hello everyone my name is John Gibbons and today I will be talking about servicenow vulnerability response classification rules some of the things I'd like to cover are what are classification rules how do classification rules work how to build and modify classification rules best practices when building and implementing classification rules and troubleshooting steps for classification rules what are classification rules classification rules provide the ability to apply classification attributes on vulnerability response records these attributes can then be reused multiple times in other triage processing logic thereby improving the performance of triage rules such as assignment rules vulnerability calculators or remediation Target rules classification rules are separated into classification groups these are based on the table that the rule should be applied to there is an available system property that will allow you to extend this functionality to additional tables such as configuration compliance the Baseline classification groups are separated into the following discovered items and vulnerability entry how do classification rules work wherever vulnerabilities and discovered items are imported the vulnerability classification rules in the respective groups get executed based on the conditions set within the rule the records will get classified in the relevant classification attributes will be applied to those records now let's go ahead and jump into a demo okay now that we've jumped into our instance I went ahead and I went to classification groups so this is under vulnerability response Administration and then classification rules we're going to go ahead and focus on a vulnerability entry classification today so let's go ahead and dive in and create a rule so the first thing we want to do is we once once we get in here we want to go ahead and click new this is going to go ahead and bring up the form we want to go ahead and name this so today we're going to be looking for Adobe based application vulnerabilities let's go ahead and give us a name the execution order is at 100 that's fine for now you can adjust this up or down as needed in general you want to have more granular type rules run before broader type rules uh we're gonna go ahead and give us a description it's not required but it's good when you have like types of classification rules and then we're going to go ahead and build out the condition so in order to do this we usually have to look at the data unless you know specifically what you're looking for but let's go ahead and open up the third party cable if we take a look at that so what we want to do is we want to look for third-party vulnerability entries that have a vendor of adobe so let's just go ahead and add in a few columns here that we're going to need if we take a look at vendor and then let's take a look at remediation notes and then we're going to go ahead and we're going to move all of these up a little bit so that they're right in front of us so if we take a look for Adobe based ones right so if we just do anything that contains Adobe you can see we got about 737 of those um you know generally I mean if that's good enough if all Adobe based vulnerabilities would go over uh then that's pretty simple rule so let's let's start there so first thing we want to do is vendor and you can see uh there's no results because we need to go dot walk off the third party vulnerability entry record so you can see now we have vendor and we're just going to do contains Adobe after that we're going to go ahead and apply the the values so these are suggestion Fields here so you can see we do have a list of out of the box values you can add these as you need but for this we're just going to go ahead and pick application and again for the type we're going to go ahead and pick Adobe once we do that we're going to go ahead and submit and then we'll go back to classification rules and this is where we're going to go ahead and reapply so what this will do is this will apply this rule to any existing third-party records if anything net new comes in then these rules will automatically be applied and you don't have to do this so let's go ahead and do that uh yep we're gonna go ahead and reapply it and then we're gonna have to wait until the job is done so to do it you can take a look at the the background jobs here you can kind of get an idea of what's going on so let's uh let's hang out and wait for this to finish and then um once we do that we'll come back and we'll validate our data that that it could apply properly so we can see here that the job went ahead and went through it's just waiting for it to complete going through all the records uh so once this is done we'll go take a look at the data okay looks like our job has completed so now we can go back and let's take a look at the third party records here so you can see here we've got a bunch of adobe vulnerabilities here you know they were classified as Adobe and application so the next thing we want to do is we want to take a look to make sure that this is the right data set for the rule um you know this usually involves going back and forth with the with the process owners to make sure that we have the right data and and we're we're capturing the right vulnerabilities so uh what we're going to take a look at is we're going to kind of go through um adding some additional conditions into the remediation notes um so if we take a look here for um vulnerabilities let's go ahead and build out our filter here so we're going to say vendor uh contains Adobe and let's let's take a look at the at the vendor right maybe maybe we're a little bit too broad in our our um saying it contains so that does not appear to be the case it looks like everything is Adobe next thing we're going to do is take a look at the remediation notes Here so we're going to say and remediation notes contains upgrade two or update to let's see if that shrinks our number down a little bit what's up so you can see that brought it down to seven so if we take a look at that we may have to go back into our Rule and and modify it just a bit so if we come back into our classification rule we can come in here and we can kind of update this condition to make it a little bit more granular mediation notes contains upgrade to or update to we're going to go ahead and update that and then we're going to go ahead and reapply so uh some of the classified or some of the best practices around classification rules uh is you want to make sure you're pretty tight on your conditions here so that you don't have to come back in and keep adding different operands um you're right to eventually narrow down the scope of what's being captured um if you're going to write um any scripts you do have the ability to do that in these rules if you go into advanced view here you can see that the condition type is has given us some different options here filter is what we just did there is the filter group filter groups are available in this in in the base system to use for for different types of filters and you can also write a script if we're going to write a script we want to make sure that we we properly dot walk anything that we need to to get from the SN volt entry table to the third-party vulnerability table um we should have you know the least amount of return statements available in a script and if you have a lot of uh you know like scripts you're going to want to make sure that you're you're very careful that none of them overlap and that your orders are correct uh as far as the troubleshooting goes for for these rules uh it's pretty much what I just went through um you know if you if you run it and then you you go and review this with the stakeholder uh and they're like that's that's way too many records we need to narrow it down right then you really need to start going through the record looking at the data finding uh the different attributes that that they're looking for usually it's in remediation notes or in threat uh sometimes it's it's you know the different attributes that are available on the record so all of these are available to use in that condition statement to go ahead and try to narrow down your rules uh the some of the other ways that you can use this in in some of the other triaging logic as I mentioned before uh right so if we go like to remediation Target rules we can take a look here um you know in in the condition that's where you can go ahead and say the um the vulnerability entry record here right then you're going to want to go over to the classification rules so you can go classification right classification type is application and sorry that would be Adobe and this is application that way you can develop specific rules based on the classification types Adobe type vulnerabilities may be more critical to resolve versus normal other types of vulnerabilities so it just gives you the flexibility to add these types in here which should reduce any kind of processing logic that needs to be run for these rules all right I appreciate everybody going through this with me today and have a great day