Automating Vulnerability Response
About 20% of the CIS-VR exam — see all 5 domains.
This domain covers reducing manual toil through orchestration, flows, and integrations to downstream systems.
- Flow Designer & IntegrationHub are the modern automation engines. VR ships flows/subflows for tasks like creating scan records, triggering scans, routing exception approvals, and creating downstream tickets. Older material references Vulnerability Response Orchestration workflows/activities (e.g., "Scan vulnerability" workflow); current releases increasingly favor Flow Designer. Expect questions that contrast workflow vs. flow.
- Change Management integration: remediation can generate Change Requests so that patching follows the organization's change process (CAB approval, scheduling). VR integrates with ITSM Change so a remediation task can spawn a change record and track its state back.
- CMDB integration is automated end-to-end: detections auto-match via CI lookup rules, IRE auto-creates/reconciles CIs, and retired-CI logic auto-closes related VIs.
- Patch Orchestration: integrations such as Microsoft SCCM, HCL BigFix, and others let VR drive actual patch deployment and read patch state back, so a vulnerable item can move toward closure automatically once the patch lands.
- Solution Management automation: VSM pulls vendor solution data (MSRC, Red Hat via CSAF, Cisco via CVRF, Rapid7) so remediation tasks are pre-populated with the fix.
- Agile/ticketing integration: the Jira integration can auto-create and synchronize Jira issues from vulnerable items for dev-owned remediation, on a scheduler.
- Automated triage / auto-assignment / ML: rules and ML models can triage and assign VIs without human routing. Auto-close, auto-promote, and bulk-edit actions also reduce manual work.
Sample questions from this domain
Three of the 52 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow capability is most commonly used to build custom Vulnerability Response automation beyond the baseline rules, such as extra notifications or escalations?
- A. Flow Designer (flows and subflows) ✓
- B. Workflow Editor (legacy workflows)
- C. Remediation target rules (due dates)
- D. Assignment rules (group routing)
Why: Flow Designer is the low-code tool used to build flows and subflows for custom Vulnerability Response automation. Baseline grouping, routing and due dates are handled by remediation task rules, assignment rules and remediation target rules, so those baseline rules are what flows extend rather than the tool for extra notifications or escalations. The legacy Workflow Editor still exists, but new automation is built in Flow Designer.
Which best describes how assignment rules help automate Vulnerability Response?
- A. They automatically group Vulnerable Items into remediation tasks for each assignment group based on conditions
- B. They automatically set the due date and target status of Vulnerable Items based on defined criteria and risk
- C. They automatically route Vulnerable Items to the appropriate assignment group based on defined criteria ✓
- D. They automatically assign the Risk Score of Vulnerable Items based on ordered conditions and CI attributes
Why: Assignment rules route Vulnerable Items to an assignment group based on defined criteria (the base rule uses the CI support group), and remediation task rules then use that group to assign the remediation task. Grouping VIs into tasks is the job of remediation task rules, due dates and target status come from remediation target rules, and the Risk Score is set by vulnerability calculators.
An organization wants Vulnerable Items above a certain risk threshold to automatically generate a remediation task. Which approach implements this?
- A. A remediation target rule that sets a due date when the risk score crosses the threshold
- B. An assignment rule that routes high-risk Vulnerable Items to a remediation owner group
- C. A Watch Topic that lists Vulnerable Items above the risk threshold for an analyst to monitor
- D. A flow triggered on Vulnerable Item creation/update that evaluates risk and creates the task ✓
Why: A flow triggered on Vulnerable Item creation or update can evaluate the risk and automatically create a remediation task when the threshold is met. In the baseline, a remediation task rule with a risk condition can also do this without custom code; a flow is the option when extra logic is needed. A remediation target rule sets due dates and target status, an assignment rule sets the assignment group, and a Watch Topic monitors VIs, so none of them creates a remediation task.