{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45220,"path":"security-management/sem-health-dashboard-overview.md","title":"Security Exposure Management Workspace Health dashboard","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security Exposure Management Workspace Health dashboard\n\nThe Vulnerability Response Health dashboard is a tool designed to empower organizations with comprehensive insights into the implementation and usage of their Security Exposure Management applications.\n\nThe overall health assessment is determined by aggregating various critical factors across configuration, implementation, integration, performance, data, and process. View the aggregate dashboard for each category for the following applications:\n\n-   Vulnerability Response\n-   Application Vulnerability Response\n-   Container Vulnerability Response\n-   ​Configuration Compliance​\n\n## Installing the SecOps Vulnerability Response Health Dashboard\n\nTo install and configure the SecOps Vulnerability Response Health Dashboard for Vulnerability Response applications in your ServiceNow AI Platform instance, navigate to the ServiceNow® Store and activate the SecOps Health Analytics \\(sn\\_sec\\_analytics\\) plugin.\n\n## Required ServiceNow AI Platform roles\n\nRoles required: sn\\_sec\\_analytics.admin, sn\\_sec\\_analytics.read\n\n## Scheduled job\n\nTo view the scheduled job, navigate to **All** &gt; **System Scheduler** &gt; **Scheduled Jobs** &gt; **Collect health dashboard metrics**. The 'Collect health dashboard metrics' scheduled job is run daily at 00:00 hours. It generates the data for the SecOps Vulnerability Response Health dashboard. You can choose to run the scheduled job manually as well.\n\n## Accessing the SecOps Vulnerability Response Health Dashboard\n\nTo access the SecOps Vulnerability Response Health Dashboard,\n\n1.  Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.\n\n2.  Select the **Dashboards** icon.\n3.  Select **SecOps Vulnerability Response Health Dashboard** from the drop-down list.\n\n## Use cases\n\nFor examples of how people in your organization would use this dashboard, see these use cases.\n\n<table id=\"table_hk1_msm_hpb\"><thead><tr><th>\n\nUser\n\n</th><th>\n\nDashboard use\n\n</th></tr></thead><tbody><tr><td>\n\nVulnerability admin\n\n</td><td>\n\nHelps you gain an understanding of the health score of the Unified Security Exposure Management applications. It’s also helpful to highlight the areas that need improvement. The Vulnerability Response Health Dashboard deals with the implementation and usage health only. It doesn’t assist with management of findings.\n\n</td></tr><tr><td>\n\nSupport admin\n\n</td><td>\n\nHelps you to identify the performance, customization, and configuration issues using KPIs. Based on the application health, you can perform an extra analysis or provide a recommendation to the users.\n\n</td></tr><tr><td>\n\nImplementation partner\n\n</td><td>\n\nHelps you to evaluate the Unified Security Exposure Management implementation health for configurations, add-ons, customizations, and integrations, and provide improvement recommendations for the users.\n\n</td></tr></tbody>\n</table>## The SecOps Vulnerability Response Health Dashboard tabs\n\nTo view the SecOps Vulnerability Response Health dashboard, navigate to **Security Operation Health** &gt; **Vulnerability Response Health**. Each color in the dashboard represents the following:\n\n-   Green: Safe\n-   Yellow: Warning\n-   Red: Critical\n\nThis dashboard communicates the overall health score for the configuration and remediation health of the Unified Security Exposure Management applications.\\[Omitted image \"secops-vr-health-dashboard-summary.png\"\\] Alt text: SecOps - VR Health dashboard - Summary tab\n\nThis dashboard displays the configuration and integration health of your implementation. It provides a holistic overview of the implementation performance.\\[Omitted image \"secops-vr-health-dashboard-system-health.png\"\\] Alt text: SecOps - VR Health dashboard - System Health tab\n\nThis dashboard displays the data health of the Unified Security Exposure Management applications.\\[Omitted image \"secops-vr-health-dashboard-rem-health-tab.png\"\\] Alt text: SecOps - VR Health dashboard - Remediation Health tab\n\nThis dashboard displays the trends for the findings ingestion performance metrics for the past 30 days for the Unified Security Exposure Management applications.\\[Omitted image \"secops-vr-health-dashboard-trends.png\"\\] Alt text: SecOps - VR Health dashboard - Trends tab\n\n## Reports\n\n**Note:** The threshold values are a part of the base system. You can configure the values based on your requirements.\n\n|Title|Description|\n|-----|-----------|\n|Overall health|Overall health score for the Unified Security Exposure Management applications. For more information, see the reports for the metrics.|\n|Configuration|Overall configuration health of the Unified Security Exposure Management applications.|\n|Implementation health|Overall implementation health of the Unified Security Exposure Management applications.|\n|Integration health|Overall integration health of the Unified Security Exposure Management applications.|\n|Performance|Overall performance health score of the VR applications.|\n|Data health|Overall data health of the Unified Security Exposure Management applications.|\n|Process health|Overall process health score of the Unified Security Exposure Management applications.|\n\n|Title|Description|Considerations for improving performance|Threshold warning|Threshold critical|\n|-----|-----------|----------------------------------------|-----------------|------------------|\n|Configuration|\n|Auto-delete rules|Displays the number of enabled auto-delete rules.|Review and resolve the inactive auto-delete rules.|3|1|\n|Auto-close stale records|Closes stale detections automatically. For more information, see the[Closing stale detections and findings automatically using auto-close rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-closing-stale-findings-automatically.md).|Reduce the volume of stale detections. Enable this option to close the stale detections that aren’t closed by the scanners.|3|1|\n|Implementation health|\n|Customized script includes|Number of 'script includes' customized.|Minimize customized 'script includes' for easier upgrades.|10|12|\n|Business rules on the detections table|Number of customized business rules in the detection table.|Minimize business rules for easier upgrades.|4|8|\n|Customized business rules|Number of customized business rules before creation of records in the CMDB.|Use the default business rules on records.|5|8|\n|Upgrade conflicts|Conflicts such as business rules and scripts identified on an upgrade.|Review and resolve the upgrade conflicts.|10|15|\n|PA installed but not activated|Indicates if the Performance Analytics dashboard is not enabled.|Activate the PA dashboard.|10|15|\n|Integration health|\n|Disabled integrations|Number of integrations that have been disabled.|Review and enable the required integrations.|6|9|\n|Failed integration runs in the past week|Number of integration runs that weren’t successful in the past week.|Review and resolve the cause of the failed integration runs.|9|12|\n|Performance|\n|Slow business rules and scripts|Business rules and scripts whose average execution time greater than 10 ms and execution count greater than 10,000.|Review and resolve the slow-running business rules.|10|15|\n|Stalled integrations|Number of integrations that were timed-out before completion.|Review and resolve the cause of the stalled integrations.|10|15|\n|Failed or stalled background jobs|Failed or timed-out background jobs in the past week.|Review and resolve the cause of the failed jobs.|5|10|\n|Slow queries|Queries whose average execution time is greater than 10 ms and execution count is greater than 10,000.|Review and resolve the slow-running business rules.|10|15|\n\n<table id=\"table_s4x_2hj_nvb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nDescription\n\n</th><th>\n\nConsiderations for improving performance\n\n</th><th>\n\nThreshold warning\n\n</th><th>\n\nThreshold critical\n\n</th></tr></thead><tbody><tr><td colspan=\"5\">\n\nData Health\n\n</td></tr><tr><td>\n\nDiscovered item matching rate\n\n</td><td>\n\nNumber of discovered items matched to existing CIs.\n\n</td><td>\n\nReview the health of your CMDB and the CI lookup rules logic.\n\n</td><td>\n\n50\n\n</td><td>\n\n20\n\n</td></tr><tr><td>\n\nUnmatched CIs in discovered items\n\n</td><td>\n\nDiscovered items in unmatched state.\n\n</td><td>\n\nReview the health of your CMDB and the CI lookup rules logic.\n\n</td><td>\n\n9\n\n</td><td>\n\n12\n\n</td></tr><tr><td>\n\nUnused CI lookup rules\n\n</td><td>\n\nCI lookup rules that aren’t associated with any discovered item.\n\n</td><td>\n\nChange the status of the unused CI lookup rules to inactive.\n\n</td><td>\n\n4\n\n</td><td>\n\n6\n\n</td></tr><tr><td>\n\nDiscovered item with no CI\n\n</td><td>\n\nDiscovered item with no configuration item.\n\n</td><td>\n\nReview and reapply CI lookup rules.\n\n</td><td>\n\n9\n\n</td><td>\n\n12\n\n</td></tr><tr><td>\n\nDefective active records\n\n</td><td>\n\nRecords without a configuration item or vulnerability.\n\n</td><td>\n\nRetire the CIs using the CMDB CI Lifecycle Management option.**Note:** Deleting CIs directly can result in orphan VITs.\n\n</td><td>\n\n40\n\n</td><td>\n\n60\n\n</td></tr><tr><td>\n\nRemediation tasks without assignment group\n\n</td><td>\n\nActive remediation tasks whose assignment group is yet to be assigned.\n\n</td><td>\n\nAssign remediation tasks to an assignment group and review the existing assignment rules.\n\n</td><td>\n\n40\n\n</td><td>\n\n60\n\n</td></tr><tr><td>\n\nClosed records without substate\n\n</td><td>\n\nRecords that are closed without a substate.\n\n</td><td>\n\nProvide information in the Reason field while closing the records.\n\n</td><td>\n\n40\n\n</td><td>\n\n50\n\n</td></tr><tr><td colspan=\"5\">\n\nProcess Health\n\n</td></tr><tr><td>\n\nActive records without risk score\n\n</td><td>\n\nActive records with a risk score of 0 or with no risk score assigned.\n\n</td><td>\n\nReview and resolve the risk rules.\n\n</td><td>\n\n40\n\n</td><td>\n\n60\n\n</td></tr><tr><td>\n\nUnassigned active records\n\n</td><td>\n\nRecords without an assignment group.\n\n</td><td>\n\nAssign a group to the records and review the existing assignment rules.\n\n</td><td>\n\n30\n\n</td><td>\n\n50\n\n</td></tr><tr><td>\n\nItems without Remediation Target\n\n</td><td>\n\nItems without a remediation target date.\n\n</td><td>\n\nReview and resolve the remediation target rules. These rules must include all the records.\n\n</td><td>\n\n30\n\n</td><td>\n\n50\n\n</td></tr><tr><td>\n\nUngrouped active records\n\n</td><td>\n\nRecords that aren’t included in a remediation task rule.\n\n</td><td>\n\nReview the remediation task rules.\n\n</td><td>\n\n40\n\n</td><td>\n\n60\n\n</td></tr></tbody>\n</table>|Title|Description|\n|-----|-----------|\n|Last 30 days vulnerable item ingestion performance metrics|Average time taken to ingest vulnerable items and process multiple rules in the past 30 days.|\n\n"}}