|
Yokohama
|
- **[Enhancements to the Vulnerability Manager and IT Remediation workspaces starting with version 2.13](https://www.servicenow.com/docs/access?context=unassigning-cvits&family=yokohama&ft:locale=en-US)**
The Unassign workflow is supported for container vulnerable items \(CVITs\) and remediation tasks \(CVULs\).
- Streamline vulnerability assignments in the workspaces with the **Unassign** UI action from the more actions menu on a CVIT.
- Reassign incorrectly assigned CVITs, clarify ownership for reassessment, and maintain accurate triage records in workspace views.
- You have the option to send unassign requests for approval prior to clearing the Assigned to and Assignment group fields on records.
[\[Placeholder link text to key cvr-assignment-rules\]](https://www.servicenow.com/docs/access?context=cvr-assignment-rules&family=yokohama&ft:locale=en-US). You can use the following values imported from the Prisma Cloud Compute integration as conditions when you create or update your assignment rules to help you track ownership across your container environments.
- Cloud account IDs
- Image namespaces
- Registry
- Hosts
- Labels
- Status - Vendor status for a resolved \(`Fixed`\) vulnerability
- **[Create container remediation tasks manually in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-create-remediation-task&family=yokohama&ft:locale=en-US)**
With the sn\_vul\_container.vulnerability\_analyst or sn\_vul\_container.vulnerability\_admin role, you can create container remediation tasks manually by selecting some or all the records in the Container vulnerable items lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating container remediation tasks.
- **[Create container remediation tasks manually in the IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-create-remediation-task&family=yokohama&ft:locale=en-US)**
With the role sn\_vul\_container.remediation\_owner, you can create container remediation tasks manually by selecting some or all the records in the Container vulnerable items’ lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating container remediation tasks.
- **[Configure container vulnerable items \(CVITs\) granularity using Registry and data source](https://www.servicenow.com/docs/access?context=pcc-integration&family=yokohama&ft:locale=en-US)**
Starting with v2.12.2 of Container Vulnerability Response, you can configure the granularity of container vulnerable items \(CVITs\) using Registry information and data sources. Depending on the chosen data source, you can view either image or kubernetes information related to a CVIT record.
- **[Additional columns in the container vulnerable items \(CVITs\) table](https://www.servicenow.com/docs/access?context=container-vul-items-fields&family=yokohama&ft:locale=en-US)**
Starting with v2.12.2 of Container Vulnerability Response, you can see the precise date and time when a CVIT was first discovered, last opened, resolved, and last found, ensuring clarity and accounting for different time zones.
- **[View risk score details of a container vulnerable item in the Work Notes section](https://www.servicenow.com/docs/access?context=cvr-calculator-rules&family=yokohama&ft:locale=en-US)**
Starting with v2.12.2 of Container Vulnerability Response, the system property **sn\_sec\_cmn.risk\_score\_changes\_add\_worknotes** is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a container vulnerable item in the Work notes section. Additionally, the work notes are updated only if there’s a change in the risk score.
|
|
Zurich
|
- **[Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US)**
You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules.
- **[Enhancements to the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**
- The Universally Unique Identifier \(UUID\) that identifies detections for the Wiz Host Vulnerability integration will be mapped to a detection key.
**Note:** This enhancement is supported for new customers only.
For existing customers, the detection key for the Wiz Host Vulnerability integration is created using the combination of vulnerability, asset\_id, and proof.
- Added the source\_id column to the Container Image Finding table \(sn\_vul\_container\_image\_findings\) and mapped the id attribute from the Wiz import to this field on findings records.
**Note:** Perform a full import after upgrading to view the enhancement on container image findings, container image, and container image vulnerabilities records.
- The image repository name format for new and existing discovered container images has been updated to align with the discovery format. The supported format is registry/repository. A separate finding is created for a repository present in each registry.
- Appended all repositories that are associated with an image to the Repository field on the Discovered Container Image \[sn\_vul\_container\_image\] table, which can help you see images from specific repositories.
- The default integration instance parameter for configuring finding keys for the Container Vulnerability Integration includes src\_ci, vulnerability, package, image\_layer, and image\_repository.
- **[Enhancements to the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**
The Missing Assets \[sn\_vul\_wiz\_missing\_asset\] is deprecated. After updating to version 1.1, you must backdate your existing primary Wiz integrations by three days and run them.
The backfill integrations are activated by default.
After you run them after updating to v1.1, the following backfill integrations are no longer required:
- Host Vulnerability Backfill Integration
- Test Results Backfill Integration
- Host Test Results Backfill Integration
- Issues Backfill Integration
Data for resources that have the validated\_at\_runtime flag set to 'yes' is imported and populated on detections.
The CMDB internet-facing field on the discovered item is mapped to Limited Internet Exposure on findings.
Fix information that includes 'Fix available', 'Partial fix available', 'No fix available', and 'Fix version' from the \[fix\_available\] and \[fix\_version\] columns is rolled up to CVITs from findings. Note: If there are two or more findings on a CVIT, the fixed version might only apply to one. In that case, 'Partial fix available' is rolled up to the CVIT.
The Wiz vendor severity attribute is mapped to the 'Source severity' column on findings records in the Container Image Findings \[sn\_vul\_container\_image\_findings\] table.
The cluster and namespace is evaluated for all the following entity Types: DEPLOYMENT, DAEMON\_SET, STATEFUL\_SET, POD.
- **[Import container vulnerability data with the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US)**
Import configuration test results from Wiz to detect non-compliant cloud configurations. Findings are mapped to cloud test results \(CTRs\) in the Configuration Compliance application to help you enforce security policies and standards across your cloud environment.
- **[Enhancements to imported scanner results](https://www.servicenow.com/docs/access?context=cvr-remediation-task-overview&family=zurich&ft:locale=en-US)**
Enhancements support more scanner data on imports. Namespaces and hierarchy cluster are considered and populated in the discovered container image \[sn\_vul\_container\_image\] table if this data is imported.
|
|
Australia
|
- **[Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=australia&ft:locale=en-US)**
Enhancements to the Wiz integration include:
- A link lets you navigate from the Wiz configuration module directly to the **Configure VI Granularity** module where you can configure the keys that generate Container Vulnerability Response findings.
- Starting with version 32.1 \(USEM\) and version 4.1 \(non-USEM\), the Asset integration is deactivated by default and is not a mandatory prerequisite for the other Wiz integration imports.
If you choose to activate it, the Asset integration will retrieve assets for all resource types if you don't specify the ones you want on the **Asset Integration Configuration** tab. To avoid importing vulnerability data you don't need, identify only the resources \(assets\) that you want to import with this integration.
- Resource Type is no longer a mandatory field for configuring the Vulnerability Response Integration with Wiz. You can now save Wiz configurations for the integrations without specifying a Resource Type, simplifying setup for use cases where specifying a Resource Type isn't appropriate.
- **[Configure Image Vulnerability keys for Container Vulnerability Response CVIT creation](https://www.servicenow.com/docs/access?context=cvr-configuring-findings-key-granularity&family=australia&ft:locale=en-US)**
Configure records on the Configure Image Vulnerability Keys \[sn\_vul\_container\_image\_vulnerability\_keys\] table in your ServiceNow AI Platform® instance for the Image Vulnerability Keys that create container vulnerable items \(CVIT\)s.
- The Universally Unique Identifier \(UUID\) provided by Wiz is now mapped as the detection key for the Wiz Host Vulnerability integration.
- AWS ECS \(Elastic Container Service\) and AWS EKS \(Elastic Kubernetes Service\) environments are supported.
- Cluster and Service are supported for AWS ECS environments.
- Namespace, Registry, and Service are supported for AWS EKS environments.
- Choose either Scanner \(third-party scanners\) or Discovery \(Configuration Management Database \(CMDB\)\) as sources for data import for AWS ECS and AWS EKS.
**Note:**
If you choose **Discovery** as the data source, the Populate image relationships scheduled job runs daily to pre-import cluster and service details, and you should schedule your third-party integration runs at least 4 hours after this scheduled job is completed to verify that the pre-import data is available. This job is activated by default, but you must set the schedule so it runs before your scheduled third-party integration runs.
For new customers only: The system property, sn\_vul\_container.image\_relationship\_mapping\_months sets the number of previous months \(1-12\) that you want your third-party integration to look for container image updates when processing relationship mappings. This data is used to filter images by the sys\_updated\_on field. The default setting is three months. After you configure the integration run, relationship mapping is created for images which have been scanned in the last 90 days and present in discovered container images.
- Column labels on the Container Vulnerable item \[sn\_vul\_container\_image\_vulnerable\_item\] table are updated to support the scanner and discovery options, depending on your choice on the Configure Image Vulnerability Keys configuration page:
- Cluster \(Scanner\) Namespace \(scanner\), and Service \(scanner\) for scanner data
- Cluster \(Discovery\), Namespace \(Discovery\) and Service \(Discovery\) for Discovery
- **[AWS Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=aws-integration-for-security-exposure-management-overview&family=australia&ft:locale=en-US)**
The AWS Integration for Security Exposure Management supports integrations with the following AWS services:
- AWS Inspector is an automated vulnerability management service that continuously scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities \(CVEs\) and unintended network exposure. The Vulnerability Response integration with AWS Inspector imports host and container vulnerability findings from AWS Inspector.
- AWS Security Hub is a security service that is used to centralize and update security checks across AWS accounts. It provides a unified view of security alerts and compliance status by integrating with various AWS services. The Vulnerability Response integration with AWS Security Hub imports host, container vulnerabilities, and misconfigurations from AWS Security Hub.
- **[Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=ms-defender-sem&family=australia&ft:locale=en-US)**
The Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management \(MS TVM\) plugins are now consolidated into a single plugin: Microsoft Defender Integration for Security Exposure Management. This consolidation deprecates the standalone Microsoft Defender for Cloud plugin. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable Items on your instance. A guided migration path is available to transfer existing data from the deprecated applications to the unified plugin.
|