{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":46267,"path":"security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md","title":"Modify the vulnerability assessment record","bundle":null,"doc_type":null,"release":"australia","body":"\n# Modify the vulnerability assessment record\n\nUpdate the Vulnerability Assessment record, post it’s creation. Based on the field's values you can calculate the risk score.\n\n## Before you begin\n\nRole required: sn\\_vul\\_analyst.vul\\_event\\_manager\n\n## About this task\n\nAfter the primary CVE is added to the vulnerability assessment, the record is moved to a Pending Assessment state. You can further add other related CVEs in the **Vulnerability Entries**tab or add the products affected by this vulnerability from the **Affected Products** tab. You can make further modifications to the **Risk Assessment** fields and the **Risk Score** for the assessment record is automatically updated accordingly. You can add or modify the CI filter to control which configuration items are collected in the next assessment run.\n\n## Procedure\n\n1. Navigate to **All** > **Vulnerability Assessment Workspace** > **Vulnerability Assessment**.\n\n2. On the **Details** tab, update the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nTitle\n\n\n\nTitle describing the vulnerability event record.\n\n
\n\nPrimary CVE\n\n\n\nPrimary CVE which you associated with the event record.\n\n
\n\nState\n\n\n\nCurrent state of the event record.\n\n
\n\nPriority\n\n\n\nPriority of the event record on a scale of 1-5.**Note:** When you change the priority of a vulnerability assessment \\(VA\\), the system automatically updates the priority of all associated VITs and AVITs with source ServiceNow. If a VIT or AVIT is linked to multiple assessments, the system assigns the minimum priority value \\(highest severity\\) from all linked assessment records.\n\n
\n\nAlert Source\n\n\n\nSource of the potential vulnerability event.\n\n
\n\nSource\n\n\n\nRead-only. Identifies the system that created the assessment record, such as a value passed by the [CVE Exposure Assessment REST API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/vr-va-ws-cve-exposure-assessment-api.md). This field is empty for assessment records created manually in the workspace.\n\n
\n\nRisk Score\n\n\n\nAuto-calculated risk score. Not editable by default.\n\n
\n\nExposure-level\n\n\n\nThe exposure level of the vulnerability event on a scale of 1-5.\n\n
\n\nAssignment Group\n\n\n\nThe assignnment group to whom the event record is assigned.\n\n
\n\nAssigned To\n\n\n\nThe user the event record is assigned to.\n\n
\n\nDescription\n\n\n\nDetailed description of the event record.\n\n
\n\nCI Filter\n\n\n\nOptional condition builder that filters the CIs collected during assessment using fields from the CI \\[cmdb\\_ci\\] table.\n\n
3. Navigate to the **Vulnerability Entries** tab to add associated or related CVEs.\n\n 1. Select **New**.\n\n 2. Search for the record in the **Vulnerability entry** field.\n\n 3. Select the vulnerability record you want to associate with the assessment record.\n\n 4. Select **Browse** to browse and attach a file.\n\n 5. Select **Save**.\n\n The vulnerability records you selected are added to the assessment record and display in the **Vulnerabilities Entries** tab.\n\n4. Add affected products.\n\n5. [Add related link to the assessment record](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response-workspaces/modify-vuln-assessment-record.md).\n\n6. Modify the **Risk Attributes** for the primary CVE associated with the vulnerability assessment event record.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nMemory corruption\n\n\n\nIndicates whether this event record can corrupt memory.\n\n
\n\nRemote code executable\n\n\n\nIndicates if the remote code execution is possible.\n\n
\n\nLocal privilege escalation\n\n\n\nIndicates if local privilege escalation vulnerability exists.\n\n
\n\nUnauthorised access\n\n\n\nIndicates if unauthorised access vulnerability exists.\n\n
\n\nDDOS\n\n\n\nIndicates if the potential event could involve Distributed Denial of Service.\n\n
\n\nAttack Complexity\n\n\n\nIndicates the complexity of the attach. Options are Low, Medium, or High.\n\n
\n\nAttack vector\n\n\n\nIndicates the potential pathway or method of attack. Options are– Network, Adjacent network, Local, Physical, None.\n\n
\n\nPrivileges required\n\n\n\nIndicates the level of privileges an attacker required to exploit the vulnerability. Options are None, Low or High.\n\n
\n\nUser interaction\n\n\n\nIndicates whether or not user interaction is needed to exploit the vulnerability.\n\n
\n\nConfidentiality impact\n\n\n\nIndicates the measure of the potential impact on confidentiality of the vulnerability.Options are None, Low, or High\n\n
\n\nScope change\n\n\n\nIndicates if the scope if the assessment has changed.\n\n
\n\nAvailability impact\n\n\n\nIndicates the potential impact to availability of a successfully exploited misuse vulnerability. Availability refers to the accessibility of information resources.Options are None, Low, or High\n\n
\n\nIntegrity impact\n\n\n\nIndicates the potential impact to integrity of a successfully exploited misuse vulnerability. Integrity refers to the trustworthiness and guaranteed veracity of information.Options are None, Low, or High\n\n
\n\nRemediation level\n\n\n\nIndicates the status or availability of remediation for the vulnerability. Options are Official Fix, Temporary Fix, Workaround, Unavailable, Not defined.\n\n
\n\nExploit code maturity\n\n\n\nIndicates the likelihood of the vulnerability being exploited based on the existing state of exploit techniques and code availability.Options are Unproven, Proof-of-concept, Functional, High, and Not defined.\n\n
\n\nReport confidence\n\n\n\nIndicates how confident you are that the vulnerability exists.\n\n
7. Enter relevant comments in the **Compose** field.\n\n - Enter your work notes in the **Work notes \\(Private\\)** field.\n - Enter your comments \\(visible to everyone\\) in the **Comments** field.\n8. **Save** the assessment record.\n\n Based on the updates you made to the **Risk attribute** fields for the primary CVE or the affected product associated with the assessment record, the **Risk score** field is automatically updated.\n\n **Note:** To modify the base system risk score calculator rules or criteria, navigate to **All** > **Vulnerability Assessment Calculators** > **Vulnerability Assessment Risk Calculator** > **Vulnerability Assessment Risk Rule**. You can add criteria and modify the field level weightage to existing criteria as needed.\n\n\n## What to do next\n\nPerform an initial assessment of the event record.\n\n## Delete associated CVEs or affected products from the vulnerability assessment record\n\nDelete a vulnerability event record if it is no longer required.\n\n### Before you begin\n\nRole required: sn\\_vul\\_analyst.vul\\_event\\_manager\n\n### About this task\n\nYou can delete CVEs or affected products associated with the vulnerability assessment record. You can only delete vulnerability entries/associated CVEs or affected products if they are in **New** or **Pending assessment** states.\n\n### Procedure\n\n1. Navigate to **All** > **Workspaces** > **Vulnerability Assessment**.\n\n2. Select the vulnerability assessment record.\n\n3. Select the **Vulnerability Entries** tab or the **Affected Products** tab.\n\n4. Select the associated CVE or the affected product record.\n\n5. Select **Delete**.\n\n **Note:** The **Delete** button displays only for an assessment record when they are in **New** or **Pending Assessment** states.\n\n\n## Add related link to the assessment record\n\nAdd additional links and information related to the assessment record.\n\n### Before you begin\n\nRole required: sn\\_vul\\_analyst.vul\\_event\\_manager\n\n### Procedure\n\n1. Navigate to **Workspaces** > **Vulnerability Assessment Workspace**.\n\n2. Select the assessment record entry.\n\n3. Select the **Related Links** tab.\n\n4. Enter a relevant description in the **Description** field.\n\n5. Enter the URL in the **Link** field.\n\n6. Select **OK**.\n\n The related link is added and listed on the Related Links tab.\n\n\n"}}