Vulnerability Response Usage calculations are viewed in a few different areas, Subscription Management and VR Usage summary Report(Starting version v16.5.4). We will discuss how each method calculates usage metrics.

The main calculations used for Vulnerability Response Customer usage within the Subscription Overview have the following criteria:

1. DEFN1005547: This definition contains the following four definitions to obtain the aggregated usage of Vulnerability Response and Configuration compliance.
   
   1. Counts devices in the Discovered Items table from infrastructure scanners such as Qualys,Tenable and Rapid7.
      
   2. Includes Cloud VMs scanned by Qualys, Tenable, or Rapid7.
      
   3. Discovered Items with state ‘CI Decommissioned’ for the retired CIs in CMDB not counted.
      
   4. Counts devices in the Discovered Items table from Cloud Security mis-configuration scanners such as Palo Alto Prisma
      
      1. Note:This definition will start collecting the metrics from the May/2022 release with Prisma Cloud and CC integration usage.
         
   5. Counts devices in the VR Container table. This table includes the count of running container instances from Container Vulnerability scanners such as Palo Alto Prisma Cloud Compute averaged over 90 days.
   6. DEFN1005414: Discovered items scanned in last 90 days.
   7. DEFN1005382: Discovered items exclusively identified as a cloud asset and scanned in last 90 days.
   8. DEFN1005385: Discovered running container instances in last 90 days (with rolling averages).
   9. DEFN1003246: Tenable assets last 90 days.This counts devices in a Tenable Assets table, which is the table where devices scanned by Tenable are stored. For avoidance of doubt, the Tenable Assets table, stores devices used by the Tenable for Vulnerability Response application (built by Tenable). In Jun, 2020, definition was created to capture tenable scanned assets (Existing Definition)

These definitions can be viewed by going to the UA Downloaded Table Stats Definitions(ua_stats_defn). Look at How Vulnerability Response Calculates Customer Usage for further details.

The main calculations used for the VR Usage summary Report us the following criteria In Discovered Items:

1. Compliance Last Scan Date OR Last Scan Date within the last 90 days AND Asset Category is 'Infra' OR is Empty AND Discovered Item State is not 'CI Decommisioned'OR
2. Non-infra Compliance Last Scan Date OR Non-infra Last Scan Date within the last 90 days OR Non-infra Compliance Last Scan Date OR Non-infra Last Scan Date is Empty AND Asset Category is not 'Infra' AND Discovered Item State is not 'CI Decommisioned'"

Look at VR Usage summary report for further details.