---
title: Create a remediation effort in the Security Exposure Management Workspace
description: A remediation effort record is a static list of records that you create from a watch topic in the Security Exposure Management Workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/sem-create-rev16.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 7
breadcrumb: [Use Remediation Effort records, Use, Unified Security Exposure Management, Security Operations]
---

# Create a remediation effort in the Security Exposure Management Workspace

A remediation effort record is a static list of records that you create from a watch topic in the Security Exposure Management Workspace.

## Before you begin

Role required:

-   sn\_vul.vulnerability\_analyst, or sn\_vul.vulnerability\_admin for host vulnerable items \(VITs\)
-   sn\_vul.app\_sec\_manager for application vulnerable items \(AVITs\)
-   sn\_vul\_container.vulnerability\_analyst or sn\_vul\_container.vulnerability\_admin for container vulnerable items \(CVITs\)
-   sn\_vulc.admin for configuration test results \(CTRs\)

## About this task

You use remediation efforts to hand off the tasks IT teams use to fix vulnerabilities and mis-configurations.

-   You can edit existing remediation efforts.
-   Create remediation efforts that are created automatically on the dates and times that you set.
-   Transfer records from existing remediation efforts into a new remediation effort.

The **Create Remediation Effort** button is disabled when the watch topic is inactive.

## Procedure

1.  Navigate to **All** > **Security Exposure Management Workspace** > **Watch Topics**.

2.  On the Watch Topics page, select a watch topic that you want to create a remediation effort for.

3.  To view the records that are associated with the selected watch topic, under the record header, click **Vulnerable Items**, **Application Vulnerable Items**, **Container Vulnerable Items** or **Configuration Test Results** tab in their respective watch topics.

    The records display.

    For example, in the header under the Vulnerable Items tab, you can view the total number of records that this watch topic has.

    The following columns and data are displayed:

<table id="table_pyx_cy5_r5b"><thead><tr><th>

Column

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Number

</td><td>

The record number.

</td></tr><tr><td>

Summary

</td><td>

Description of the vulnerability.

</td></tr><tr><td>

Configuration item

</td><td>

The asset associated with the vulnerability.

</td></tr><tr><td>

Risk rating

</td><td>

Quantified Risk Score separating records into Critical, High, Medium, Low, and None.

</td></tr><tr><td>

State

</td><td>

Status of the record.

</td></tr><tr><td>

Remediation status

</td><td>

Status of remediation for a record.

</td></tr><tr><td>

Assignment group

</td><td>

Assignment groups responsible for remediation. Assignment of records to groups is based on the assignment rules that you create.

</td></tr><tr><td>

Remediation effort

</td><td>

If it is assigned to a remediation effort, each record lists its assigned remediation effort. After it is added to a remediation effort, a record won't be added to any other remediation efforts that you create.

</td></tr><tr><td>

Assignment group

</td><td>

Assignment groups responsible for remediation. Assignment of records to groups is based on the assignment rules that you create.

</td></tr><tr><td>

Remediation effort

</td><td>

If it is assigned to a remediation effort, each record lists its assigned remediation effort. After it is added to a remediation effort, a record won't be added to any other remediation efforts that you create.

</td></tr><tr><td>

In remediation task

</td><td>

If `true`, this value indicates that a record is already in a remediation task. Records can be in multiple remediation tasks, but a record can be added only to one remediation effort.

</td></tr><tr><td>

Exploit exists

</td><td>

Indicates if a known exploit exists for a record.

</td></tr><tr><td>

Last opened

</td><td>

Date when the record was last opened in your ServiceNow AI Platform. If the record was closed and then reopened, this is the last time the record was reopened.

</td></tr></tbody>
</table>4.  To create a remediation effort, click **Create Remediation Effort**.

    When you create remediation effort, records already in existing remediation efforts are not added to any new remediation efforts that you create from this watch topic.

    As records are updated or new records are created in watch topics, you can create remediation efforts.

5.  Alternatively, you can [Create a recurring remediation effort in the Security Exposure Management Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-create-recurringRE-steal-VI.md).

    The **Edit** button is available in the menu for existing remediation efforts. You have the option to modify the fields and conditions from a modal that is displayed. Any changes you make and save to the remediation effort record do not affect any of the other remediation efforts you have already created from the watch topic.

6.  In step 1 of the Create Remediation Effort modal, fill in the fields.

    In the Short description field, enter text that describes the recurring remediation effort and helps you locate and track it from the effort list.

    In the Description field, enter more text about the context of the effort that helps you locate it easily from the list of remediation efforts.

7.  In step 2, Task generation, choose one method from the list to bundle the records in the remediation tasks that you generate from this remediation effort after it is created.

    |Option|Description|
    |------|-----------|
    |**By Assignment group**|Records with same assignment group are bundled into one Remediation Task.|
    |**By Assignment group and configuration item**|Records with same assignment group and Configuration Item are bundled into one Remediation Task.|
    |**By Assignment group and \(vulnerability or configuration test\)**|Records with same assignment group and Configuration Item are bundled into one Remediation Task.|
    |**None \(No remediation tasks are created\).**|Use this method if you want to add records manually to a remediation task for this effort. See [Create a remediation task on-demand from Remediation Effort in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-create-rt-frm-re.md).|

8.  To automatically refresh the duplicate host vulnerable items, you must select the **Automatically refresh duplicate vulnerable items for the created remediation tasks** check box.

    **Note:** This check box is available only for Host Vulnerabilities.

9.  In step 3, Transfer, verify how many records you want to add to the remediation effort and see how many records are available for transfer from other active remediation efforts.

    If there are no new, active records to add, the following text is displayed:

    `There are no available active records that you can add to this new remediation effort.`

    Any additional records that are available for transfer to this effort are listed under `Additional matching records` .

    Select the **Transfer matching records from other active remediation efforts** check box and then select the check boxes for the records you want to transfer from other active remediation efforts.

    After you select **Create Remediation Effort**, in a few moments, the new remediation effort is displayed. Depending on the number of records, it may take some time to populate the new record. A message indicates if the record is still populating.

    The new remediation effort is created with any records that are available from the watch topic used to create it, in addition to any records that you selected for transfer from existing efforts.

    If you select records to transfer from an existing effort, and the existing effort transfers all of its records into your new effort, the remediation effort you moved the records from is closed. For more information on how the Remediation Tasks associated with the Remediation Efforts are impacted by the records transfer, see [Life cycles of remediation efforts, remediation tasks, and records in the Vulnerability Response Workspaces](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-re-lifecycle.md).

    **Note:** If there are not any records available from the watch topic, or any records selected for transfer, the **Create Remediation Effort** button is deactivated.

    The **Populate Efforts** scheduled job runs every 10 minutes to populate the data in the widgets based on the condition selected.

    Select Remediation Progress tab to view the remediation progress. Select any item to view details including record type, risk score, risk rating, percentage of records remediated, records in deferred and non-deferred state and total number of records, conditions used in the watch topic, and remediation status. The Remediation Status information such as Remediation target and Remediation status is rolled up from the Vulnerable Items table. The highest record risk score is rolled-up from the Vulnerability Calculators table while risk score is rolled up from the **Vulnerability Rollup Calculators** &gt; **Remediation Effort Rollup**.

    The Remediation Tasks tab displays the tasks for all types of issues. The fields are populated when the following scheduled jobs run. They are executed automatically every 15 minutes:

    -   Rollup application vulnerable item values to vulnerability and group.
    -   Rollup container vulnerable item values to vulnerability and group.
    -   Rollup test result values to test result group and configuration test.
    -   Rollup vulnerable item values to vulnerability and group.
    In the Lists view, you can view the Remediation efforts, Remediation Tasks, Vulnerable Items, Configurations Test Results and so on. You can open a remediation task or a vulnerable item and view the Details page. Select the More Actions ellipses and select **Start Investigation** to resolve a remediation task.

10. You can also edit existing recurring remediation efforts.

    If there is an existing recurring remediation effort for a watch topic, **Edit recurring effort** is available from the menu in the upper right of a watch topic. Choose this option to edit the recurring effort.

    Any changes you make and save to the remediation effort record do not affect any of the other remediation efforts you have already created from the watch topic.


**Parent Topic:**[Use Remediation Effort records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-ws-remed-eff-rcd.md)