{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45258,"path":"security-management/sem-vuln-calc-define-risk-rule-fields.md","title":"Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators","bundle":null,"doc_type":null,"release":"australia","body":"\n# Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators\n\nCustomize risk rule parameters and weights to generate risk scores that reflect your organization's specific finding and asset data. By selecting relevant fields for the risk rule, you can create an effective risk scoring framework that meets your organization's unique needs.\n\n## Before you begin\n\nAdditionally, you can use attributes in the configuration\\_item \\[cmdb\\_ci\\] in the Configuration Management Database \\(CMDB\\) to help you create logic for your Unified Security Exposure Management risk calculators. If, for example, you determine that CIs that are external-facing in your organization are more vulnerable and might require immediate remediation, you can assign attributes such as **Internet Facing** for these CIs. This attribute, and others, are listed in the Common Service Data Model release notes for the Orlando family release. For current information and guidance on the CMDB, see the following topics:\n\n- [Common Service Data Model conceptual model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/csdm-conceptual-model.md)\n- [CMDB schema model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/c_ConfigurationManagementDatabase.md)\n\nRole required: sn\\_sec\\_cmn.admin \\(read-only viewers: sn\\_sec\\_cmn.read\\)\n\n## Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Administration** > **Vulnerability Calculators**.\n\n2. On the Vulnerability Calculators page, select **Default Risk Calculator**.\n\n3. Navigate to **Vulnerability Calculator page** > **Vulnerability Calculator Rules tab** > **Default Risk Rule**.\n\n4. In the Risk Calculator Criteria section of the Vulnerability Risk Rule page, set the weight for each criterion according to its importance in the overall risk score calculation.\n\n5. To deactivate the rule, you must clear the **Active** check box.\n\n6. To add risk rule fields to the Risk Calculator Criteria, select **Add criteria**.\n\n7. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nChoose reference table\n\n\n\nTable that you use to define the risk score weightage. You can select one of these options:- **Vulnerable Item**: Add fields that are directly dot-walkable from the vulnerable item \\(VI\\).​\n- **Vulnerable Item - Configuration Item**: Add dot-walkable fields that are part of the base table extensions, such as the Hardware table. These fields aren’t part of the base table \\(cmdb\\_ci\\).\n- **Vulnerable Item - Vulnerability**: Add dot-walkable fields that are part of the tables that extend the base table, for example, third party Entry. These fields aren’t part of the Vulnerability Entry base table.\n- **Vulnerable Item Reference Table**: Add fields that are a part of the Related tables \\(m2m\\) or tables that have a reference to the vulnerable item. These fields aren’t directly dot-walkable from the VI.\n- **Configuration Item Reference Table**: Add fields that are a part of the Related tables \\(m2m\\) of cmdb\\_ci or tables that have a reference to cmdb\\_ci. These fields aren’t directly dot-walkable from the VI.\n- **Vulnerability Reference Table**: Add fields that are a part of the Related tables \\(m2m\\) of sn\\_vul\\_entry or tables that have a reference to sn\\_vul\\_entry. These fields aren’t directly dot-walkable from the VI.\n- **Custom Conditions**: Use this option to assign weights to the rule by evaluating the condition. For example, the internet-facing filter determines if a configuration item \\(CI\\) is external or internal.\n\n\n
\n\nTable\n\n\n\nField that appears only when one of the following options is selected from the Choose reference table:- **Vulnerable Item -> Configuration Item**\n- **Vulnerable Item -> Vulnerability**\n- **Vulnerable Item Reference Table**\n- **Configuration Item Reference Table**\n- **Vulnerability Reference Table**\n\n\n
\n\nField\n\n\n\nField to be used for risk score calculation for this rule.\n\n
\n\nAggregation\n\n\n\nField that appears only when a reference table is selected from the Choose reference table. Select the minimum or maximum value to be considered for calculations when Field is selected from the Related tables \\(m2m\\).\n\n
\n\nWeight\n\n\n\nWeightage of this field within the risk rule. The value must be an integer from 0 through 100.\n\n
\n\nDefine Value Weightage\n\n\n\nComponent to assign weights to each field value. For numeric fields, field values can be defined as a range \\(for example, 1–5\\). The weights must be integer between 0–100.**Note:** This field doesn’t appear if the Custom Conditions option is selected from the Choose reference table.\n\n
\n\nCondition table\n\n\n\nField that appears only when Custom conditions are selected from the Choose reference table. Select a condition from the list.\n\n
\n\nField name\n\n\n\nField that appears only when Custom conditions are selected from the Choose reference table. Enter a name for the risk criteria.\n\n
\n\nCondition\n\n\n\nField that appears only when Custom conditions are selected from the Choose reference table. Preview the items in this table that match the defined conditions.**Note:** After you integrate with Early Warning for Security Exposure Management, the early warning flag and Admiralty score become available as risk rule criteria, giving you finer control over how early warnings affect your vulnerability scores. For more information, see [Early Warning for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/armis-early-warning-integration.md).\n\n
8. Select **Submit**.\n\n9. In the Rule page, activate and reapply the rule to reevaluate the risk score on the active vulnerable items.\n\n **Note:** Starting with version 23.0 of Vulnerability Response, in case of:\n\n - **Default Risk Calculator** rule: Whenever the risk score on a vulnerable item \\(VIT\\) changes, the following details are documented in the Notes section of the VIT:\n - Calculator group name\n - Calculator name\n - Field values that have a weightage greater than 1 and their risk score contribution.\n - Final risk score\n - **Vulnerability Severity** risk rule: Whenever the risk score is updated on a VIT, the **Notes** section is updated with the following details:\n - Calculator group name\n - Calculator name: Depending on whether the calculator rule is based on a template or a script, the name is appended with the details in brackets. To modify or view the basis of the calculator rule, select any rule and select the **Advanced view** check box. From the **Value type** drop-down box, select the required option. If **Template** is selected, the risk score is updated according to the specified condition in the rule. If **Script** is selected, you can either add or update the existing script.\n\n## Example\n\nExample 1: Add a source severity as a criterion for a risk rule.\n\nUse case: Third-party vendors, like Qualys and Tenable, provide their own scores. These scores are populated in the **Source Severity** field on the sn\\_vul\\_entry table. Use this field for risk score calculations. To use this score to compute the risk score, do the following:\n\n1. Navigate to the Risk rule page.\n2. To deactivate the rule, clear the **Active** check box.\n3. To add risk rule fields to the Risk Calculator Criteria, select **Add criteria**.\n4. From the Choose reference table list, select **Vulnerable item**.\n5. From the Field list, select **Vulnerability.Source Severity**.\n6. In the **Weight** field, enter the relative importance of this field within the risk rule. The value must be an integer from 0 through 100.\n7. In the Define Value Weightages section, add field values, and assign a weight to them.\n8. Select **Submit**.\n\nExample 2: Add a business criticality as a criterion for a risk rule.\n\nUse case: Let's assume your organization has many business services. The configuration item \\(CI\\) LINUX-SF-6381 is being used by the following services:\n\n|Business service|Criticality|\n|----------------|-----------|\n|Cloud Management|1 - Most critical|\n|E-Commerce|2 - Somewhat critical|\n|Client services|3 - Less critical|\n|Travel and Expense|4 - Not critical|\n\nThe mapping between the CI and services is stored in the Related Services \\[sn\\_vul\\_m2m\\_ci\\_services\\] table. When a vulnerability is found in the asset LINUX-SF-6381, a vulnerable item \\(VI\\) is created. You can use the value of the business criticality from the affected services to compute the risk score for this VI. To use the criticality value of these services to compute the risk score, do the following:\n\n1. Navigate to the Risk rule page.\n2. To deactivate the rule, clear the **Active** check box.\n3. To add risk rule fields to the Risk Calculator Criteria, select **Add criteria**.\n4. From the Choose reference table list, select **Configuration Item Reference Table**.\n5. From the Table list, select **Related Services \\[sn\\_vul\\_m2m\\_ci\\_services\\]**.\n6. From the Field list, select **Service.Business criticality**.\n7. In the **Aggregation** field, select **Minimum** to retrieve the most critical service for this use case \\(**1- Most critical** value\\) or Maximum to retrieve the least critical service for this use case \\(**4 – Not critical** value\\) for this use case.\n8. In the **Weight** field, enter the relative importance of this field within the risk rule. The value must be an integer from 0 through 100.\n9. In the Define Value Weightages section, add field values, and assign a weight to them.\n10. Select **Submit**.\n\nExample 3: Add a conditional criterion to the risk calculator.\n\nLet's assume that an organization has multiple configuration items \\(CIs\\), of which only a few can be accessed by an external user. You can add risk score weightages for these outward-facing CIs.\n\n**Note:** You can identify these CIs by their name. The names start with 'external'.\n\nTo add a conditional criterion to the risk rule, do the following:\n\n1. Navigate to the Risk rule page.\n2. To deactivate the rule, clear the **Active** check box.\n3. To add risk rule fields to the Risk Calculator Criteria, select **Add criteria**.\n4. From the Choose reference table list, select **Custom conditions**.\n5. From the Condition table list, select **Configuration item**.\n6. In the **Field name** field, enter the name **CI Exposure**.\n7. In the **Weight** field, enter the relative importance of this field within the risk rule. The value must be an integer from 0 through 100.\n8. In the **Condition** field, select **Name** > **starts with** and enter the value **external**.\n9. Select **Submit**.\n\n **Note:** Adding conditional criteria to your risk rule might degrade performance.\n\n\n**Parent Topic:**[Configure rules to manage findings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-configure-rules-manage-findings.md)\n\n**Related topics** \n\n\n[Vulnerability Response calculators and vulnerability calculator rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calculators-rules.md)\n\n[Create a Vulnerability Response calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/create-vul-calculator.md)\n\n[Filtering within Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-filtering.md)\n\n"}}