---
title: Create, edit, and delete Application Vulnerability Response remediation task rules
description: You can create rules to automatically group application vulnerable items \(AVI\) into remediation tasks \(AVUL\) based on filter conditions. These rules automatically group AVIs as they're imported or manually created.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/avm-create-rt-rule.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 4
breadcrumb: [Application Vulnerability Response remediation tasks and task rules overview, Configure Application Vulnerability Response, Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Create, edit, and delete Application Vulnerability Response remediation task rules

You can create rules to automatically group application vulnerable items \(AVI\) into remediation tasks \(AVUL\) based on filter conditions. These rules automatically group AVIs as they're imported or manually created.

## Before you begin

If you create a new rule, it doesn't apply to existing data. After you submit it, it's run against new imports.

Role required: sn\_vul.app\_sec\_manager

## Procedure

1.  Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Remediation Task Rules**.

2.  Open the rule or select **New**.

3.  Fill in the fields on the form or edit them.

<table id="table_g2b_tmn_rkb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the task rule.

</td></tr><tr><td>

Active

</td><td>

Indicates whether the task is active.

</td></tr><tr><td>

Description

</td><td>

Description of the rule.

</td></tr><tr><td>

Case sensitive

</td><td>

Determines whether a condition is case sensitive or not.**Note:** The default value is case insensitive.

</td></tr><tr><td>

Condition

</td><td>

Optional filter conditions for the rule.

 By default, \(**Case sensitive** check box not selected\), the search text you enter in the condition builder on task rules records and forms isn't case-sensitive. You have the option to enable case-sensitive searches on task records and forms.

 An example condition is **Vulnerability** &gt; **is** &gt; **VULNENT123451** \(a known imported vulnerability\). Any AVIs that have this vulnerability match this condition.

</td></tr><tr><td class="sub-head" colspan="2">

**Group by \(up to six condition sets are available\)**

</td></tr><tr><td>

Group application vulnerable items from

</td><td>

The table the rule uses to group AVIs.Select the elements from the tree:

-   Application Vulnerable Item \[sn\_vuln\_vulnerable\_item\]
-   Application Vulnerable Item Configuration Item \[cmdb\_ci\]
-   Application Vulnerable Item Application Vulnerability \[sn\_vul\_third\_party\_entry\]
-   Application Vulnerable Item Product Model
**Note:** If you choose an extended table, the **Using field** is applied only for application vulnerable items that use that extended table.

</td></tr><tr><td>

Using field

</td><td>

Field on the table that the rule uses to group AVIs. Select conditions from the tree.

 **Note:** You can create group by conditions so that not all the AVIs that share data are assigned to the same remediation task. For example, if you select Assignment group and IP Address as the Using fields, and multiple AVIs match the initial filtering condition **Vulnerability**, these AVIs can be assigned to distinct assignment groups for remediation using the many options available in the Group by section. The Group by conditions give you the flexibility to create distinct remediation tasks that can be assigned to different group even if they share some data.

</td></tr><tr><td class="sub-head" colspan="2">

**Assignment**

</td></tr><tr><td>

Assign remediation tasks by

</td><td>

When automatically assigning remediation tasks, the Assignment choice is used in addition to the **Group By** choices to group the vulnerable items. New tasks are created, as needed, so that each AVI is placed in a task with a matching assignment group set.

 To automate the assignment of tasks created based on this rule, choose one of the options available.

-   Group by field: If you selected any user group field from the **Using field** values in the **Group by**section, they appear in the drop-down menu.
-   User Group: Use the lookup list to select a static user group.


</td></tr></tbody>
</table>    if you delete a rule from either the form or list view, you have the option to delete all **Open** remediation tasks created by that rule. Groups not in the **Open** state are excluded.

4.  Select **Submit** for new rules.

    After you select **Submit**, your rule is displayed on the Remediation Task Rules list \[sn\_vul\_grouping\_rule\]. The following situations initiate your rule.

    -   When new AVIs are created.
    -   When you select **Reapply**. You select **Reapply** to evaluate task rules on existing remediation tasks only.
    -   When AVIs are updated, either by you or by the system.

        If an AVI is updated, task rules are evaluated for matches to existing remediation tasks. Some common updates that initiate a rules check are:

        -   When the State changes from Closed to Open, or from Closed to Under Investigation.
        -   The configuration item \(CI\) is changed.
        -   The vulnerability is changed.
    The system checks all the task rules for matches to the updated AVI. If the conditions of a rule match the conditions of a remediation task, matching AVIs are assigned to it.

    If no match is found, a new remediation task is created.

    For more information about state roll up from AVIs to remediation tasks and state roll down from remediation tasks to AVIs, see [Application Vulnerability Response remediation tasks and task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-rt-rt-rules-overview.md).

    For an example of a remediation task rule, see [Application Vulnerability Response remediation task rule examples](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-remediation-task-examples.md).

5.  To delete a task rule, select the rule from the Remediation Task Rules list and select **Delete**.

    The following message is displayed: `The selected remediation task rule created n remediation tasks. Of the remediation tasks, n are in the Open state.`.

    |Option|Description|
    |------|-----------|
    |Check box deactivated \(default\).|Only delete the rule. Tasks not in the **Open** state are excluded.|
    |Check box selected.|Include the remediation tasks in the **Open** state when you delete the remediation task rule. Delete the rule and any remediation tasks in the **Open** state.|

6.  Choose one option and select **Delete**.


**Parent Topic:**[Application Vulnerability Response remediation tasks and task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-rt-rt-rules-overview.md)