{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43498,"path":"security-management/application-vulnerability-response/avm-create-calculator.md","title":"Create an application vulnerability calculator","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create an application vulnerability calculator\n\nAn application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item \\(AVI\\) **Risk Score**, can contain **Risk Rules**. Risk calculations offer insight in prioritizing remediation.\n\n## Before you begin\n\nRole required: App-Sec Manager group\n\n**Note:** You may notice performance degradation when running application vulnerability calculators that contain scripts.\n\nOrder your rules to run the simplest rules first. Only run scripts on the items that cannot be handled with a condition and template value or a risk rule.\n\n## Procedure\n\n1. Navigate to **All** > **Application Vulnerability Response** > **Administration** > **Vulnerability Calculators**.\n\n2. Click **New**.\n\n3. Fill in the fields on the form, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Name|The name of the application vulnerability calculator.|\n |Table|Auto-filled with the name of the AVI table.|\n |Application|Auto-filled with Vulnerability Response.|\n |Target field|Field to calculate.|\n |Description|Text description of the calculator.|\n |Active|Turn the calculator on or off.|\n\n4. Right-click in the header to **Save**.\n\n The **Vulnerability Calculator Rules** section appears.\n\n5. Create a rule for the calculator by clicking **New**.\n\n **Note:** For the **New Risk Rules** form \\(only available when the **Target field** is **Risk Score**\\) see step 10.\n\n6. Fill in the fields, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Name|Name of the calculator rule.|\n |Order|The order in which to run the vulnerability calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.|\n |Calculator|Auto-filled with the calculator parent.|\n |Active|By default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.|\n |Advanced view|When selected, scripted conditions and scripted values can be selected from **Condition type** and **Value type**.|\n\n7. Fill in the fields in the **When this condition is met** tab, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nCondition type\n\n\n\nAvailable when you select the **Advanced view**. Choices include: - Filter: Uses filter conditions.\n- Filter group: See [create and define filter groups](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/create-filter-group.md) to define the calculator criteria.\n- Script: Script condition used to determine when to apply this calculator.\n\n**Note:** Before you write scripts for determining when to apply the calculators, return to the **Application Vulnerability Calculators** list. Explore the vulnerability calculator records shipped with the base system.\n\n
\n\nCondition\n\n\n\nDefines basic filter conditions for determining whether to use the calculator or not. Selecting either the **Filter group** or **Script** condition types, hides this field.\n\n
8. Click the **Set these values** tab and fill in the fields on the form, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nValue type\n\n\n\nAvailable when you select the **Advanced view**. Choices include: - Template: Define the values to set on each field.\n- Script: Used to set the values on each field.\n\n\n
\n\nScript values\n\n\n\nAvailable if you selected the **Script** value type.Defines what values to apply the calculations to.\n\n
\n\nTemplate\n\n\n\nSelect the fields and values you want to use for the calculator. Selecting either the **Script** value type, hides this field.\n\n
9. When you have completed all entries, click **Submit**.\n\n **Note:** When you edit an existing calculator, and you want to update all existing scores, you can use the **Reapply Calculator** button. It runs through all active AVIs, and if that calculator would be used to set its value, recalculates the value for those AVIs. Since reapplying a calculator can take a long time, a scheduled job handles it.\n\n10. For the **New Risk Rules** form, fill in the fields as appropriate.\n\n Set each weight according to the percentage of the result that should come from that value. For any data that your scanner does not provide, or for data that should not be part of the risk score, set the weight to zero.\n\n As you update the weights, scenarios display the weights remaining, as well as anticipated **Risk Score** results.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName of the calculator rule.\n\n
\n\nOrder\n\n\n\nThe order in which to run the calculator. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.\n\n
\n\nCalculator\n\n\n\nAuto-filled with the calculator parent.\n\n
\n\nActive\n\n\n\nBy default the **Active** check box is selected, which means the calculator rule is active. If you clear this check box, this rule does not apply to new vulnerable items created in the system.\n\n
\n\nCondition\n\n\n\nDefines basic filter conditions for determining whether to use the calculator. Selecting either the **Filter group** or **Script** condition types, hides this field.\n\n
\n\n**Weights**\n\n
\n\nVulnerability Severity\n\n\n\nPercentage of the result that comes from severity.\n\n
\n\nOWASP top 10\n\n\n\nPercentage of the result that comes from the vulnerability's presence in the OWASP top 10 list. If this information is not present in your vulnerabilities, set the weight to zero.\n\n
\n\nSANS top 25\n\n\n\nPercentage of the result that comes from the vulnerability's presence in the SANS top 25 list. If this information is not present in your vulnerabilities, set the weight to zero.\n\n
\n\nRunning total\n\n\n\nAuto-computed percentage totals. When this value reaches 100, the Scenario preview shows sample risk scores in different scenarios.\n\n
\n\nSample scenarios\n\n\n\nWhen all weights total 100%, risk score scenarios display, providing a preview of the risk score in some of the possible scenarios.\n\n
\\[Omitted image \"RiskRuleCI.png\"\\] Alt text: Vulnerability Risk Rule example\n\n11. Click **Submit**.\n\n\n"}}