{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45178,"path":"security-management/sem-configure-classification-rules.md","title":"Configuring classification rules","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configuring classification rules\n\nBy configuring classification rules, you can ensure consistent categorization and processing of vulnerabilities, discovered items and other finding related entities based on key attributes. This helps the system route findings to the correct tables, apply the appropriate grouping, assignment, and remediation rules, enhance reporting accuracy, and determine which business logic to use \\(such as prioritization and remediation targets\\).\n\nConfiguration of classification rules includes the following steps.\n\n**Parent Topic:**[Configure rules to manage findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-configure-rules-manage-findings.md)\n\n**Related topics**  \n\n\n[Categorizing findings and discovered items using classification rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-categorizing-findings-discovered-items.md)\n\n## Create and edit a classification group\n\nCreate groups so that the underlying rules of this group can classify the entities or records in a specified table based on the conditions. The rules can be used to select any field in the corresponding table.\n\n### Before you begin\n\nRole required: See [Access control lists \\(ACLs\\) for administration rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-acls-for-admin-rules.md)\n\n### Procedure\n\n1.  Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.\n\n2.  Select **Review** on the **Classification rules** tile.\n\n3.  On the Rules page, select **Classification** in the navigation pane.\n\n4.  Select **New**.\n\n5.  On the form, fill in the fields.\n\n<table id=\"table_z5k_bwb_glb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td colspan=\"2\">\n\nDetails\n\n</td></tr><tr><td>\n\nName\n\n</td><td>\n\nName of the new classification group.\n\n</td></tr><tr><td>\n\nTable\n\n</td><td>\n\nTable based on which the rules are executed.**Note:** The base system includes classification groups for discovered items and vulnerability entries.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nOption to activate the group.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nDescription of the new classification group.\n\n</td></tr></tbody>\n</table>6.  Select **Save**.\n\n\n## Create or edit classification rules\n\nCreate rules to classify entities or records in the specified table into choice of classifications for use in downstream process or rules.\n\n### Before you begin\n\nRole required: See [Access control lists \\(ACLs\\) for administration rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-acls-for-admin-rules.md)\n\n### Procedure\n\n1.  Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.\n\n2.  Select **Administration** in the navigation pane.\n\n3.  Select **Review** on the **Classification rules** tile.\n\n4.  On the Rules page, select **Classification** in the navigation pane.\n\n5.  Select a classification group.\n\n6.  Select **New rule** and fill in the fields on the form:\n\n<table id=\"table_vks_thr_ns\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td colspan=\"2\">\n\nDetails\n\n</td></tr><tr><td>\n\nName\n\n</td><td>\n\nName of the new classification rule.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nOption to activate the rule.\n\n</td></tr><tr><td>\n\nClassification group\n\n</td><td>\n\nClassification group for which the rule is being created. This field is auto-populated.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nDescription of the new classification rule.\n\n</td></tr><tr><td colspan=\"2\">\n\nIf this condition is met\n\n</td></tr><tr><td>\n\nCondition type\n\n</td><td>\n\nType of condition for the rule. Choices are as follows:-   **Filter**: Basic filter conditions for determining whether to use the rule or not.\n-   **Filter group**: Set of multiple conditions that are used together. The rule is evaluated based on the conditions defined in the filter group.\n-   **Script**: Scripted condition used to determine when to apply this rule.\nThis field appears only when the **Advanced view** option is selected.\n\n</td></tr><tr><td>\n\nCondition\n\n</td><td>\n\nCondition for the rule. Define conditions based on the column selected on the required vulnerability entry column. You can add multiple conditions to refine the rule. This field appears only when **Filter** is selected from the **Condition type** field.**Note:** When defining multiple conditions or templates, you can select only from a parent and a child table. You can’t select from two or more child tables.\n\n</td></tr><tr><td>\n\nFilter group\n\n</td><td>\n\nGroup of filters. The group is defined when a set of conditions is used repeatedly in multiple places. Select the lookup using the lookup list icon to select the filter group. For more information, see [Create and define filter groups in Security Operations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-filter-group.md). This field appears only when **Filter group** is selected from the **Condition type** field.\n\n</td></tr><tr><td>\n\nScript\n\n</td><td>\n\nScript that is evaluated to determine when to apply this rule. You can write your code and set the response as either true or false. This field appears only when **Script** is selected from the **Condition type** field\n\n</td></tr><tr><td colspan=\"2\">\n\nSet these values\n\n</td></tr><tr><td>\n\nClassification\n\n</td><td>\n\nClassification of the rule. The list includes the following options:-   Platform\n-   Application\n-   Service\n-   Business Application\n Alternatively, you can enter your own classification that is not in the list.\n\n</td></tr><tr><td>\n\nClassification type\n\n</td><td>\n\nType of classification. This field shows the filtered list of classification types based on your selected value for the **Classification** field.\n\n</td></tr><tr><td>\n\nValue type\n\n</td><td>\n\nType of the value that is assigned by using this rule. Choices are as follows:-   **Template**: Select a template. You can use a required template.\n-   **Script**: Select a pre-existing script, or write your own custom script.\nThis field appears only when the **Advanced view** option is selected.\n\n</td></tr><tr><td>\n\nField\n\n</td><td>\n\nOption to select another field for the rule apart from the **Classification** and **Classification type** fields. Select a combination of fields and values that you want to set when the rule is evaluated.\n\n</td></tr><tr><td>\n\nScript value\n\n</td><td>\n\nScript to set values on the current record. This field defines what values to set on the fields in vulnerability entries. This field appears only when **Script** is selected from the **Value type** field.\n\n</td></tr></tbody>\n</table>7.  Select **Save**.\n\n\n## Reapply a classification rule to existing records in the table\n\nRerun all active rules on all the findings when you modify a classification rule. You can also update existing vulnerabilities by applying the new classification rules.\n\n### Before you begin\n\nRole required: See [Access control lists \\(ACLs\\) for administration rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-acls-for-admin-rules.md)\n\n### Procedure\n\n1.  Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.\n\n2.  Select **Administration** in the navigation pane.\n\n3.  Select **Review** on the **Classification rules** tile.\n\n4.  On the Rules page, select **Classification** in the navigation.\n\n5.  Select the classification group or rule you want to reapply.\n\n6.  Select **Reapply**.\n\n\n## Deactivate or delete a classification rule\n\nDeactivate or delete a classification rule if it is no longer needed or relevant.\n\n### Before you begin\n\nRole required: See [Access control lists \\(ACLs\\) for administration rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-acls-for-admin-rules.md)\n\n### About this task\n\nWhen a classification rule is deactivated or deleted, the data that was populated in the **Classification** and **Classification\\_type** fields by that deleted rule remains in their respective tables.\n\nIf you want to clear this data, create a rule with empty values in the **Classification** and **Classification\\_type** fields and reapply the group. Once this new rule is reapplied, the changes are reflected on all the records that this rule is applicable for, based on the conditions of the rule.\n\nIf a classification rule is deleted or deactivated, it’s no longer applied to the specified table and the data in the **Classification** and **Classification\\_type** fields get cleared.\n\n### Procedure\n\n1.  Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.\n\n2.  Select **Administration** in the navigation pane.\n\n3.  Select **Review** on the **Classification rules** tile.\n\n4.  On the Rules page, select **Classification** in the navigation.\n\n5.  Select the rule that you want to delete.\n\n6.  In the classification rules form, select the ellipses next to the **Update** button.\n\n7.  Select **Delete**.\n\n    **Note:** If you don't click this button, the rule continues to reside in the system. Findings referenced by the rule continue to reference them.\n\n\n"}}