{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45810,"path":"security-management/vulnerability-manager-workspace/vr-unified-dashboard.md","title":"Unified Vulnerability Response Dashboard","bundle":null,"doc_type":null,"release":"australia","body":"\n# Unified Vulnerability Response Dashboard\n\nThe Unified Vulnerability Response dashboard provides a comprehensive view of an organization's vulnerabilities and risks. The vulnerabilities related to infrastructure, cloud, applications, and containers can be viewed in a centralized dashboard for better visibility and remediation.\n\nWatch this four-minute video to learn about the Unified Vulnerability Response Dashboard.\\[Omitted video\\] Description: Unified Vulnerability Response Dashboard\n\n## Required ServiceNow AI Platform roles\n\nThe following roles are associated with this solution. They’re required for viewing, editing, and sharing the reports:\n\n-   sn\\_vul.app\\_sec\\_manager\n-   sn\\_vul.vulnerability\\_admin\n-   sn\\_vul.vulnerability\\_analyst\n-   sn\\_vulc.admin\n-   sn\\_vul\\_container.vulnerability\\_admin\n-   sn\\_vul\\_container.vulnerability\\_analyst\n-   sn\\_vul.app\\_developer\n-   sn\\_vulc.vulnerability\\_analyst\n\n## Access the Unified Vulnerability Response Dashboard\n\nTo open the dashboard, navigate to either:\n\n-   **All** &gt; **Vulnerability Response** &gt; **Vulnerability Manager Workspace** and select the **Dashboards** icon. Depending on your role, the default dashboard is displayed. To view the Unified Vulnerability Response Dashboard, select the drop-down next to the dashboard name.\n-   **Workspaces** &gt; **Platform Analytics Workspace** &gt; **Dashboards** &gt; **Unified Vulnerability Response Dashboard**.\n\n\\[Omitted image \"vr-unified-dashboard.png\"\\] Alt text: Unified Vulnerability Response dashboard\n\n## Use cases\n\nFor examples of how different people in your organization would use this dashboard, see these use cases.\n\n<table id=\"table_rgy_zrw_ywb\"><thead><tr><th>\n\nUsers\n\n</th><th>\n\nDashboard use\n\n</th></tr></thead><tbody><tr><td>\n\n-   Vulnerability Managers\n-   Vulnerability Analysts\n\n</td><td>\n\n-   Provides real-time visibility of the risks present in infrastructure, applications, configurations, and containers. Enables Vulnerability Managers and Vulnerability Analysts to prioritize and remediate the vulnerabilities in a timely way.\n-   Provides an Attack Surface Overview of critical assets, which can be used to track the remediation progress and efforts.\n-   Provides an overview of risks across business units \\(BUs\\). You can use filters to select BUs and compare the progress to reallocate resources, as necessary. Role-level access must be provided to the BU head.\n-   Provides visibility into the potential impact by BUs. You can use the Common Vulnerability and Exposure \\(CVE\\) filter to identify exposures across the organization.\n-   Provides visibility into the EPSS scores attained by vulnerable entries that exist in the CISA KEV catalog for Application, Host, and Container vulnerable items.\n\n</td></tr></tbody>\n</table>## Unified Vulnerability Response Dashboard tabs\n\nThis dashboard lets you see the vulnerabilities or issues that are present in hosts, cloud, configurations, applications, and containers. You can view the vulnerabilities based on the business unit, assignment group, risk rating, criticality, and whether an exploit exists for the vulnerabilities.\n\nThe **Asset Overview** tab provides the overall status of configuration items \\(CIs\\) in the system.\\[Omitted image \"vr-ws-ud-asset-overview.png\"\\] Alt text: Asset Overview tab\n\nThe **Vulnerability Overview** tab provides a status on the types of vulnerabilities such as host, application, container.\\[Omitted image \"vr-ws-ud-vulnerability-overview.png\"\\] Alt text: Vulnerability Overview tab\n\nThe **Assignment Overview** tab provides a status on the assignment of the vulnerabilities.\\[Omitted image \"vr-ws-ud-assignment-overview.png\"\\] Alt text: Assignment Overview tab\n\nThe **Exception Management** tab provides a status on the deferred vulnerabilities.\\[Omitted image \"vr-ws-ud-exception-management.png\"\\] Alt text: Exception Management tab\n\nThe **Service Level Agreement \\(SLA\\)** tab provides a status on the service level agreement attained by different assignment groups.\\[Omitted image \"vr-ws-ud-SLA.png\"\\] Alt text: Service level Agreement SLA tab\n\nThe **Exclusion overview** tab provides a status of exclusion rules you have created, as well as those affecting detections that are internet-facing and have available exploits. \\[Omitted image \"vr-ws-ud-exclusion.png\"\\] Alt text: Exclusion overview tab\n\nThe **Vulnerability Intelligence** tab provides a status on the EPSS scores attained by vulnerabilities having the CISA KEV flag true and EPSS Score &gt;= 0.9 for Application, Host, and Container Vulnerable items.\\[Omitted image \"vr-ws-ud-vuln-intelligence.png\"\\] Alt text: Vulnerability Intelligence tab\n\n## Filters\n\nYou can filter the widgets based on the following:\n\n-   Business unit\n-   Assignment group\n-   Risk rating\n-   Criticality of assets\n-   Internet facing\n-   Exploit exists\n\nWhen a filter is selected, the data in all widgets gets updated. However, if a filter is not applicable for a widget, a cross symbol is shown next to the filter name.\n\n**Note:** Only Business unit and Assignment group filters are available in Tokyo. All the filters are available from Utah onwards.\n\n## Indicators\n\n-   **Scanned assets**\n\n    Formula indicator for assets scanned in the last 60 days. Contains scanned discovered item assets, scanned application release assets, scanned discovered container image assets as contributing indicators.​\n\n-   **Assets - Exploit exists**\n\n    Formula indicator for assets where exploit exists in the vulnerabilities. Contains Host assets - Exploit exists, Application assets - Exploit exists, Container assets - Exploit exists as contributing indicators.​\n\n-   **Infra Asset - Internet Facing**\n\n    Indicator for fetching the count of assets, which are internet facing.\n\n-   **Discovered items based on Cloud Resource type**\n\n    Indicator for fetching the count of assets having an asset category such as cloud.​\n\n-   **Base Images**\n\n    Indicator for fetching the count of base images​.\n\n-   **CISA KEVs Asset Type**\n\n    Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV \\(BOD 22-01\\) flag set to true. Contains CISA exists CVR, and CISA exists Vul Items as contributing indicators.\n\n-   **CISA Exists Vulnerable Items – Unassigned**\n\n    Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV \\(BOD 22-01\\) flag set to true and the vulnerable items are unassigned. Contains Unassigned Container Vul Items, Unassigned Host Vul Item as contributing indicators.\n\n-   **CISA Exists Vulnerable Items - Target Missed**\n\n    Formula indicator, which gives the count of container and host vulnerable items where the vulnerability has the CISA KEV \\(BOD 22-01\\) flag set to true and the vulnerable items have missed the target. Contains CISA exists Vul Items, CISA exists CVR as contributing indicators.\n\n-   **Active Host VITs**\n\n    Count of active host vulnerable items \\(VITs\\).\n\n-   **Active Application VITs**\n\n    Count of active application vulnerable items \\(AVITs\\).\n\n-   **Active Container VITs**\n\n    Count of active container vulnerable items \\(CVITs\\).\n\n-   **New VITs**\n\n    Count of VITs that opened on a day.\n\n-   **New AVITs**\n\n    Count of AVITs that opened on a day.\n\n-   **New CVITs**\n\n    Count of CVITs that opened on a day.\n\n-   **New Test Results**\n\n    Count of test results \\(TRs\\) that were created on a day.\n\n-   **Closed AVITs**\n\n    Count of VITs closed on a day.​\n\n-   **Closed VITs**\n\n    Count of AVITs closed on a day.\n\n-   **Closed CVITs**\n\n    Count of CVITs closed on a day.\n\n-   **Closed Test Results**\n\n    Count of TRs closed on a day.\n\n-   **Open Config Issues - Test results**\n\n    Count of all open test results, which are in failed state.\n\n-   **Organization Risk Score**\n\n    Risk score of an organization from the Rollup Application Risk Score table.\n\n-   **Unassigned Application Vul Item**\n\n    AVITs with no assignment group or assigned to.\n\n-   **Unassigned Host Vul Item**\n\n    VITs with no assignment group or assigned to.\n\n-   **Unassigned Container Vul Items**\n\n    CVITs with no assignment group or assigned to.\n\n-   **Unassigned Config Issues**\n\n    TRs with no assignment group or assigned to.\n\n-   **Deferred VITs**\n\n    VITs in deferred state.\n\n-   **Deferred AVITs**\n\n    AVITs in deferred state.​\n\n-   **Deferred CVITs**\n\n    CVITs in deferred state.\n\n-   **Host SLA - Closed**\n\n    Average age closed of closed VITs.​\n\n-   **Application SLA - Closed**\n\n    Average age closed of closed AVITs.​\n\n-   **Container SLA - Closed**\n\n    Average age closed of closed CVITs.​\n\n-   **Test Result SLA - Passed**\n\n    Average age closed of passed TRs.​\n\n-   **Host SLA - Closed \\(Critical &amp; High\\)**\n\n    Average age closed of closed critical and high VITs.\n\n-   **Application SLA - Closed \\(Critical &amp; High\\)**\n\n    Average age closed of critical and high AVITs.​\n\n-   **Container SLA - Closed \\(Critical &amp; High\\)**\n\n    Average age closed of closed critical and high CVITs.​\n\n-   **Test Result SLA - Passed \\(Critical &amp; High\\)**\n\n    Average age closed of passed critical and high TRs.​\n\n-   **Aggregate MTTR**\n\n    Average age closed of closed VITs, AVITs, CVITs, and TRs.​\n\n-   **SLA Missed**\n\n    Average age closed of closed and target missed VITs, AVITs, CVITs, and TRs.\n\n-   **Vulnerabilities With EPSS Scores &gt;= 0.9**\n\n    Count of vulnerability entries with EPSS scores greater than or equal to 0.9.\n\n\n## Breakdowns\n\n-   VIT type \\(unified\\)\n-   Internet Facing \\(unified\\)\n-   Risk Rating \\(unified\\)\n-   Exploit Exists \\(unified\\)\n-   Discovered Item Cloud Resource Type \\(unified\\)\n-   CISA Exists \\(unified\\)\n-   CMDB class \\(unified\\)\n-   Business Unit \\(unified\\)\n-   Business Criticality \\(unified\\)\n-   Deferred Reason \\(unified\\)\n-   Assignment group \\(unified\\)\n-   Remediation Status \\(unified\\)\n\n## Data visualizations\n\n<table id=\"table_nkz_jcn_2yb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nAttack Surface Overview\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber representing the aggregated score of an organization's security.\n\n</td></tr><tr><td>\n\nCMDB CI Count\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber of CIs in the organization that are registered and tracked in the Configuration Management Database \\(CMDB\\). Provides a breakdown of the following CIs:-   Scanned CIs: Number of scanned CIs\n-   Exploit: Number of exploits available\n-   Internet Facing: Number of internet facing CIs\n\n</td></tr><tr><td>\n\nCloud Resource\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber of CIs with asset category such as cloud. Provides a breakdown of the following cloud assets:-   AWS\n-   Azure\n-   GCP\n\n</td></tr><tr><td>\n\nDocker Image\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber of docker images including the number of base images.\n\n</td></tr><tr><td>\n\nApplications\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber of applications in the organization.\n\n</td></tr></tbody>\n</table><table id=\"table_cmg_kvt_2yb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nCISA KEVs\n\n</td><td>\n\nPie Chart\n\n</td><td>\n\nNumber of vulnerabilities associated with the CISA catalog and CISA flag as true.\n\nProvides a breakdown based on the following:-   CISA Vulnerability: Types of vulnerabilities with CISA flag as true\n-   Host CIs - Internet Facing: Internet facing CIs\n-   Unassigned VITs: Unassigned VITs with CISA flag as true\n-   VITs missed target: VITs that missed target with CISA flag as true\n\n</td></tr><tr><td>\n\nActive Vulnerabilities by Criticality\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nNumber of active VITs, AVITs, and CVITs based on criticality.\n\n</td></tr><tr><td>\n\nVulnerability creation and closure trend\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nNumber of new and closed vulnerabilities for all applications. Provides a trend for the last three months.\n\n</td></tr><tr><td>\n\nMisconfiguration by cloud platform\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nNumber of configuration issues based on risk rating for each cloud asset.\n\n</td></tr><tr><td>\n\nCloud Compliance\n\n</td><td>\n\nTable\n\n</td><td>\n\nList of resources with the asset category as cloud along with the following details:-   Resource name\n-   Class\n-   Vulnerability issues: Number of issues present in the resource that are aggregated based on the risk rating.\n-   Configuration issues: Number of resources with configuration issues along with the risk rating.\n-   Cloud account: Cloud account ID.\n-   Cloud region: Location of the cloud resources.\n-   Cloud provider: Name of the cloud provider.\n\n</td></tr></tbody>\n</table><table id=\"table_ekl_4vt_2yb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nUnassigned VITs\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nNumber of vulnerabilities that aren’t assigned to any group or individual along with the risk rating.\n\n</td></tr><tr><td>\n\nMTTR by Assignment Group - Top 10\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nMean time taken by an assignment group to identify and remediate the security vulnerabilities or issues. The top 10 assignment groups are displayed that have the highest mean time for remediation.\n\n</td></tr><tr><td>\n\nTop 10 Assignment Groups missing SLA \\(Critical &amp; High Vulnerability\\)\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nTop 10 assignment groups that missed the target date of remediation of critical and high vulnerabilities.\n\n</td></tr></tbody>\n</table>|Title|Type|Description|\n|-----|----|-----------|\n|Deferred VITs|Stacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar|Number of vulnerabilities in the deferred state based on risk rating.|\n|Critical and High Deferred VITs by Assignment Group|Stacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar|Number of vulnerabilities with critical and high risk ratings in the deferred state that is categorized based on the assignment groups.|\n\n<table id=\"table_tys_4vt_2yb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nHost Vulnerability: SLA attainment by assignment group\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nTime taken by an assignment group to remediate host vulnerabilities. Provides a trend for the last 10 months.\n\n</td></tr><tr><td>\n\nCompliance Issues: SLA attainment by assignment group\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nTime taken by an assignment group to remediate compliance issues. Provides a trend for the last 10 months.\n\n</td></tr><tr><td>\n\nApplication Vulnerability: SLA attainment by assignment group\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nTime taken by an assignment group to remediate application vulnerabilities. Provides a trend for the last 10 months.\n\n</td></tr><tr><td>\n\nContainer Vulnerability: SLA attainment by assignment group\n\n</td><td>\n\nMultiple Line \\[Omitted image \"line-multiple.svg\"\\] Alt text: Multiple Line\n\n</td><td>\n\nTime taken by an assignment group to remediate container vulnerabilities. Provides a trend for the last 10 months.\n\n</td></tr></tbody>\n</table><table id=\"table_i3v_ckp_kbc\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nExclusion rules\n\n</td><td>\n\nTable\n\n</td><td>\n\nList of all exclusion rules you have created.\n\n</td></tr><tr><td>\n\nExclusion rules v/s Internet facing\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nExclusion rules impacting detections which belong to internet facing assets.\n\n</td></tr><tr><td>\n\nExclusion rules v/s Exploit exists\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nExclusion rules impacting detections that are vulnerable to existing exploits.\n\n</td></tr></tbody>\n</table><table id=\"table_x2q_lww_4zb\"><thead><tr><th>\n\nTitle\n\n</th><th>\n\nType\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nVulnerabilities with EPSS Score&gt;= 0.9\n\n</td><td>\n\nTable\n\n</td><td>\n\nComplete list view of all vulnerable entries \\(CVEs or TPEs\\) that have an EPSS score greater than or equal to 0.9 along with the following details.-   ID: CVE ID of the vulnerability\n-   EPSS Score\n-   EPSS Last Modified\n-   CISA KEV BOD 22-01: Indicates if the entry exists in the CISA KEV BOD \\(Binding Operational Directive 22-01\\)\n-   Total VIs: Total count of VIs that exist for this vulnerability entry.\n-   Total Container VIs: Total count of container VIs that exist for this vulnerability entry.\n-   Severity\n\n</td></tr><tr><td>\n\nExternal Facing Host Vulnerable Items With EPSS Score &gt;= 0.9\n\n</td><td>\n\nSingle score\\[Omitted image \"single-score.png\"\\] Alt text: Single score\n\n</td><td>\n\nNumber indicating the aggregate count of external facing host vulnerable items with an EPSS score greater than or equal to 0.9. Provides single scores sorted by severity of risk rating.\n\n</td></tr><tr><td>\n\nExternal Facing Host Vulnerable Items By Risk Rating\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nNumber of external facing host vulnerable items by risk rating. The stack bars are categorized by EPSS Score &gt;=0.9 and CISA KEV =True.\n\n</td></tr><tr><td>\n\nVulnerable Items With EPSS Score &gt;= 0.9 By Risk Rating\n\n</td><td>\n\nStacked Bar\\[Omitted image \"stacked-column-bkdown-icon.png\"\\] Alt text: Stacked Bar\n\n</td><td>\n\nNumber of vulnerabilities with EPSS score greater than or equal to 0.9 sorted by risk rating. Provides a breakdown by host vulnerable items, application vulnerable items, and container vulnerable items.\n\n</td></tr></tbody>\n</table>## Scheduled jobs for data collection\n\nData collection jobs automatically collect scores for automated indicators and breakdowns. The following scheduled jobs are run to collect scores on new data automatically.\n\n**Warning:** By default, the following data collection jobs are deactivated in the base system:\n\n-   Unified Dashboard Daily Data Collection\n-   Unified Dashboard Weekly Data Collection\n-   Unified Dashboard Historical Data collection\n\nBefore enabling the jobs, refer to the [KB](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1444679).\n\n<table id=\"table_dqc_c54_kxb\"><thead><tr><th>\n\nScheduled job\n\n</th><th>\n\nFrequency\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nUnified Dashboard Historical Data collection\n\n</td><td>\n\nOnce\n\n</td><td>\n\nCollects scores and snapshots for existing records.\n\n</td></tr><tr><td>\n\nUnified Dashboard Weekly Data Collection\n\n</td><td>\n\nWeekly\n\n</td><td>\n\nCollects data weekly.\n\n</td></tr><tr><td>\n\nUnified Dashboard Daily Data Collection\n\n</td><td>\n\nDaily\n\n</td><td>\n\nCollects data everyday.\n\n</td></tr><tr><td>\n\nRollup Risk scores to Organization\n\n</td><td>\n\nDaily\n\n</td><td>\n\nCollects the aggregated risk score for an organization.\n\n</td></tr><tr><td>\n\nPopulate cloud compliance daily counts\n\n</td><td>\n\nDaily\n\n</td><td>\n\nCollects data for cloud compliance.\n\n</td></tr><tr><td>\n\nEPSS Daily Job\n\n</td><td>\n\nDaily\n\n</td><td>\n\nCollects EPSS data from First.org.\n\n</td></tr></tbody>\n</table>A new table Rollup Application Risk Score \\[sn\\_vul\\_cmn\\_rollup\\_app\\_risk\\_score\\] is created in the Vulnerability Common Scope. This table is populated using the following rollup calculators via the scheduled jobs everyday.\n\n|Rollup calculator name|Description|\n|----------------------|-----------|\n|Organization Risk Score Rollup|Rolls up the risk scores for all vulnerable items and configuration issues in an organization. It provides an overall risk score for an organization.|\n|Vulnerable Item Rollup|Rolls up the risk scores for all vulnerable items in an organization, to contribute to the overall risk score of an organization.|\n|Application Vulnerable Item Rollup|Rolls up the risk scores for all application vulnerable items in an organization, to contribute to the overall risk score of an organization.|\n|Container Vulnerable Item Rollup|Rolls up the risk scores for all container vulnerable items in an organization, to contribute to the overall risk score of an organization.|\n|Test Result Rollup|Rolls up the risk scores for all test results in an organization, to contribute to the overall risk score of an organization.|\n|Rollup EPSS Scores from NVDs to TPEs|Rolls up EPSS Scores from NVDs to TPEs, to contribute to the overall risk score of an organization.|\n\n"}}