v24.0.6+)
Beginning with v24.0.6, solutions from scanners can be ingested in addition to vendor solutions. The following integrations are supported:
- Tenable.sc Plugin Integration
- Tenable.io Plugin Integration
- Qualys Knowledge Base (Backfill)
- Microsoft TVM Machine Vulnerabilities Integration (Full Import)
- Microsoft TVM Machine Vulnerabilities Integration (Delta Import)
For Microsoft TVM specifically, solutions are created at the detection level, allowing preferred solutions to be populated directly on vulnerable items without additional processing steps.
Remediation status metrics
Navigate to the Vulnerability Solution [sn_vul_solution] table, select a specific vulnerability solution, and open the Remediation Status tab. This tab reports the following fields:
| Field | Description |
|---|---|
| Preferred Solution Targets - Remediation status for VIs for which this is the preferred solution | |
| Vulnerable items | Number of active (non-closed) vulnerable items for which this solution is preferred for remediation. This count excludes deferred vulnerable items. |
| Remaining CIs | Number of CIs associated with one or more active vulnerable items for which this solution is preferred for remediation. This count excludes deferred vulnerable items. |
| Total VIs | Number of active and closed vulnerable items for which this solution is preferred for remediation. This count excludes deferred vulnerable items. |
| Total CIs | Number of CIs associated with one or more active and closed vulnerable items for which this solution is preferred for remediation. This count excludes deferred vulnerable items. |
| % VIs remediated | Percent complete for vulnerable item (VI) remediation. Applies to VIs for which this solution is preferred. This count excludes deferred vulnerable items. |
| % CIs remediated | Percent complete for CI remediation. Applies to VIs for which this solution is preferred. This count excludes deferred vulnerable items. |
| Preferred Solution Targets (Includes Deferred) - Remediation status for VIs, including deferred, for which this is the preferred solution | |
| Vulnerable items | Number of active (non-closed) vulnerable items for which this solution is preferred for remediation. |
| Remaining CIs | Number of CIs associated with one or more active vulnerable items for which this solution is preferred for remediation. |
| Total VIs | Number of active and closed vulnerable items for which this solution is preferred for remediation. |
| Total CIs | Number of CIs associated with one or more active and closed vulnerable items for which this solution is preferred for remediation. |
| % VIs remediated | Percent complete for vulnerable item (VI) remediation. Applies to VIs for which this solution is preferred. |
| % CIs remediated | Percent complete for CI remediation. Applies to VIs for which this solution is preferred. |
| Potential Solution Targets - Remediation status for all VIs with a vulnerability related to this solution | |
| Vulnerable items | Number of active (non-closed) vulnerable items for which this solution is a potential solution for remediation. This count excludes deferred vulnerable items. |
| Remaining CIs | Number of CIs associated with one or more active vulnerable items for which this solution is a potential solution for remediation. This count excludes deferred vulnerable items. |
| Potential Solution Targets (Includes Deferred) - Remediation status for all VIs, including deferred, with a vulnerability related to this solution | |
| Vulnerable items | Number of active (non-closed) vulnerable items for which this solution is a potential solution for remediation. |
| Remaining CIs | Number of CIs associated with one or more active vulnerable items for which this solution is a potential solution for remediation. |
Note: Both Preferred Solution Targets sections are available: excluding deferred and including deferred. The same fields apply — the difference is whether deferred VITs are counted.
Solution risk score and risk rating
Each solution record carries a risk score that estimates the risk reduction achievable by deploying it. The calculation is:
- Start with 85% of the highest Risk score among all active VITs that list this as a potential solution.
- Add bonus points based on the total number of affected VITs:
| VIT Count Range | Points Added |
|---|---|
| 0 – 9 vulnerable items | + 0 points |
| 10 – 99 vulnerable items | + 5 points |
| 100 – 999 vulnerable items | + 10 points |
| 1,000+ vulnerable items | + 15 points |
For example, a solution with a max VIT risk score of 80 starts at 68 (80 × 0.85). With 200 active VITs, 10 points are added, yielding a final Risk score of 78 (High).
The risk rating translates the Risk score into a severity label (applies from v16.1 onward):
| Risk Rating | Score Range |
|---|---|
| Critical | 90 or higher |
| High | 70 – 89 |
| Medium | 40 – 69 |
| Low | 1 – 39 |
| None | 0 |
Performance optimization: update status flag
An Update status column was introduced in the Vulnerability Solution table to reduce unnecessary processing. When only remediation status metrics must be recalculated (no roll-up or preferred solution population required), solutions are no longer queued. Instead, the Update status flag is set to true directly.
This optimization applies in the following scenarios:
- When the preferred solution changes on a vulnerability
- When VITs are created or deleted
- When a VIT import is completed
Note: The scheduled job processes queued solutions first, then iterates through solutions marked Update status = true. This recalculates counts and metrics. This significantly reduces queue volume and improves job performance.
Processing architecture
Process Vulnerability Solution Metrics Queue Job
This scheduled job evaluates and assigns preferred solutions to vulnerability records ingested via MSRC and Red Hat. It executes solution roll-down to associated VITs and recalculates remediation status metrics on solution records. It processes all solutions — while only MSRC and Red Hat integrations are available in the base system, you can also activate Suse and Cisco solutions or create your own CSAF or CVRF integrations.
This job is resource-intensive given the potential scale of processing hundreds of thousands of vulnerability records. Initial solution ingestion or high-volume imports of solutions or third-party vulnerabilities or vulnerable items may take substantially longer than steady-state runs.
Split Processing Jobs (v26.5.3+)
Beginning with v26.5.3, the scheduled job was split into two parallel jobs to support concurrent processing:
- Chained Solutions Job: Handles MSRC solutions. MSRC publishes monthly incremental updates structured as supersedence chains. Each solution supersedes one or more prior ones. This job performs a directed graph traversal to identify the highest-superseding solution, then designates it as the preferred solution. Note: graph traversal is complex and may require significant processing time in large environments.
- Non-Chained Solutions Job: Handles Red Hat and all other integrations. These sources don't use supersedence chain relationships and don't require graph-based resolution. They are processed via a faster, streamlined execution path.
Running both jobs concurrently significantly improves overall throughput.
- Microsoft Security Response Center Solution Integration
Review and implement proposed remediation solutions provided by the Microsoft Security Response Center Solution Integration. - Red Hat Solution Integration
You can review and implement proposed remediation solutions provided by the Red Hat Solution Integration in the Vulnerability Response application. - Rapid7 solution management
Solutions are known remediations that are imported into your Rapid7 Vulnerability Integration from either the Rapid7 data warehouse or Rapid7 InsightVM. Rapid7 data warehouse imports both solutions and superseding solutions. With Rapid7 InsightVM, you get solutions as part of the Rapid7 Vulnerable Item Integration - API. - Generic framework to ingest data from any solution vendor
A generic framework for solution intelligence integration is available to support ingestion of data in different file formats from solution vendors. These formats speed up information exchange and processing and facilitate the sharing of critical security-related information in a standardized reporting format.
Parent Topic:Vulnerability Response