Managing flag types and SLA matrix

In Vulnerability settings, you can manage flag types and set up a Service Level Agreement (SLA) matrix.

Flag types

Different types of flags are used to classify and prioritize vulnerabilities. These flags provide insight into the severity and impact of each finding. For example: Actual finding, informational, false positive.

Adding a flag type

1. Open the Asset Manager app.
2. On the left hand side, select the expand button to open the side panel.
3. Select Vulnerabilities > Settings > General tab.
4. Select Add New, and enter the flag type name in the text box.
5. To save the name, either press Enter on the keyboard or scroll down and select Save Changes.

   Result The new flag type is saved.

Removing a flag type

1. Open the Asset Manager app.
2. On the left hand side, select the expand button to open the side panel.
3. Select Vulnerabilities > Settings > General tab.
4. Select the minus sign (-) next to the flag type that you want to remove.

   Result The flag type is removed.

SLA settings

In the context of vulnerabilities, a Service Level Agreement (SLA) specifies the maximum number of days required to resolve a vulnerability after it has been identified.

In Asset Manager, you can calculate the SLA (due date) for the findings imported from Tenable by setting up an SLA matrix.

Prequisites to set up an SLA matrix

Finding severity value This is one of the values required to set up the SLA matrix. There are three types of scores imported from Tenable, and you can select one of them to calculate the SLA.

• VPR score Vulnerability Priority Rating (VPR) is a metric to prioritize the remediation of vulnerabilities based on multiple factors.
• CVSSv2 Common Vulnerability Scoring System version 2 is a standardized method to assess the severity of security vulnerabilities, focusing on base, temporal, and environmental metrics.
• CVSSv3 Updated version of the CVSSv2 method that provides more detailed and accurate assessment of vulnerabilities.

SLA matrix The SLA matrix is a table used to calculate the SLAs for the vulnerabilities/findings. This table consists of the following:

• Asset criticality This is the criticality level of the aggregated asset, and comes from the Asset Manager. Criticality signifies the level of the business impact of an asset. For example: High, Medium, and Low.
  The assets created in Asset Manager must have the Criticality field completed for the SLA matrix to work. For more information, see Working with assets in Asset Manager.
• Score This is the score you select in Finding severity value, and the options include: VPR score, CVSSv3, and CVSSv2. These are imported from Tenable and are available in findings. They contain a range of values, for example: 0-2, 2-4, and 4-6.

Setting up the SLA matrix

1. Open the Asset Manager app.
2. On the left hand side, select the expand button to open the side panel.
3. Select Vulnerabilities > Settings > General tab.
4. Under the SLA settings, select the Finding severity value from the following three options:

   Note

   The option you select as Finding severity value takes precedence.

   If you select VPR score for the SLA due date calculation, and the VPR score from Tenable is not available, then the SLA calculation logic uses the CVSSv3 score. If CVSSv3 is also not available, then it uses the CVSSv2 score as the third option. If none of these scores are available from Tenable, then the due date is not calculated.

   • VPR score
   • CVSSv3
   • CVSSv2
5. In the SLA Matrix table, enter a number in each cell.
   This number signifies the maximum number of days required to resolve a vulnerability/finding. For example: In the screenshot above, if the score is between 8-10 and the asset criticality is High, then the SLA is 7 days.
6. Select Save Changes.

   Result The SLA settings are saved.