{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43818,"path":"security-management/container-vulnerability-response/installed-with-cvr-data.md","title":"Components installed with Container Vulnerability Response","bundle":null,"doc_type":null,"release":"australia","body":"\n# Components installed with Container Vulnerability Response\n\nSeveral types of components are installed with activation of the Container Vulnerability Response application, including tables, user roles, and scheduled jobs.\n\n**Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md).\n\nDemo data is available for this feature.\n\nStarting with v2.11 of Container Vulnerability Response, the most frequently used system properties are now accessible within the Container Vulnerability Response application. To view these system properties, navigate to **All** > **Container Vulnerability Response** > **Properties**.\n\n**Parent Topic:**[Container Vulnerability Response reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-reference.md)\n\n## Roles installed with Container Vulnerability Response\n\nRoles are added with activation of Container Vulnerability Response.\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n**Note:**\n\nIf you are an upgrade customer, access for the users and groups you assigned with the sn\\_vul.vulnerability\\_read and sn\\_vul.vulnerability\\_write permissions prior to v10.3 has not changed. Users and groups remain assigned with these roles until you change them. However, starting with v10.3, you may prefer assigning granular roles for more control over what users and groups can do and see in the Vulnerability Response application. For an overview and more information about managing these roles, see [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-persona-overview.md) and [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n\n
\n\nRole title \\[name\\]\n\n\n\nDescription\n\n
\n\nsn\\_vul\\_container.delete\n\n\n\nDeletes source records. Contains the sn\\_vul\\_cmn.delete, and sn\\_vul\\_container.delete\\_vi roles.\n\n
\n\nsn\\_vul\\_container.ci\\_manager\n\n\n\nManages reclassification of unmatched configuration items \\(CIs\\).\n\n
\n\nsn\\_vul\\_container.configure\\_integrations\n\n\n\nConfigures container integrations.\n\n
\n\nsn\\_vul\\_container.configure\\_vi\\_granularity\n\n\n\nConfigures container vulnerable item granularity.\n\n
\n\nsn\\_vul\\_container.create\\_vi\n\n\n\nCan create container vulnerable items manually.\n\n
\n\nsn\\_vul\\_container.delete\\_vi\n\n\n\nCan delete manually created container vulnerable items.\n\n
\n\nsn\\_vul\\_container.exception\\_approver\n\n\n\nApproves exceptions, deferrals, and closures of container vulnerable items. Contains sn\\_vul.view\\_manager\\_workspace role.\n\nStarting with v2.3, the granular role, sn\\_vul\\_container.read\\_all, has been removed for this role so that you can access the container vulnerable items and remediation tasks assigned to you and your group instead of all the container vulnerable items and remediation tasks.\n\n
\n\nsn\\_vul\\_container.false\\_positive\\_approver\n\n\n\nApproves or rejects closing container vulnerable items as a false positive.Contains the sn\\_vul.view\\_manager\\_workspace role.\n\n
\n\nsn\\_vul\\_container.manage\\_assignment\\_rules\n\n\n\nDefines and updates container vulnerable items assignment rules.\n\n
\n\nsn\\_vul\\_container.manage\\_auto\\_close\\_stale\\_vi\n\n\n\nConfigure the auto-close stale container vulnerable items\n\n
\n\nsn\\_vul\\_container.manage\\_auto\\_exception\\_rule\n\n\n\nManage \\(create/read/update/delete\\) exception rules\n\n
\n\nsn\\_vul\\_container.manage\\_normalized\\_severity\n\n\n\nCan update the mapping to normalize the severity.\n\n
\n\nsn\\_vul\\_container.manage\\_permissions\n\n\n\nCan assign container vulnerability response roles to users.\n\n
\n\nsn\\_vul\\_container.manage\\_remediation\\_target\\_rules\n\n\n\nDefines and updates container remediation target rules.\n\n
\n\nsn\\_vul\\_container.manage\\_risk\\_score\\_configuration\n\n\n\nDefines and updates risk score Calculators, risk rules, and vulnerability Rollup Calculators for Container Vulnerable Items.\n\n
\n\nsn\\_vul\\_container.read\\_all\n\n\n\nCan view all container vulnerable items and related information.Contains the sn\\_vul.view\\_manager\\_workspace role\n\n
\n\nsn\\_vul\\_container.read\\_assigned\n\n\n\nCan view container vulnerable items assigned to you or your groups either in the Classic UI or IT Remediation Workspace.Contains the sn\\_vul.view\\_rem\\_workspace role.\n\n**Important:** Starting with v24.0 of Vulnerability Response, the sn\\_vul\\_container.read\\_assigned role has the privilege to access the IT Remediation Workspace.\n\n
\n\nsn\\_vul\\_container.read\\_assignment\\_rules\n\n\n\nCan view container vulnerable items Assignment Rules.\n\n
\n\nsn\\_vul\\_container.read\\_auto\\_exception\\_rule\n\n\n\nRead Exception rules\n\n
\n\nsn\\_vul\\_container.read\\_discovered\\_image\n\n\n\nCan view discovered items.\n\n
\n\nsn\\_vul\\_container.read\\_integrations\n\n\n\nCan view results from integration runs.\n\n
\n\nsn\\_vul\\_container.read\\_normalized\\_severity\n\n\n\nCan view the normalized severity mapping.\n\n
\n\nsn\\_vul\\_container.read\\_remediation\\_target\\_rules\n\n\n\nCan view Remediation Target Rules.\n\n
\n\nsn\\_vul\\_container.read\\_risk\\_score\\_configuration\n\n\n\nCan view risk score calculators, risk rules, and vulnerability rollup calculators for Container Vulnerable Items.\n\n
\n\nsn\\_vul\\_container.remediation\\_owner\n\n\n\nReads and writes container vulnerable items assigned to them. Vulnerability records are also readable by a user with this role.\n\n
\n\nsn\\_vul\\_container.update\\_assigned\\_to\n\n\n\nCan update assignment of container vulnerable items.\n\n Requires sn\\_vul\\_container.write\\_all or sn\\_vul\\_container.write\\_assigned.\n\n
\n\nsn\\_vul\\_container.update\\_assignment\\_group\n\n\n\nCan update assignment group for container vulnerable items.\n\n Requires sn\\_vul\\_container.write\\_all or sn\\_vul\\_container.write\\_assigned.\n\n
\n\nsn\\_vul\\_container.update\\_state\n\n\n\nCan update states of vulnerable items.\n\n Requires sn\\_vul\\_container.write\\_all or sn\\_vul\\_container.write\\_assigned.\n\n
\n\nsn\\_vul\\_container.vulnerability\\_admin\n\n\n\nConfigures all rules, integrations, and so on for the Container Vulnerability Response product.\n\n
\n\nsn\\_vul\\_container.vulnerability\\_analyst\n\n\n\nMonitors remediation of all container vulnerable items.\n\n
\n\nsn\\_vul\\_container.write\\_all\n\n\n\nCan update all container vulnerable items and remediation tasks.\n\n
\n\nsn\\_vul\\_container.write\\_assigned\n\n\n\nCan update container vulnerable items or remediation tasks assigned to me or my groups.\n\n
\n\nsn\\_vul\\_container.read\\_watch\\_topic\n\n\n\nCan read Watch Topics for container vulnerabilities.\n\n
\n\nsn\\_vul\\_container.create\\_watch\\_topic\n\n\n\nCan create Watch Topics for container vulnerabilities.\n\n
\n\nsn\\_vul\\_container.edit\\_watch\\_topic\n\n\n\nCan edit Watch Topics for container vulnerabilities.\n\n
\n\nsn\\_vul\\_container.manage\\_exception\\_configuration\n\n\n\nCan manage exception management configurations.\n\n
## Tables installed with Container Vulnerability Response\n\nTables are added with activation of Container Vulnerability Response \\(CVR\\).\n\n\n
\n\nTable\n\n\n\nDescription\n\n
\n\nContainer image findingsn\\_vul\\_container\\_image\\_findings\n\n\n\nStores information on the associated vulnerabilities, image layer, docker image,image repository, and discovered image.Starting with v2.11.3 of Container Vulnerability Response, you can also view the path where the finding is shown.\n\n
\n\nContainer Image Layersn\\_vul\\_container\\_image\\_layer\n\n\n\nContains the information of each image layer. An image is a static file with executable code that can create a container on a computing system.\n\n
\n\nContainer Image Packagesn\\_vul\\_container\\_image\\_package\n\n\n\nProvides information about the packages where the vulnerabilities exist. The Binary package details are also provided as a comma-separated value.Starting with v2.11.3 of Container Vulnerability Response, you can also view the package URL \\(PURL\\).\n\n
\n\nContainer vulnerable itemsn\\_vul\\_container\\_image\\_vulnerable\\_item\n\n\n\nContains details of each finding and the corresponding vulnerability.Starting with v2.11.3 of Container Vulnerability Response, you can also view information on the last scan date of an image running as a container.\n\n
\n\nVulnerability Entry sn\\_vul\\_entry\n\n\n\nProvides information on the severity of a CVE and any additional information sent by Prisma.\n\n
\n\nDiscovered container imagesn\\_vul\\_container\\_image\n\n\n\nProvides information on the image ID, Docker image, and the image repository. It also stores the layer information and associates it with the discovered image.Starting with v2.11.3 of Container Vulnerability Response, it also provides information on Image digest of a docker image and last scan date of an image running as a container and a registry.\n\n
\n\nFinding Mappingssn\\_vul\\_container\\_finding\\_m2m\\_vul\\_item\n\n\n\nM2M relationship of the container image findings and the container vulnerable items \\(CVITs\\).\n\n
\n\nAuto-close Vulnerable Itemssn\\_vul\\_container\\_image\\_auto\\_close\\_config\n\n\n\nContains the information on how to close the stale container image findings and roll up the state to the CVITs.\n\n
\n\nContainer Image Vulnerability Keyssn\\_vul\\_container\\_image\\_vulnerability\\_keys\n\n\n\nContains the granularity configuration for creation of CVITs from the container image findings.\n\n
\n\nDocker Related Servicessn\\_vul\\_cmn\\_m2m\\_ci\\_services\n\n\n\nContains all the business services related with a container image.\n\n
\n\nVR Container Countssn\\_vul\\_container\\_vr\\_container\\_counts\n\n\n\nContains the rolling average of container instances spun off from a container image over the last 90 days.\n\n
\n\nContainer Remediation Task Item sn\\_vul\\_container\\_m2m\\_vul\\_group\\_item\n\n\n\nM2M table between CVIT and container remediation tasks.\n\n
\n\nContainer Remediation Task sn\\_vul\\_container\\_vulnerability\n\n\n\nContains container remediation tasks.\n\n
\n\nContainer Remediation Task Manifestsn\\_vul\\_container\\_rt\\_manifest\n\n\n\nAny updates on remediation task will be done by using this manifest table by scheduled jobs.\n\n
## Scheduled jobs installed with Container Vulnerability Response\n\nScheduled jobs are added with activation of Container Vulnerability Response.\n\n**Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md).\n\nDemo data is available for this feature.\n\n\n
\n\nScheduled job\n\n\n\nDescription\n\n
\n\nAssociate existing Container VIs with Auto Exception Rule\n\n\n\nAutomatically associates the Auto Exception Rule with existing container vulnerable items \\(CVITs\\).\n\n
\n\nCheck Container Vulnerable Item Deferment Expiration\n\n\n\nSends notifications if container vulnerable items or container vulnerabilities have expired \\(and if they expire in one week\\).\n\n
\n\nVulnerability Response Container Count \\(Application - Vulnerability Response and Configuration Compliance for Containers\\)\n\n\n\nRuns daily to populate the sn\\_vul\\_container\\_vr\\_container\\_counts table that calculates the 90-day rolling average for containers.\n\n
\n\nAuto-Close CVITs\n\n\n\nAutomatically closes container vulnerability items that match the condition defined in the auto-close configuration. Their status is changed to 'fixed'.\n\n
\n\nCalculate Business Criticality for CVIT\n\n\n\nProcesses all active CVITs and updates the Business Criticality field, based on the affected services of the docker image of the CVIT.\n\n
\n\nClose cancel CVITs that do not have a Docker Image associated\n\n\n\nAutomatically expires CVITs that don’t have a CI associated with. Their state is set to Closed, and substate to Canceled.\n\n
\n\nCalculate Related VI Counts for Container Remediation Task\n\n\n\nCalculates the counts on Container Remediation Task records.\n\n
\n\nRollup container vulnerable item values to vulnerability and group\n\n\n\nCalculates vulnerabilities and group roll ups for container vulnerable items.**Note:** Starting with v2.10 of Container Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task.\n\n
"}}