| \n\nRole title \\[name\\]\n\n | \n\nDescription\n\n | \n\nContains roles\n\n |
|---|---|---|
| \n\nsn\\_vul\\_prisma.configure\\_prisma\\_integration\n\n | \n\nSecures the CRUD + report\\_view operations on sn\\_vul\\_prisma\\_hosts\\_import table and report\\_view operation on sn\\_vul\\_prisma\\_host\\_attrb table.\n\n | \n\n \n\n |
| \n\nsn\\_vul.view\\_manager\\_workspace\n\n | \n\nViews Vulnerability Manager Workspace.\n\n | \n\n \n\n |
| \n\nsn\\_vul.delete\n\n | \n\nDeletes source records and vulnerable items. Prior to v23.0, the admin role had the privilege to delete the source records.\n\n | \n\n- sn\\_vul\\_cmn.delete\n- sn\\_vul.delete\\_vulnerable\\_items\n\n |
| \n\nsn\\_vul\\_cmn.delete\n\n | \n\nDeletes source records.\n\n | \n\n \n\n |
| \n\nsn\\_vulc.bulk\\_edit\n\n | \n\nPerforms bulk edit operation on test results.\n\n | \n\n \n\n |
| \n\nsn\\_vul.app\\_bulk\\_edit\n\n | \n\nPerforms bulk edit operation on application vulnerable items \\(AVITs\\).\n\n | \n\nsn\\_vul.app\\_write\\_all\n\n |
| \n\nsn\\_vul\\_container.container\\_bulk\\_edit\n\n | \n\nPerforms bulk edit operation on container vulnerable items \\(CVITs\\).\n\n | \n\nsn\\_vul\\_container.write\\_all\n\n |
| \n\nsn\\_vul\\_cisa.configure\\_intelligence\\_integration\n\n | \n\nConfigures Intelligence integrations.\n\n | \n\n \n\n |
| \n\nVulnerability managers and senior analysts\\[sn\\_vul.vulnerability\\_admin or sn\\_vul.admin \\(deprecated\\)\\]\n\n | \n\nUpdate properties and vulnerability integrations. The sn\\_vul.vulnerability\\_admin or sn\\_vul.admin \\(deprecated\\) role is required for Vulnerability Response administration including vulnerability integrations, remediation task rules, calculators, and remediation target rules and tasks, reports, and third-party integration configuration.\n\n | \n\n- sn\\_vul.vulnerability\\_write\n- sn\\_vul.ciso\\_write\n- sn\\_sec\\_cmn.admin\n- sn\\_vul\\_qualys.admin \\(when the Qualys Vulnerability Integration is installed.\\)\n- sn\\_vul\\_r7.admin \\(when the Rapid7 Vulnerability Integration is installed.\\)\n- sn\\_vul\\_shodan.admin \\(when the Shodan Exploit Integration is installed.\\)\n- sn\\_vul.configure\\_nvd\\_integration \\(when the NVD integrations are installed.\\)\n- treemap\\_admin \\(when the Performance Analytics application is installed.\\)\n\n |
| \n\nPatch orchestration\n\n | \n\nConfigures supported third-party patch vendor integrations. View and apply patch data and patch records.\n\n | \n\n- sn\\_vul\\_patch\\_orch.configure\\_patch\n\nConfigure and apply patches.\n\n- sn\\_vul\\_patch\\_orch.read\\_patch\n\nCan view patch records and data.\n\n- sn\\_vul\\_bigfix.configure\\_integration\n\nConfigures the BigFix Patch Orchestration Integration application. This role contains the sn\\_vul\\_bigfix.read\\_integration and connection\\_admin granular roles that permit the user to connect to the BigFix console.\n\n- sn\\_vul\\_sccm.configure\\_integration\n\nThis role contains the sn\\_vul\\_sccm.read\\_integration and connection\\_admin granular roles that permit the user to connect to the SCCM console.\n\n- sn\\_vul\\_bigfix.read\\_integration\n\nUsers with this role can view \\(read only\\) the records of the Vulnerability Response and the BigFix Patch Orchestration Integration application and patch orchestration data.\n\n- sn\\_vul\\_sccm.read\\_integration\n\nUsers with this role can view \\(read only\\) the records of the Vulnerability Response and the Microsoft SCCM Patch Orchestration Integration application and patch orchestration data.\n\n\n |
| \n\nVulnerability analysts\\[sn\\_vul.vulnerability\\_write\\]\n\n | \n\nThe sn\\_vul.vulnerability\\_write role is required for managing remediation tasks and vulnerable items, and monitoring remediation progress.\n\n | \n\n- sn\\_vul.read\\_all\n- sn\\_sc\\_cmn.write\n- sn\\_vul\\_qualys.user \\(when the Qualys Vulnerability Integration is installed.\\)\n- sn\\_vul\\_shodan.write \\(when the Shodan Exploit Integration is installed.\\)\n\n |
| \n\nV19.0: Vulnerability Event Manager\\[sn\\_vul\\_analyst.vul\\_event\\_manager\\]\n\n | \n\nThe sn\\_vul\\_analyst.vul\\_event\\_manager role is used to assess the impact of a new vulnerability or software, or add a zero-day vulnerability to identify the impacted assets and create vulnerable items \\(VIs\\).\n\n | \n\n- sn\\_sec\\_cmn.read\n- canvas\\_user\n- sn\\_vul\\_analyst.emergency\\_response\n- sn\\_vul.manage\\_exposure\\_assessment\n\n |
| \n\nOthers\\[sn\\_vul.read\\_all\\]\n\nThe sn\\_vul.vulnerability\\_read role is deprecated.\n\n | \n\nThe sn\\_vul.read\\_all role is required for anyone needing visibility into vulnerability management. For example, IT and security executives or someone who wants to drill down from high-level dashboards to the items that comprise the dashboard visuals.**Important:** Starting with v24.0.6 of Vulnerability Response, the sn\\_vul.read\\_all role has the privilege to access the Vulnerability Manager Workspace.\n\n | \n\n- sn\\_sec\\_cmn.read\n- sn\\_vul\\_qualys.read \\(when the Qualys Vulnerability Integration is installed.\n- sn\\_vul\\_shodan.read \\(when the Shodan Exploit Integration is installed.\\)\n- pa\\_viewer \\(when the Performance Analytics application is installed.\\)\n- sn\\_vul\\_tenable.read\\_integration \\(when the Tenable Vulnerability Integration is installed.\\)\n\n- sn\\_vul.view\\_manager\\_workspace\n\n |
| \n\nsn\\_vul.read\\_assigned\n\n | \n\nView vulnerable items assigned to you or your assignment groups in both the Classic UI and IT Remediation Workspace.**Important:** Starting with v24.0.6 of Vulnerability Response, the sn\\_vul.read\\_assigned role has the privilege to access the IT Remediation Workspace.\n\n | \n\nsn\\_vul.view\\_rem\\_workspace\n\n |
| \n\nVR System import administrator\\[sn\\_vul.vr\\_import\\_admin\\]\n\n | \n\nSystem run-as user. Runs scheduled jobs.**Note:** This user is the default run-as user for each integration record. Don’t change.\n\n | \n\n- import\\_admin\n- sn\\_vul.vulnerability\\_write\n\n |
| \n\nRemediation owner\n\n \\[sn\\_vul.remediation\\_owner\\]\n\n | \n\nView and update permission for vulnerable items, remediation tasks assigned to you or your group. Can view all vulnerabilities and solutions. Has write access to the**Internal notes field** on the solution record.\n\n | \n\nContained in the itil role.\n\n |
| \n\nCISOs and vulnerability executives\n\n \\[sn\\_vul.vulnerability\\_ciso\\]\n\n | \n\nView the CISO dashboard in Performance Analytics for Vulnerability Response.\n\n | \n\n- sn\\_vul.ciso\\_read\n- sn\\_vul.read\\_all\n\n |
| \n\nFalse positive approver\\[sn\\_vul.false\\_positive\\_approver\\]\n\n | \n\nApproves/rejects false positive requests.\n\n | \n\nsn\\_vul.view\\_manager\\_workspace\n\n |
| \n\nException approver\\[sn\\_vul.exception\\_approver\\]\n\n | \n\nApproves/rejects exception requests.\n\n | \n\nsn\\_vul.view\\_manager\\_workspace\n\n |
| \n\nScheduled job\n\n | \n\nDescription\n\n |
|---|---|
| \n\n \n\n | \n\n \n\n |
| \n\nPopulate OOTB saved filters for Host and App module\n\n | \n\nMigrates modules related to Host and App module.\n\n |
| \n\nPopulate OOTB saved filters for CC module\n\n | \n\nMigrates modules related to CC module.\n\n |
| \n\nPopulate OOTB saved filters for Container module\n\n | \n\nMigrates modules related to container module.\n\n |
| \n\nRefresh Host related Saved filters\n\n | \n\nRefreshes all the aggregation data related to saved filters of Host module.\n\n |
| \n\nRefresh CC related Saved filters\n\n | \n\nRefreshes all the aggregation data related to saved filters of CC module.\n\n |
| \n\nRefresh Container related Saved filters\n\n | \n\nRefreshes all the aggregation data related to saved filters of Container module.\n\n |
| \n\nRefresh App related Saved filters\n\n | \n\nRefreshes all the aggregation data related to saved filters of App module.\n\n |
| \n\nTrigger aggregation creation and running for saved filter\n\n | \n\nCreates, updates, runs, and refreshes the aggregations related to the saved filter.\n\n |
| \n\nVersion 19.0 of Vulnerability Response and v4.0 of the Veracode Vulnerability Integration\n\n | \n\nThe Veracode CWE Integration retrieves Veracode - specific Common Weakness Enumeration \\(CWE\\) data for threat information and remediation recommendations.\n\n The Veracode SBOM Integration ingests release, version, and vulnerability information that originates in Veracode about the components in your software projects. The integration generates SBOMs in CycloneDx JSON format and uploads them into your instance\n\n Veracode Categories Integration retrieves enhanced Categories data from Veracode.\n\n The Veracode DevOps Integration lets DevOps users view summary details for third-party vulnerability scans without a SecOps license.\n\n JSON-based APIs for the following Veracode integrations: Application Vulnerable Item, Scan Summary, Application List. The XML-based API versions of these integrations are deprecated.\n\n |
| \n\nAssociate existing VIs with Auto Exception Rule\n\n | \n\nAutomatically associates the Auto Exception Rule with existing VIs.\n\n |
| \n\nAuto-Close Vulnerable Detections\n\n | \n\nAutomatically closes the stale vulnerable detections based on the configuration defined in the table ‘sn\\_vul\\_auto\\_close\\_config’.\n\n |
| \n\nVersion 16.1:\n\n HCL BigFix Collection, Fixlet, and Actions Integrations.\n\n | \n\nManage patches and patch deployments for vulnerabilities with patches from the HCL BigFix product.\n\n |
| \n\nCalculate Related Counts for All Solutions\n\n | \n\nInactive by default. Processes solutions data once nightly instead of continuously.\n\n Starting with v22.0, you can run this job only on demand. As this scheduled job processes all the solutions, it can impact performance. Therefore, it is recommended to run this job only once if the solution data is corrupted.\n\n |
| \n\nCalculate Related VI Counts for Vulnerability and Remediation Task\n\n | \n\nCaptures manual and VI import changes for the day. Reconciles vulnerability and solution relationships and recalculates totals. Solutions data is queued and processed separately by the **Process Vulnerability Solution Metrics Queue** scheduled job.\n\n |
| \n\nCheck Mid-Server Timeout\n\n | \n\nPings the Mid-Server and errors out after 30 seconds.\n\n |
| \n\nV19.0: Check potential vulnerability exposure\n\n | \n\nProcesses the delta CVEs, software, and installations to get the exposure.\n\n |
| \n\nCheck Run State WaitComplete\n\n | \n\nMarks an integration run as complete once they’re verified as fully done.\n\n |
| \n\nCheck Vulnerable Item and Groups Deferment Expiration\n\n | \n\nSends notifications if vulnerable items or vulnerabilities have expired \\(and if they expire in one week\\).Checks if any exception rule is applicable on a deferred VI and updates the **Reason** and **Until** fields according to the exception rule. The state of the VI remains Deferred until the latest expiry date.\n\n |
| \n\nClose cancel VITs that do not have a CI associated\n\n | \n\nAutomatically closes vulnerable items that don’t have an associated configuration item \\(CI\\) and haven’t been updated for three days. State is set to Closed/Cancelled.\n\n |
| \n\nClose VI on exp record delete\n\n | \n\nCloses a VI when it’s deleted.\n\n |
| \n\nCompliance Results Integration\n\n | \n\nImports test results along with policies, configuration tests \\(controls\\) and citations with authoritative sources for processing in the Configuration Compliance application.\n\n |
| \n\nCompliance Results Backfill Integration\n\n | \n\nPart of a chained integration run with the Tenable.io Assets Integration, imports configuration assessment data for ignored assets that are discovered \\(imported through assets integration\\).\n\n |
| \n\nCR State Synchronization\n\n | \n\nScript retrofits all existing remediation task to CHG relationships so they are synchronized. Enables synchronization going forward.\n\n |
| \n\nVersion 15.0 Scan Credential Integration\n\n | \n\nImports and securely stores temporarily Tenable.io credentials used to access the scanner for on-demand rescans.\n\n |
| \n\nCWE Comprehensive 2000 Integration\n\n | \n\nVulnerability integration that pulls in vulnerability information from the Common Weakness Enumeration \\(CWE\\) dataset, curated by the MITRE Corporation.\n\n |
| \n\nV18.0: Delete Stale Split Action Records\n\n | \n\nDaily job to clean up stale records in split task intermediate tables.\n\n |
| \n\nDisable VR solutions when solutions application not active\n\n | \n\nDisables and hides the Vulnerability Solution Management feature when the Solution Management for Vulnerability Response application isn’t installed.\n\n |
| \n\nEvaluate remediation targets\n\n | \n\nSets or updates remediation target dates on all vulnerable items. Determines the status of remediation target dates against rules.\n\n |
| \n\n- Fixing the detections for updated key for Rapid7\n- Fixing the detections for updated key for Qualys\n- Fixing the detections for updated key for Tenable\n\n | \n\nCleans up detection data automatically by an integration-specific scheduled job that is triggered post-upgrade to Vulnerability Response.\n\n |
| \n\nVersion 16.1: Generate remediation digest\n\n | \n\nThis job automatically generates an email digest for any users in the Remediation Owner user group. The job is activated by default.\n\n |
| \n\nV19.0: Insert CISA exploited CVE to exposure config\n\n | \n\nInserts CISA CVEs into the Exposure Configuration table to calculate the exposure.\n\n |
| \n\nV18.0: Insert Classic Remediation Tasks Into Unified Remediation Task\n\n | \n\nOne-time scheduled job to insert all the remediation tasks created in the classic UI into the Unified remediation task \\(sn\\_vul\\_remediation\\_task\\).\n\n |
| \n\nMicrosoft Security Response Center Solution integration\n\n | \n\nVulnerability Solution Management integration that retrieves solutions from the Microsoft Security Response Center.\n\n |
| \n\nVersion 16.1: Microsoft SCCM Collection, Patch Update, and Deployments Integrations\n\n | \n\nManage patches and patch deployments for vulnerabilities with Microsoft SCCM patches.\n\n |
| \n\nPick up throttled integration process\n\n | \n\nCreates the integration process for the Shodan Exploit Integration.\n\n |
| \n\nPopulate affected products text\n\n | \n\nAfter upgrade, handles existing solutions to populate affected products text. This job runs only once.\n\n |
| \n\nPopulate new CR Count Column\n\n | \n\nAutomatically populates the new CR count column for customers with existing data in the remediation task \\[sn\\_vul\\_vulnerability\\] table.\n\n |
| \n\nProcess Vulnerability Solution Metrics Queue\n\n | \n\nProcesses the queued solutions data by:- Rolling up solutions from NVD entries to third-party entries\n- Populating preferred solutions on vulnerabilities, and\n- Updating the remediation status metrics on the solutions\n\nIn addition, it also processes the solutions that are marked for update statuses.**Note:** If you’re using only Rapid7, you can disable this schedule job to improve performance.\n\n |
| \n\nPopulate records in vulnerability vendor mapping table\n\n Populate records in vulnerability vendor mapping table for Rapid7 vulnerabilities\n\n | \n\nInserts records into vulnerability vendor mapping table for existing vulnerabilities.\n\n |
| \n\nRe-open deferred vulnerability groups\n\n | \n\nReopens deferred remediation tasks when the deferment date has passed.\n\n |
| \n\nReapply all vulnerability assignment rules\n\n | \n\nReevaluates assignment rules against all **Open** VIs.\n\n |
| \n\nVersion 16.5: Reassignment count for assignment rules\n\n | \n\nRuns daily and posts the total number of VIs and remediation tasks that are unassigned by this feature for a particular assignment rule.\n\n |
| \n\nRed Hat Solution Integration\n\n | \n\nVulnerability Solution Management integration that retrieves solutions from the Red Hat Security Advisory.\n\n |
| \n\nV17.1: Refresh and resolve duplicate VITs on remediation task\n\n | \n\nFinds duplicate vulnerable items for the items in the remediation task with the ‘Automatically refresh duplicate VIs’ as active.\n\n |
| \n\nRefresh associated vulnerable items for non-remediation task rule-based remediation task\n\n | \n\nUpdates the remediation task with vulnerable items matching the Filter Group and Condition groups criteria.\n\n |
| \n\nRepair erroneous Vulnerable Items Last Opened and Closed\n\n | \n\nRepairs existing UI data corrupted by defects previously fixed.\n\n |
| \n\nRerun calculators\n\n | \n\nReapplies the calculators to any vulnerable items affected by the change. This triggers a recalculation of the cumulative risk scores of their remediation tasks. **Note:** Rerunning calculators can take a long time depending on your environment.\n\n |
| \n\nRetry Cancelled Integration Import Sets\n\n | \n\nRetries canceled integration import sets. Retries 5 times before returning an error.\n\n |
| \n\nRetry Integration Processes\n\n | \n\nRetries integration processes. Retries 5 times before returning an error.\n\n |
| \n\nRollup vulnerable item values to vulnerability and group\n\n | \n\nComputes the risk score, number of vulnerable items, and remediation target status for remediation tasks, using the rollup calculator.**Note:** Starting with v23.0 of Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task.\n\n |
| \n\nRun severity calculator after vuln entry promotion\n\n | \n\nRuns the severity calculator after a previously missing vulnerability has been updated with its score and other data from a third-party provider, such as Qualys Cloud Platform, Rapid7 Nexpose.**Note:** Starting with v25.0.3 of Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task.\n\n |
| \n\nV19.0: Run exposure assessment for configured CVEs\n\n | \n\nCalculates exposure for all the CVE records in the Exposure Configuration table.\n\n |
| \n\nV19.0: Run software exposure\n\n | \n\nCalculates exposure for all the software records in the Exposure Configuration table.\n\n |
| \n\nScheduled Vulnerability Data Source Processor\n\n | \n\nChecks the import queue for entries to process and assigns a scheduled import job based on available resources.\n\n |
| \n\nScheduled Vulnerability integration process attachment cleanup\n\n | \n\nRemoves integration XML attachments once they’re 14 days old. This retention time isn’t configurable.\n\n |
| \n\nScheduled Vulnerability Integration timeout checker\n\n | \n\nCancels integration runs that take over 60 minutes to complete.\n\n |
| \n\nSet related CI services for VI\n\n | \n\nOnce the integration import is complete, it links the affected business services to CIs connected to vulnerable items, at the specified time. For more information, see [Service Mapping in Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/service-mapping-vr.md).\n\n |
| \n\nSet deferral counts\n\n | \n\nCollects the number of times a vulnerable item, application vulnerable item, a container vulnerable item, or a remediation task is deferred.\n\n |
| \n\nTrigger next integration\n\n | \n\nTriggers the next integration in a chained integration run.\n\n |
| \n\nTemplate Integration\n\n | \n\nA single template record is sent to Tenable.io during rescan.\n\n |
| \n\nUpdate Ungrouped Vulnerable Items\n\n | \n\nDetermines whether a vulnerable item is in a remediation task and adds or removes it from the **Ungrouped Vulnerable Items** list.**Note:** This job runs post-upgrade and, depending on your data set, can take a long time to complete.\n\n |
| \n\nUpdate Vulnerability on VG\n\n | \n\nUpdates the **Vulnerability** field on the Remediation Task \\(sn\\_vul\\_vulnerabilty\\) table after upgrade. This job is triggered once and inactive afterward.\n\n |
| \n\nVulnerability Import Template\n\n | \n\nEngine that processes the import queue. One of 10.\n\n |
| \n\nVulnerability Response Age Closed Update\n\n | \n\nUpdates Age closed column on VI table.\n\n |
| \n\nVulnerability Response CI count\n\n | \n\nCalculates the number of CIs scanned by third-party scanners in the last 30 days.\n\n |
| \n\nVulnerability Response Risk and Remediation Status Upgrade\n\n | \n\nUpdates the risk rating on data when you upgrade.\n\n |
| \n\nv20.0: Check Risk Mitigation Expiration\n\n | \n\nChecks if compensatory controls have expired for a Vulnerable Item and Remediation Task. If they expired, it reverts the risk score to original risk score and sends an email notification indicating that compensatory controls have expired. Also sends an email notification if compensatory controls are set to expire within 7 days.\n\n |
| \n\nTable\n\n | \n\nDescription\n\n |
|---|---|
| \n\nv24.0.6Prisma Hosts Import \\[sn\\_vul\\_prisma\\_hosts\\_import\\]\n\n | \n\nImport set table for the hosts.\n\n |
| \n\nv24.0.6Prisma Host Attributes \\[sn\\_vul\\_prisma\\_host\\_attrb\\]\n\n | \n\nAsset attribute table for hosts integration.\n\n |
| \n\nv22.0sn\\_vul\\_cmn\\_auto\\_close\\_rule\n\n | \n\nCloses stale detections automatically based on filter conditions.\n\n |
| \n\nsn\\_vul\\_cmn\\_ws\\_saved\\_filter\n\n | \n\nStores the data of saved filter.\n\n |
| \n\nsn\\_vul\\_licensing\\_usage\n\n | \n\nContains the duplicate asset, Incomplete IP Asset, Total scanner assets counts and Final usage.\n\n |
| \n\nsn\\_vul\\_m2m\\_entry\\_compensating\\_control\n\n | \n\nRepresents association between vulnerability entries and compensating controls.\n\n |
| \n\nv21.0Rapid7 Scan Engine \\[sn\\_vul\\_r7\\_scan\\_engine\\)\n\n | \n\nStore the records imported Scan Engine data responsible for discovering assets during a scan and checking them for vulnerabilities.\n\n |
| \n\nv21.0Rapid7 Scan Engine Import \\[sn\\_vul\\_r7\\_scan\\_engine\\_import\\]\n\n | \n\nUsed by the Rapid7 Scan Engine integration to stage import data prior to processing.\n\n |
| \n\nVersion 19.0: \\[sn\\_vul\\_veracode\\_cwe\\_import\\]\n\n | \n\nExtends the Veracode Category table for CWE remediation recommendations.\n\n |
| \n\nVersion 19.0: \\[sn\\_vul\\_veracode\\_category\\_import\\]\n\n | \n\nStores imported category data.\n\n |
| \n\nVersion 19.0: \\[sn\\_vul\\_veracode\\_sbom\\_import\\]\n\n | \n\nStores imported SBOM data originating from Veracode.\n\n |
| \n\nV17.1: Add Proof to the VI Key\\[sn\\_vul\\_proof\\_key\\_vulnerability\\]\n\n | \n\nRapid7 vulnerabilities for which proof must be included in the VI key.Starting with v24.0.6 of Vulnerability Response, a column 'Regular Expression to Split Tenable VITs' is added. It stores the regular expression entered by a user that is used to parse the proof from the payload.\n\n |
| \n\nAssessed Vulnerable Items\\[sn\\_vul\\_m2m\\_exp\\_sw\\_vi\\]\n\n | \n\nAssigns a remediation task to an assignment group during remediation task creation.\n\n |
| \n\nAssignment Rule\\[sn\\_vul\\_vgr\\_assignment\\_rule\\]\n\n | \n\nAssigns a remediation task to an assignment group during remediation task creation.\n\n Prior to v15.0: Assigns a remediation task to an assignment group during remediation task creation.\n\n |
| \n\nAssociate Change Request\\[sn\\_vul\\_action\\_associate\\_cr\\]\n\n | \n\nStaging table used to process new remediation task-CHG associations.\n\n Prior to v15.0: Staging table used to process new VG-CHG associations.\n\n |
| \n\nAsynchronous Vulnerable Item Job\\[sn\\_vul\\_async\\_vi\\_job\\]\n\n | \n\nContains background jobs that process vulnerable items. Only one job type is supported; used to edit vulnerabilities in bulk.\n\n |
| \n\nAsynchronous Vulnerable Item Job Type\\[sn\\_vul\\_async\\_vi\\_job\\_type\\]\n\n | \n\nContains the types of background jobs, and references the relevant script. Only has one processor, the **VulnerabilityBulkEditProcessor**\n\n |
| \n\nAuto-Close Stale Detections\\[sn\\_vul\\_auto\\_close\\_config\\]\n\n | \n\nStores the configuration for how stale detections are automatically closed.\n\n |
| \n\nConfigure Vulnerable Item Granularity\n\n \\[sn\\_vul\\_action\\_vi\\_granularity\\_config\\]\n\n | \n\nStores the UI form used to enable or disable Include Port from the configuration page in the Configure VI Granularity module.\n\n |
| \n\nCreate change request\\[sn\\_vul\\_action\\_create\\_cr\\]\n\n | \n\nUsed to create change requests from remediation task.\n\n |
| \n\nCreate Vulnerable Items\\[sn\\_vul\\_action\\_create\\_vi\\]\n\n | \n\nA staging table which is used as a place holder for information. This table does not store any records.\n\n |
| \n\nCollection\n\n \\[sn\\_vul\\_patch\\_orch\\_collection\\]\n\n | \n\nStores collection data from distinct instances.\n\n |
| \n\nCWE\\[sn\\_vul\\_cwe\\]\n\n | \n\nCatalog of Common Weakness and Enumeration \\(CWE\\) software vulnerabilities.\n\n |
| \n\nCWE Applicable Platform\n\n \\[sn\\_vul\\_cwe\\_m2m\\_cwe\\_platform\\]\n\n | \n\nContains the imported CWE applicable platform data.\n\n |
| \n\nCWE Category\n\n \\[sn\\_vul\\_cwe\\_category\\]\n\n | \n\nContains the imported CWE category data.\n\n |
| \n\nCWE Common Consequence\n\n \\[sn\\_vul\\_cwe\\_consquence\\]\n\n | \n\nContains the imported CWE common consequence data.\n\n |
| \n\nCWE External Reference\n\n \\[sn\\_vul\\_cwe\\_reference\\]\n\n | \n\nContains the imported CWE external reference data.\n\n |
| \n\nCWE Observed Example\n\n \\[sn\\_vul\\_m2m\\_cwe\\_cve\\]\n\n | \n\nContains the imported CWE CVE data.\n\n |
| \n\nCWE Platform\n\n \\[sn\\_vul\\_cwe\\_platform\\]\n\n | \n\nContains the imported CWE platform data.\n\n |
| \n\nCWE External Reference\n\n \\[sn\\_vul\\_cwe\\_reference\\]\n\n | \n\nContains the imported CWE related external reference data.\n\n |
| \n\nCWE Relationship\n\n \\[sn\\_vul\\_m2m\\_cwe\\_relation\\]\n\n | \n\nContains the imported CWE relationship data.\n\n |
| \n\nCWE View\n\n \\[sn\\_vul\\_cwe\\_view\\]\n\n | \n\nContains the imported CWE view data.\n\n |
| \n\nCWE Weakness\n\n \\[sn\\_vul\\_cwe\\_weakness\\]\n\n | \n\nContains the imported CWE weakness data.\n\n |
| \n\nVersion 16.1: Device Collection\n\n \\[sn\\_vul\\_patch\\_orch\\_m2m\\_src\\_ci\\_collection\\]\n\n | \n\nStores collections data about discovered items.\n\n |
| \n\nVersion 16.1: Device Update\n\n \\[sn\\_vul\\_patch\\_orch\\_m2m\\_src\\_ci\\_update\\]\n\n | \n\nStores data about the deployed patches, along with deployment status, that are on displayed on discovered item records.\n\n |
| \n\nDiscovery Model Vulnerable Software Match\\[sn\\_vul\\_discovery\\_model\\_software\\_match\\]\n\n | \n\nSupplements the matching of vulnerable software to a discovery model.\n\n |
| \n\nException Management Configuration\n\n \\[sn\\_vul\\_exception\\_config\\]\n\n | \n\nStores the configuration settings for the exception management feature.\n\n |
| \n\nException Rule\n\n \\[sn\\_vul\\_auto\\_exception\\_rule\\]\n\n | \n\nContains the set of rules evaluated for Exception Management.\n\n |
| \n\nExploit\\[sn\\_vul\\_exploit\\]\n\n | \n\nContains the definitions of exploits: publicly available code that takes advantage of a vulnerability.\n\n |
| \n\nExploit Frameworksn\\_vul\\_exploit\\_framework\n\n | \n\nContains the names of exploit frameworks: full software packages that are capable of running many exploits.\n\n |
| \n\nExposed Discovery Models\\[sn\\_vul\\_m2m\\_exp\\_sw\\_model\\]\n\n | \n\nStores the mapping between the Discovery model and Vulnerability Exposure Assessment.\n\n |
| \n\nExposure Assessment\\[sn\\_vul\\_exp\\_by\\_sw\\]\n\n | \n\nStores the records for exposure assessment.\n\n |
| \n\nV19.0: Exposure Manifestsn\\_vul\\_analyst\\_exposure\\_manifest\n\n | \n\nManifest table for delta processing.\n\n |
| \n\nExposure Vulnerability Entries\\[sn\\_vul\\_m2m\\_entry\\_exp\\]\n\n | \n\nStores the mapping between Vulnerability \\(sn\\_vul\\_entry\\) and Exposure Assessment.\n\n |
| \n\nMalware Kit\\[sn\\_vul\\_malware\\_kit\\]\n\n | \n\nContains the details of malware kits: pre-written tools that make it easy to run an exploit or set of related exploits without doing additional coding or configuration work\n\n |
| \n\nMissing asset table \\[sn\\_vul\\_tenable\\_missing\\_asset\\]\n\n | \n\nContains temporary asset IDs for ignored configuration compliance assessment data with unmatched assets.\n\n |
| \n\nMicrosoft Response Center Solution Update \\[sn\\_vul\\_msrc\\_update\\]\n\n | \n\nContains the last time that the solution data was updated by Microsoft. Used to compare against the nightly import to determine the delta data for download.\n\n |
| \n\nMicrosoft Security Response Center Solution Import\\[sn\\_vul\\_msrc\\_solution\\_import\\]\n\n | \n\nUsed by the Microsoft Security Response Center Solution integration to stage import data prior to processing.\n\n |
| \n\nMicrosoft Security Response Center Solution Integration \\[sn\\_vul\\_msrc\\_integration\\]\n\n | \n\nExtends the Vulnerability Integration \\[sn\\_vul\\_integration\\] table for the Microsoft Security Response Center Solution Integration.\n\n |
| \n\nNational Vulnerability Database Entry\\[sn\\_vul\\_nvd\\_entry\\]\n\n | \n\nDocumented vulnerability from the NIST National Vulnerability Database.\n\n |
| \n\nNVD CVSS Import \\[sn\\_vul\\_nvd\\_cvss\\_import\\]\n\n | \n\nContains staging data that hasn’t yet been transformed to the Vulnerability Response schema during NVD import.\n\n |
| \n\nVersion 16.1\n\n \\[sn\\_vul\\_patch\\_orch.patch\\_approval\\_required\\]\n\n | \n\nWhen patch deployments are scheduled from a patch integration, requests are submitted for review and approval to users assigned to the Level 1 - Patch update approval group. This property is activated by default.\n\n |
| \n\nVersion 16.1: Patch Deployment\n\n \\[sn\\_vul\\_patch\\_orch\\_deployment\\]\n\n | \n\nStores information about deployed patches about Collections and CIs.\n\n |
| \n\nVersion 16.1: Patch Update\n\n \\[sn\\_vul\\_patch\\_orch\\_update\\]\n\n | \n\nStores information about the patches that are available on distinct instances.\n\n |
| \n\nVersion 16.1: Potential Patch\n\n \\[sn\\_vul\\_patch\\_orch\\_m2m\\_vuln\\_patch\\]\n\n | \n\nStores data about patches and vulnerabilities that identify the patches that might be used to resolve a vulnerability.\n\n |
| \n\nV19.0: Potential Vulnerability Exposuresn\\_vul\\_analyst\\_m2m\\_pot\\_exp\\_sw\\_model\n\n | \n\nExposure assessment table for CVE.\n\n |
| \n\nProduct category\\[sn\\_vul\\_product\\_category\\]\n\n | \n\nContains the imported product category data.\n\n |
| \n\nRed Hat Security Advisory\n\n \\[sn\\_vul\\_rhsa\\_update\\]\n\n | \n\nCompares the Red Hat solutions against the nightly job to determine the delta data for import.\n\n |
| \n\nRed Hat Solution Imports\n\n \\[sn\\_vul\\_rh\\_solution\\_import\\]\n\n | \n\nUsed by the Red Hat Solution Integration to stage import data prior to processing.\n\n |
| \n\nRed Hat Solution Integration\n\n \\[sn\\_vul\\_rh\\_integration\\]\n\n | \n\nExtends the Vulnerability Integration \\[sn\\_vul\\_integration\\] table for the Red Hat Solution Integration.\n\n |
| \n\nRelated Business Services\\[sn\\_vul\\_m2m\\_ci\\_services\\]\n\n | \n\nLinks CIs to Business Services for impacted services lookup. Contains a flag indicating whether it was added by Service Mapping.\n\n |
| \n\nV18.0: Remediation Effort Counts\\[sn\\_vul\\_daily\\_count\\_re\\]\n\n | \n\nDaily count of remediation efforts. This table is updated daily.\n\n |
| \n\nV18.0: Remediation Effort Record\\[sn\\_vul\\_remediation\\_effort\\_record\\]\n\n | \n\nTracks the remediation progress for remediation efforts \\(RE\\). Contains references to the REs.\n\n |
| \n\nRemediation Target Rule\n\n \\[sn\\_vul\\_ttr\\_rule\\]\n\n | \n\nDefines the expected time frame for remediating a vulnerable item. Extends Application File.\n\n |
| \n\nV18.0: Remediation Task\\[sn\\_vul\\_remediation\\_task\\]\n\n | \n\nStores all the remediation tasks for VR, AVR, CVR, and test result groups.Consists of information related to \\[sn\\_vul\\_vulnerability\\] table records. Users who cannot view records in \\[sn\\_vul\\_vulnerability\\] table list view, can see those records information in the \\[sn\\_vul\\_remediation\\_task\\] table list view.\n\nThis table is accessible to the users in Vulnerability Manager workspace or IT Remediation Workspace\n\n |
| \n\nREST Integration\n\n \\[sn\\_vul\\_rest\\_integration\\]\n\n | \n\nExtends the Vulnerability Integration \\[sn\\_vul\\_integration\\] table for the REST-based Integrations.\n\n |
| \n\nSAM NVD Vulnerability Detection\n\n \\[sn\\_vul\\_sam\\_config\\]\n\n | \n\nContains which CI and Vulnerabilities are monitored with SAM NVD and whether SAM NVD vulnerability detection is enabled or not.\n\n |
| \n\nScheduled Import Pool\\[sn\\_vul\\_sched\\_import\\_pool\\]\n\n | \n\nCollection of scheduled import set records used to facilitate simultaneous data source imports.\n\n |
| \n\nSelect Vulnerable Item\\[sn\\_vul\\_action\\_select\\_vi\\]\n\n | \n\nBase staging table used to handle split VG, create CHGs, and associate CHGs\n\n |
| \n\nSetup Status\\[sn\\_vul\\_setup\\_status\\]\n\n | \n\nInternal only: Used by the Setup Assistant. Whenever Setup Assistant is opened, it shows the status of the steps Completed, and the percentage on the right top corner comes from this table.\n\n |
| \n\nSeverity Map \\[sn\\_vul\\_severity\\_map\\]\n\n | \n\nContains the mappings from source severity to normalized severity.\n\n |
| \n\nSolution Scanner Mapping\n\n \\[sn\\_vul\\_solution\\_scanner\\_mapping\\]\n\n | \n\nMaps vendor, scanner, and keywords for exclusion or inclusion.\n\n |
| \n\nSplit remediation task\\[sn\\_vul\\_action\\_split\\_vg\\]\n\n | \n\nStaging table used to split remediation tasks.\n\n |
| \n\nThird Party Vulnerability Entry\\[sn\\_vul\\_third\\_party\\_entry\\]\n\n | \n\nDocumented vulnerability from a third-party source.\n\n |
| \n\n\\[sn\\_vul\\_tenable\\_io\\_template\n\n | \n\nA template record is sent to Tenable.io and then imported during rescan for items that have Tenable.io as a source.\n\n |
| \n\nUpdate Manifest\n\n \\[sn\\_vul\\_update\\_manifest\\]\n\n | \n\nList of remediation tasks that have been updated and require recalculation by the rollup calculator.\n\n |
| \n\nV17.1: Usage by CI classes\\[sn\\_vul\\_licensing\\_usage\\_by\\_ci\\_classes\\]\n\n | \n\nContains the usage count aggregated by the CI class.\n\n |
| \n\nVR Configuration Item Count\\[sn\\_vul\\_vr\\_configuration\\_item\\_count\\]\n\n | \n\nContains the 90-day rolling cumulative average of configuration items imported from third-party integrations.\n\n |
| \n\nVulnerability Assignment Rule\\[sn\\_vul\\_assignment\\_rule\\]\n\n | \n\nContains the set of rules evaluated to set the assignment group on VIs.\n\n |
| \n\nVulnerability Calculator\n\n \\[sn\\_vul\\_calculator\\_group\\]\n\n | \n\nContains the vulnerability calculator rules. The order of the calculator determines which calculator is evaluated first, and in each calculator, one calculator rule, at most, is used.\n\n |
| \n\nVulnerability Calculator Rule\\[sn\\_vul\\_calculator\\]\n\n | \n\nContains the rules for all of the calculators. For each calculator, the calculator rules are reviewed in order. The first calculator matching the condition uses the values within that rule.\n\n |
| \n\nVulnerability CVEs\\[sn\\_vul\\_m2m\\_entry\\_cve\\]\n\n | \n\nLinks NVD Common Vulnerability Exposures \\(CVE\\) data to vulnerable entries.\n\n |
| \n\nVulnerability Data Source Import Queue Entry\\[sn\\_vul\\_ds\\_import\\_q\\_entry\\]\n\n | \n\nQueue for attachments before they’re processed by a data source. Utilized by vulnerability integrations.\n\n |
| \n\nVulnerability Entry\\[sn\\_vul\\_entry\\]\n\n | \n\nDocumented vulnerability.\n\n |
| \n\nVulnerability Entry Scan\n\n \\[sn\\_vul\\_entry\\_scan\\]\n\n | \n\nStores the relationship between a scan and vulnerability entry.\n\n |
| \n\nVulnerability Exploit Framework\\[sn\\_vul\\_m2m\\_framework\\_vul\\]\n\n | \n\nContains the relationship between Exploit frameworks and vulnerabilities.\n\n |
| \n\nV19.0: Vulnerability Exposure Assessmentsn\\_vul\\_analyst\\_sam\\_config\n\n | \n\nExposure assessment configuration table for CVE.\n\n |
| \n\nVulnerability Granularity Configuration\n\n \\[sn\\_vul\\_granularity\\_config\\]\n\n | \n\nStores and maintains the state of include or exclude Port for the Configure VI Granularity module.\n\n |
| \n\nRemediation Tasks\\[sn\\_vul\\_vulnerability\\]\n\n | \n\nCollection of vulnerable items organized for remediation.\n\n |
| \n\nRemediation Task Change Requests\\[sn\\_vul\\_m2m\\_vg\\_change\\_request\\]\n\n | \n\nStores the association of remediation tasks and CHG requests.\n\n |
| \n\nRemediation Task Items\\[sn\\_vul\\_m2m\\_vul\\_group\\_item\\]\n\n | \n\nAssociation of remediation tasks and vulnerable items.\n\n |
| \n\nRemediation Task Rules\\[sn\\_vul\\_grouping\\_rule\\]\n\n | \n\nContains the rules that define the criteria with which groups are automatically created for a set of vulnerable items.\n\n |
| \n\nVulnerability Integration\\[sn\\_vul\\_integration\\]\n\n | \n\nSchedulable record to import vulnerability data from an external source. Extends Scheduled Script Execution.\n\n |
| \n\nVulnerability Integration Data Source\\[sn\\_vul\\_int\\_data\\_src\\]\n\n | \n\nData source to use with a vulnerability integration.\n\n |
| \n\nVulnerability Integration Log \\[sn\\_vul\\_integration\\_log\\]\n\n | \n\nRecords log information output by vulnerability integration runs.\n\n |
| \n\nVulnerability Integration Process\\[sn\\_vul\\_integration\\_process\\]\n\n | \n\nSingle process occurrence for a vulnerability integration.\n\n |
| \n\nVulnerability Integration Queue\\[sn\\_vul\\_integration\\_queue\\]\n\n | \n\nQueues the import requests for an integration run when all the Data Sources are in use.\n\n |
| \n\nVulnerability Integration Run\\[sn\\_vul\\_integration\\_run\\]\n\n | \n\nVulnerability integration invocations.**Note:** If an integration run is in progress, only one integration can be in ready state in the backlog.\n\n |
| \n\nVulnerability Integration Run Stats\n\n \\[sn\\_vul\\_integration\\_stats\\]\n\n | \n\nStores the breakdown of each step: for example, REST API time, VI creation time, and so on for an integration run\n\n |
| \n\nVulnerability Item Task\\[sn\\_vul\\_m2m\\_item\\_task\\]\n\n | \n\nVulnerable items associated with problems, changes, and security incidents.\n\n |
| \n\nVulnerability Malware Kit \\[sn\\_vul\\_m2m\\_malware\\_kit\\_vul\\]\n\n | \n\nContains the relationships between vulnerabilities and malware kits.\n\n |
| \n\nVulnerability Prerequisite Solution\\[sn\\_vul\\_m2m\\_solution\\_prerequisite\\]\n\n | \n\nContains the source-specific prerequisites to applying a solution, when available.\n\n |
| \n\nVulnerability Rate limit\\[sn\\_vul\\_rate\\_limit\\]\n\n | \n\nDefines a rate limit to be used on a scanner.\n\n |
| \n\nVulnerability Reference\\[sn\\_vul\\_reference\\]\n\n | \n\nExternal references for known vulnerabilities.\n\n |
| \n\nVulnerability Remediation Status\\[sn\\_vul\\_m2m\\_ttr\\_status\\]\n\n | \n\nStatus of the vulnerable item against the closest applied remediation target rule.\n\n |
| \n\nVulnerability Risk Rule\\[sn\\_vul\\_calc\\_risk\\]\n\n | \n\nSpecialized calculator rule used with the Risk Score calculators. Takes weights indicating which values, related to a VI, to use to calculate the Risk Score.\n\n |
| \n\nVulnerability Rollup Calculator\\[sn\\_vul\\_rollup\\]\n\n | \n\nList of vulnerability rollup calculators.\n\n |
| \n\nVulnerability Scan\\[sn\\_vul\\_scan\\]\n\n | \n\nVulnerability scan. Contains what to scan, with what scanner, and a summary of the scan results.\n\n |
| \n\nVulnerability Scan Configuration Item\\[sn\\_vul\\_m2m\\_scan\\_configuration\\_item\\]\n\n | \n\nAssociates CMDB CIs that are queued to be scanned.\n\n |
| \n\nVulnerability Scan Queue Entry\\[sn\\_vul\\_scan\\_q\\_entry\\]\n\n | \n\nScan record queued for scanning or processing. Facilitates the requests within stated rate limits.\n\n |
| \n\nVulnerability Scan Source\\[sn\\_vul\\_m2m\\_scan\\_source\\]\n\n | \n\nAssociates sources to a scan record and signifies all the records that are queued to be scanned.\n\n |
| \n\nVulnerability Scan Task\\[sn\\_vul\\_m2m\\_scan\\_vulnerability\\]\n\n | \n\nAssociates vulnerability tasks for the sources of a scan record.\n\n |
| \n\nVulnerability Scanner\\[sn\\_vul\\_scanner\\]\n\n | \n\nDefines third-party scanners to use in scans.\n\n |
| \n\nVulnerability Scanner Rate Limit\\[sn\\_cmn\\_scanner\\_rate\\_limit\\]\n\n | \n\nAssociates a scanner with a rate limit.\n\n |
| \n\nVulnerability Software\\[sn\\_vul\\_m2m\\_entry\\_software\\]\n\n | \n\nContains associations between vulnerabilities and vulnerable software.\n\n |
| \n\nVulnerability Solution\n\n \\[sn\\_vul\\_solution\\]\n\n | \n\nContains the relationship data between the vulnerability and the possible solutions for it. Starting with v24.0.6 of Vulnerability Response, a new column titled Scanner Bulletin is added to this table.\n\n |
| \n\nVulnerability Solution\n\n \\[sn\\_vul\\_m2m\\_vulnerability\\_solution\\]\n\n | \n\nLinks the Vulnerability Entry \\(sn\\_vul\\_entry\\) table to the Vulnerability Solution \\(sn\\_vul\\_solution\\) table.\n\n |
| \n\nVulnerability State Change Approval\\[sn\\_vul\\_change\\_approval\\]\n\n | \n\nTracks the approval process for vulnerabilities.\n\n |
| \n\nVulnerability Superseding Solution\\[sn\\_vul\\_m2m\\_solution\\_supersedence\\]\n\n | \n\nContains the source-specific relationship between solutions.\n\n |
| \n\nVulnerability Update Manifest\\[sn\\_vul\\_vuln\\_update\\]\n\n | \n\nContains a list of vulnerabilities that need their rollup data updated after their vulnerable items are updated, closed, or have risk score changes.\n\n |
| \n\nVulnerability Vendor Mapping\n\n \\[sun\\_vul\\_vulnerability\\_vendor\\_mapping\\]\n\n | \n\nContains a list of vulnerabilities and their vendors.\n\n |
| \n\nVulnerable Item\\[sn\\_vul\\_vulnerable\\_item\\]\n\n | \n\nContains the occurrence of a vulnerability on a configuration item.\n\n |
| \n\nVulnerable Item Detection\n\n \\[sn\\_vul\\_detection\\]\n\n | \n\nContains the vulnerable item detections from third-party integrations.\n\n |
| \n\nVulnerable Software\\[sn\\_vul\\_software\\]\n\n | \n\nSoftware that is known to have certain vulnerabilities.\n\n |