Note:
This app version is intended for Unified Security Exposure Management (USEM), a significant architectural upgrade to the Vulnerability Response applications.
If you are currently using Vulnerability Response and upgrading to USEM for the first time, you must use the Migration assistant for Unified Security Exposure Management to ensure a safe and successful upgrade. For full details, please refer to the KB2556844 and documentation before proceeding.
If you do not intend to upgrade to USEM, please select a version below 30.x when installing or upgrading.
Vulnerability Response helps organizations respond faster and more efficiently to vulnerabilities, connects security and IT teams, and provides real-time visibility into your security posture. Vulnerability Response connects the workflow and automation capabilities of the Now Platform® with vulnerability scan data from leading vendors to give your teams a single platform for response that can be shared between security and IT.
The Vulnerability Response application includes the following capabilities:
- Automate the process of organizing vulnerabilities into a group and assigning it to the IT operations team.
- Prioritize vulnerabilities based on asset criticality and vulnerability severity.
- Improve the flow of work between Security and IT via a comprehensive remediation workflow.
- Import Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Software Composition Analysis (SCA) vulnerabilities, manual penetration test assessments, and application vulnerable items to help you determine, prioritize, and remediate the impact and priority of flaws in your code using the Application Vulnerability Response (AVR) feature.
- Import information from the NIST National Vulnerability Database (NVD) with the Vulnerability Response Integration with NVD to better understand your vulnerability exposure.
New
- Admins can now preview exception, assignment, classification, remediation target, calculator, auto-close, and CI lookup rules before applying them. The preview option displays the impact of rule conditions, allowing users to verify affected records and adjust rules as needed.
- Remediation plan details are now fully automated in workspace and classic views. All fields, actions, related lists, and state transitions are covered by automated tests, ensuring consistent validation and reliability.
- Admins can now manually select assignment groups when creating remediation tasks. Findings can be reassigned using manual group selection before remediation task creation.
- Admins can now automate classification rules front-end test cases. Identified scenarios are fully automated for improved reliability.
Fixed
- Fixed an issue that required the Vulnerability Admin role to view the Exposure and Vulnerability Assessment icons in the Unified Security Exposure Management workspace.
- Fixed an issue that prevented the "Transit to Closed" business rule from moving vulnerable items to the Closed state.
- Fixed an issue where the Microsoft Security Response Center (MSRC) integration removed all proposed solutions when an attachment exceeded approximately 5 MB.
- Fixed an issue that allowed a past Until date for vulnerable items closed as Closed – False Positive.
- Corrected a dialog tab order so the Next button now follows the Cancel button as expected.
- Improved accessibility across the application with enhanced keyboard navigation, screen reader support (including state announcements, dialog context, and heading semantics), focus management, and icon button labeling.
Not applicable for this application version.
- The following dependency plugins for Vulnerability Response must be activated:
- com.snc.vul_dep plugin for Vulnerability Response Dependencies
- The following Security Operations applications must be installed and activated:
- Security Integration Framework
- Security Support Common
- Security Support Orchestration
- Security Exposure Management (requires entitlement from the store)
- Permissions and roles
- Roles required:
- System Admin (admin) for installation
- For Configuration:
- Application Security Manager (User part of App-Sec Manager group) for Application Vulnerability Response
- For access to the Vulnerability Response Workspaces:
- IT Remediation Workspace: sn_vul.remediation_owner
- Roles required: