{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":46227,"path":"security-management/vulnerability-response/vuln-calculators-rules.md","title":"Vulnerability Response calculators and vulnerability calculator rules","bundle":null,"doc_type":null,"release":"australia","body":"\n# Vulnerability Response calculators and vulnerability calculator rules\n\nVulnerability calculators automate calculating initial values for the fields on vulnerable items. The condition for each calculator is evaluated in order, and the first matching calculator is used.\n\n## Vulnerability Calculators\n\nThe Vulnerability Response base system includes two vulnerability calculators that set the base **Risk Score** on the vulnerable item.\n\n-   **Default Risk Calculator**\n-   **Vulnerability Severity**\n\nVulnerability calculators can be built to prioritize and rate the impact of vulnerable items based on any criteria by using condition filters. Whether it is the business impact of the vulnerability, the class of the configuration item \\(CI\\), or the age of the vulnerable item, you can create additional vulnerability calculators to set other fields on vulnerable items. Or you can customize the existing vulnerability calculators. A calculator can be written to reflect any set of priorities. See [Create a Vulnerability Response calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/create-vul-calculator.md) and [Filtering within Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-filtering.md) for more information.\n\nAdditionally, you can use attributes in the configuration\\_item \\[cmdb\\_ci\\] in the Configuration Management Database \\(CMDB\\) to help you create logic for your Vulnerability Response risk calculators. If, for example, you determine that CIs that are external-facing in your organization are more vulnerable and might require immediate remediation, you can assign attributes such as **Internet Facing** for these CIs. This attribute, and others, are listed in the Common Service Data Model release notes . For current information and guidance on the CMDB, see the following topics:\n\n-   [Common Service Data Model conceptual model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/csdm-conceptual-model.md)\n-   [CMDB schema model](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/servicenow-platform/c_ConfigurationManagementDatabase.md)\n-   [Vulnerability Response: Risk Score Calculation \\(KB1169927\\)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1169927)\n\nEach calculator contains a list of calculator rules, with a condition determining when to apply it. When the calculator is run, the condition for each calculator rule is evaluated in order, and the first matching calculator rule is used.\n\nThe **Vulnerability Severity** calculator calculates the **Risk Score** for vulnerable items using the normalized vulnerability severity.\n\n**Note:**\n\n-   Only one calculator per target field \\(**Risk Score**\\) can be active at a time. **Vulnerability Severity** is disabled by default.\n-   Whenever the risk score is updated on a VIT, the **Notes** section is updated with the following details:\n    -   Calculator group name\n    -   Calculator name: Depending on whether the calculator rule is based on a template or a script, the name is appended with the details in brackets. To modify or view the basis of the calculator rule, click on any rule and select the **Advanced view** check box. From the **Value type** drop-down box, select the required option. If Template is selected, the risk score is updated according to the specified condition in the rule. If Script is selected, you can either add or update the existing script.\n\n        The system property **sn\\_sec\\_cmn.risk\\_score\\_changes\\_add\\_worknotes** helps populate the work notes section. Starting with v25.0.3 of Vulnerability Response, the system property is inactive by default. If you enable it, only then you can see all the changes related to the risk score.\n\n\nAll enabled vulnerability calculators set the selected fields each time a vulnerable item is created, when an associated CI or vulnerability changes, or when the **Calculate Risk Score** related link in a vulnerable item is used. As an example, the Risk Score is automatically updated on vulnerable item records when the severity value is updated on a vulnerability that is imported. After a vulnerability import has updated a vulnerability score, the recalculate flag is enabled for that vulnerability. The risk scores for the vulnerable items that have the recalculate flag enabled \\(true\\) with that vulnerability are recalculated.\n\nFrom an existing vulnerable item, if you click the **Calculate Risk Score** related link and either of the calculators is enabled, the **Risk Score** field in the vulnerable item is updated.\n\n**Note:**\n\n-   The **Calculate Risk Score** related link is only visible when at least one vulnerability calculator is enabled.\n-   You can update the risk score for a vulnerable item in the Vulnerability Manager Workspace and IT Remediation Workspace by selecting the **Calculate Risk Score** button in its record view.\n-   Whenever the risk score on a VIT changes, the following details are documented in the Notes section of the VIT:\n    -   Calculator group name\n    -   Calculator name\n    -   Field values with their weightage and risk score contribution\n    -   Final risk score\n\n## Vulnerability Calculator Rules\n\nThe base system calculator **Default Risk Calculator** contains the rule**Default Risk Rule**, a specialized vulnerability calculator rule called a **Risk Rule**. It calculates **Risk Score** based on multiple values:\n\n-   Vulnerability severity\n-   Exploit information\n-   Criticality\n-   External exposure of the CI with the vulnerability\n-   EPSS scores\n\nYou can adjust the values to use in the **Default Risk Rule** and how much weight to give each of these values. Weights are used to adjust how much each element counts when setting the base **Risk Score**.\n\nYou can customize the criteria for the default risk rule. For more information, see [Define fields and weights for the risk rule for Vulnerability Response Risk Calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calc-define-risk-rule-fields.md).\n\nFor an example of how risk scores for risk rule calculators are determined, see [Risk score calculation example for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calc-risk-rule-example.md).\n\nAssigning a weightage percentage\n\nYou can also assign weightage percentage \\(0-100\\) at the field value level, for example, you can assign a weightage percentage to each level of Severity \\(None to Critical\\).\n\nIf the severity weightage is 50 for the risk rule, and the following weightage values are assigned for the Severity level:\n\n|Vulnerability severity|Risk score|\n|----------------------|----------|\n|Critical|100|\n|High|50|\n|Medium|20|\n|None|0|\n\nIf the severity is critical, the equivalent weightage is 50. If the severity is high, the equivalent weightage is 25, and if the severity is medium, the equivalent weightage is 10. If the severity is None, the equivalent weightage is 0. For more information, see the [Risk score calculation example for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-calc-risk-rule-example.md).\n\nVulnerability calculator rule settings\n\nEach rule has an **Order** setting. However, the first one to match the conditions updates the **Risk score** field in the vulnerable item. For more information on vulnerability calculator rule settings, see [Create a Vulnerability Response calculator](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/create-vul-calculator.md). Non-scripted calculator rules typically create less of a performance impact than scripted calculator rules.\n\nThe base system **Vulnerability Severity** calculator contains calculator rules that assign each level of severity \\(None to Critical\\) a value \\(0-100\\) for **Risk Score** based on severity. **Unknown Severity** is automatically assigned a risk score of 100. These values can be adjusted and, like **Default Risk Calculator**, new calculator rules or new risk rules can be created.\n\n## Vulnerability Risk Score Weights\n\nAll vulnerabilities are assigned a risk score and rating based on factors such as severity, criticality, exploit information, and so on. The business rule **Update Risk Rating from Risk Score** on the vulnerable item table is responsible for calculating the risk rating. Whenever the risk score changes, the risk rating is calculated and populated on the vulnerable items.\n\n|Value \\(Risk Rating\\)|Weight \\(Risk Score\\)|\n|---------------------|---------------------|\n|1|90–100|\n|2|70–89|\n|3|40–69|\n|4|1–39|\n|5|0|\n\n-   The risk rating types are shipped in the base table as vr\\_risk\\_rating. These types are passed as part of the business rule on each table where the risk rating is calculated.\n-   The script is modified so that you can query the entries in the Risk Score Weights table values for the risk rating calculation.\n-   Add additional entries for an existing type or create a new type. When you create a new type, ensure that you add the labels for the new risk rating, and also modify the related scripts and business rules. You must also add a new style for the new risk score.\n-   Modify the script to query the records in the base table.\n\nYou can access the Risk Score Weights table by entering sn\\_sec\\_cmn\\_risk\\_score\\_weight \\(for versions below 30.0\\) or sn\\_sec\\_calculator\\_risk\\_score\\_weight \\(for versions 30.0 and above\\) in the filter navigator.\n\nIn addition, the risk score is automatically recalculated when the associated Common Vulnerabilities and Exposures \\(CVEs\\) or third-party entries \\(TPEs\\) on the vulnerability items \\(VIs\\) are linked to a CVE Known Exploit Vulnerability \\(KEV\\).\n\n## Tenable Vulnerability Integration and the Tenable Risk Rule\n\nThe Tenable Risk Rule is available with the Tenable Vulnerability Integration. The Vulnerability Priority Rating \\(VPR\\) is an attribute from the Tenable product that is imported and used with a new default risk calculator in Vulnerability Response. The Tenable Risk Rule is installed with the Vulnerability Response Integration with Tenable application as part of the Default Risk Calculator in the Vulnerability Calculators from Vulnerability Response.\n\nThis risk rule is disabled by default. See [Configure the Tenable Vulnerability Integration using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-tenable-config-in-SA.md).\n\n**Parent Topic:**[Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vuln-landing-page.md)\n\n"}}