Automating Vulnerability Response
About 20% of the CIS-VR exam — see all 5 domains.
This domain covers reducing manual toil through orchestration, flows, and integrations to downstream systems.
- Flow Designer & IntegrationHub are the modern automation engines. VR ships flows/subflows for tasks like creating scan records, triggering scans, routing exception approvals, and creating downstream tickets. Older material references Vulnerability Response Orchestration workflows/activities (e.g., "Scan vulnerability" workflow); current releases increasingly favor Flow Designer. Expect questions that contrast workflow vs. flow.
- Change Management integration: remediation can generate Change Requests so that patching follows the organization's change process (CAB approval, scheduling). VR integrates with ITSM Change so a remediation task can spawn a change record and track its state back.
- CMDB integration is automated end-to-end: detections auto-match via CI lookup rules, IRE auto-creates/reconciles CIs, and retired-CI logic auto-closes related VIs.
- Patch Orchestration: integrations such as Microsoft SCCM, HCL BigFix, and others let VR drive actual patch deployment and read patch state back, so a vulnerable item can move toward closure automatically once the patch lands.
- Solution Management automation: VSM pulls vendor solution data (MSRC, Red Hat via CSAF, Cisco via CVRF, Rapid7) so remediation tasks are pre-populated with the fix.
- Agile/ticketing integration: the Jira integration can auto-create and synchronize Jira issues from vulnerable items for dev-owned remediation, on a scheduler.
- Automated triage / auto-assignment / ML: rules and ML models can triage and assign VIs without human routing. Auto-close, auto-promote, and bulk-edit actions also reduce manual work.
Sample questions from this domain
Three of the 52 in this domain, with the reasoning. The full set is in the question bank.
Which ServiceNow capability is most commonly used to automate Vulnerability Response processes such as auto-creating remediation tasks or routing assignments?
- A. Flow Designer (flows and subflows) ✓
- B. The MID Server status page
- C. The NVD feed
- D. The Theme Builder
Why: Flow Designer is the primary low-code automation tool used to build flows and subflows that automate Vulnerability Response processes, such as creating remediation tasks or routing assignments. The MID Server status page reports connectivity, Theme Builder changes appearance, and the NVD feed supplies data, none of which is an automation engine. Flow Designer is the recommended modern automation approach.
Which best describes how assignment rules help automate Vulnerability Response?
- A. They install the scanner integration
- B. They build the Overview dashboard
- C. They automatically route Vulnerable Items or tasks to the appropriate group based on defined criteria ✓
- D. They calculate the CVSS score
Why: Assignment rules automatically route Vulnerable Items or remediation tasks to the appropriate assignment group based on defined criteria (such as asset ownership or vulnerability type), reducing manual triage. They do not calculate CVSS, install integrations, or build dashboards. Automated routing is a key efficiency in Vulnerability Response.
An organization wants Vulnerable Items above a certain risk threshold to automatically generate a remediation task. Which approach implements this?
- A. A MID Server reboot schedule
- B. A dashboard widget
- C. A Knowledge Base article
- D. A flow triggered on Vulnerable Item creation/update that evaluates risk and creates the task ✓
Why: A flow triggered on Vulnerable Item creation or update can evaluate the risk and automatically create a remediation task when the threshold is met. A dashboard widget visualizes data, a MID Server reboot schedule manages infrastructure, and a Knowledge Base article documents information, none of which create tasks automatically. Trigger-driven flows are the standard automation pattern.