---
title: Modify the vulnerability assessment record
description: Update the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.Delete a vulnerability event record if it is no longer required.Add additional links and information related to the assessment record.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.html
release: australia
product: Vulnerability Response Workspaces
classification: vulnerability-response-workspaces
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 5
keywords: [Modify the vulnerability assessment record, Update Vulnerability Assessment Risk Rule, Modify Vulnerability Assessment Risk Rule, Delete associated CVEs or affected products from the vulnerability assessment record, Delete a vulnerability event record, Add related link to the assessment record, Add related link to the assessment record in the Vulnerability Assessment Workspace]
breadcrumb: [Exploring vulnerability assessment, Explore the Vulnerability Assessment Workspace, Vulnerability Response Workspaces, Unified Security Exposure Management, Security Operations]
---

# Modify the vulnerability assessment record

Update the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.

## Before you begin

Role required: sn\_vul\_analyst.vul\_event\_manager

## About this task

After the primary CVE is added to the vulnerability assessment, the record is moved to a Pending Assessment state. You can further add other related CVEs in the **Vulnerability Entries**tab or add the products affected by this vulnerability from the **Affected Products** tab. You can make further modifications to the **Risk Assessment** fields and the **Risk Score** for the assessment record is automatically updated accordingly. You can add or modify the CI filter to control which configuration items are collected in the next assessment run.

## Procedure

1.  Navigate to **All** > **Vulnerability Assessment Workspace** > **Vulnerability Assessment**.

2.  On the **Details** tab, update the fields.

<table id="table_hdr_jnr_fzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Title

</td><td>

Title describing the vulnerability event record.

</td></tr><tr><td>

Primary CVE

</td><td>

Primary CVE which you associated with the event record.

</td></tr><tr><td>

State

</td><td>

Current state of the event record.

</td></tr><tr><td>

Priority

</td><td>

Priority of the event record on a scale of 1-5.**Note:** When you change the priority of a vulnerability assessment \(VA\), the system automatically updates the priority of all associated VITs and AVITs with source ServiceNow. If a VIT or AVIT is linked to multiple assessments, the system assigns the minimum priority value \(highest severity\) from all linked assessment records.

</td></tr><tr><td>

Alert Source

</td><td>

Source of the potential vulnerability event.

</td></tr><tr><td>

Source

</td><td>

Read-only. Identifies the system that created the assessment record, such as a value passed by the [CVE Exposure Assessment REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-va-ws-cve-exposure-assessment-api.md). This field is empty for assessment records created manually in the workspace.

</td></tr><tr><td>

Risk Score

</td><td>

Auto-calculated risk score. Not editable by default.

</td></tr><tr><td>

Exposure-level

</td><td>

The exposure level of the vulnerability event on a scale of 1-5.

</td></tr><tr><td>

Assignment Group

</td><td>

The assignnment group to whom the event record is assigned.

</td></tr><tr><td>

Assigned To

</td><td>

The user the event record is assigned to.

</td></tr><tr><td>

Description

</td><td>

Detailed description of the event record.

</td></tr><tr><td>

CI Filter

</td><td>

Optional condition builder that filters the CIs collected during assessment using fields from the CI \[cmdb\_ci\] table.

</td></tr></tbody>
</table>3.  Navigate to the **Vulnerability Entries** tab to add associated or related CVEs.

    1.  Select **New**.

    2.  Search for the record in the **Vulnerability entry** field.

    3.  Select the vulnerability record you want to associate with the assessment record.

    4.  Select **Browse** to browse and attach a file.

    5.  Select **Save**.

    The vulnerability records you selected are added to the assessment record and display in the **Vulnerabilities Entries** tab.

4.  Add affected products.

5.  [Add related link to the assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md).

6.  Modify the **Risk Attributes** for the primary CVE associated with the vulnerability assessment event record.

<table id="table_rdf_5t5_fzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Memory corruption

</td><td>

Indicates whether this event record can corrupt memory.

</td></tr><tr><td>

Remote code executable

</td><td>

Indicates if the remote code execution is possible.

</td></tr><tr><td>

Local privilege escalation

</td><td>

Indicates if local privilege escalation vulnerability exists.

</td></tr><tr><td>

Unauthorised access

</td><td>

Indicates if unauthorised access vulnerability exists.

</td></tr><tr><td>

DDOS

</td><td>

Indicates if the potential event could involve Distributed Denial of Service.

</td></tr><tr><td>

Attack Complexity

</td><td>

Indicates the complexity of the attach. Options are Low, Medium, or High.

</td></tr><tr><td>

Attack vector

</td><td>

Indicates the potential pathway or method of attack. Options are– Network, Adjacent network, Local, Physical, None.

</td></tr><tr><td>

Privileges required

</td><td>

Indicates the level of privileges an attacker required to exploit the vulnerability. Options are None, Low or High.

</td></tr><tr><td>

User interaction

</td><td>

Indicates whether or not user interaction is needed to exploit the vulnerability.

</td></tr><tr><td>

Confidentiality impact

</td><td>

Indicates the measure of the potential impact on confidentiality of the vulnerability.Options are None, Low, or High

</td></tr><tr><td>

Scope change

</td><td>

Indicates if the scope if the assessment has changed.

</td></tr><tr><td>

Availability impact

</td><td>

Indicates the potential impact to availability of a successfully exploited misuse vulnerability. Availability refers to the accessibility of information resources.Options are None, Low, or High

</td></tr><tr><td>

Integrity impact

</td><td>

Indicates the potential impact to integrity of a successfully exploited misuse vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information.Options are None, Low, or High

</td></tr><tr><td>

Remediation level

</td><td>

Indicates the status or availability of remediation for the vulnerability. Options are Official Fix, Temporary Fix, Workaround, Unavailable, Not defined.

</td></tr><tr><td>

Exploit code maturity

</td><td>

Indicates the likelihood of the vulnerability being exploited based on the existing state of exploit techniques and code availability.Options are Unproven, Proof-of-concept, Functional, High, and Not defined.

</td></tr><tr><td>

Report confidence

</td><td>

Indicates how confident you are that the vulnerability exists.

</td></tr></tbody>
</table>7.  Enter relevant comments in the **Compose** field.

    -   Enter your work notes in the **Work notes \(Private\)** field.
    -   Enter your comments \(visible to everyone\) in the **Comments** field.
8.  **Save** the assessment record.

    Based on the updates you made to the **Risk attribute** fields for the primary CVE or the affected product associated with the assessment record, the **Risk score** field is automatically updated.

    **Note:** To modify the base system risk score calculator rules or criteria, navigate to **All** &gt; **Vulnerability Assessment Calculators** &gt; **Vulnerability Assessment Risk Calculator** &gt; **Vulnerability Assessment Risk Rule**. You can add criteria and modify the field level weightage to existing criteria as needed.


## What to do next

Perform an initial assessment of the event record.

## Delete associated CVEs or affected products from the vulnerability assessment record

Delete a vulnerability event record if it is no longer required.

### Before you begin

Role required: sn\_vul\_analyst.vul\_event\_manager

### About this task

You can delete CVEs or affected products associated with the vulnerability assessment record. You can only delete vulnerability entries/associated CVEs or affected products if they are in **New** or **Pending assessment** states.

### Procedure

1.  Navigate to **All** &gt; **Workspaces** &gt; **Vulnerability Assessment**.

2.  Select the vulnerability assessment record.

3.  Select the **Vulnerability Entries** tab or the **Affected Products** tab.

4.  Select the associated CVE or the affected product record.

5.  Select **Delete**.

    **Note:** The **Delete** button displays only for an assessment record when they are in **New** or **Pending Assessment** states.


## Add related link to the assessment record

Add additional links and information related to the assessment record.

### Before you begin

Role required: sn\_vul\_analyst.vul\_event\_manager

### Procedure

1.  Navigate to **Workspaces** &gt; **Vulnerability Assessment Workspace**.

2.  Select the assessment record entry.

3.  Select the **Related Links** tab.

4.  Enter a relevant description in the **Description** field.

5.  Enter the URL in the **Link** field.

6.  Select **OK**.

    The related link is added and listed on the Related Links tab.