# US 2021/0344701 A1 · System and method for detection promotion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344701 A1 - Document ID: US20210344701A1 - Status: Published application - Kind: A1 - Application number: 16/862,182 - Filed: 2020-04-29 - Published: 2021-11-04 - Earliest claimed: 2020-04-29 - Assignees: ServiceNow, Inc. - Applicants: ServiceNow, Inc. - Inventors: Lisa Sherilyn Henderson - Web page: https://patentgrep.com/patent/US20210344701A1 ## CPC - G06F 16/2455: Query execution - H04L 63/1433: {Vulnerability analysis} - G06F 16/2282: {Tablespace storage structures; Management thereof} - G06F 16/24558: {Binary matching operations} - G06F 16/24564: {Applying rules; Deductive queries} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A modified configuration management database (CMDB) system is disclosed in which detected configuration item (CI) vulnerabilities are stored as less-resource-intensive detection objects, rather than as more-resource-intensive vulnerable item (VI) objects. The system includes a vulnerability response (VR) server that enables promotion rules to be created and periodically applied to the stored detections. When the conditions of a detection promotion rule are satisfied by information relating to a stored detection, a new VI may be created and related to the stored detection within the CMDB. The disclosed promotion rules can be configured to ensure that VIs are only automatically created for high-risk or relevant detections, substantially reducing the number of VIs to be created, stored, and managed. As such, the disclosed system substantially reduces resource consumption and improves the efficiency and operation of the CMDB. ## Claims ### Claim 1 A configuration management database (CMDB) system, comprising: at least one memory storing a database, wherein the database comprises a configuration items (CIs) table configured to store CI objects, a vulnerable items (VIs) table configured to store VI objects, a detections table configured to store detection objects representing detections of vulnerabilities for the stored CI objects, and a detection promotion rules table configured to store detection promotion rule objects that each include one or more promotion conditions; and at least one processor configured to execute instructions stored in the at least one memory to cause the CMDB system to perform actions comprising: for each active detection promotion rule object of the stored detection promotion rule objects: evaluating the one or more promotion conditions of the active detection promotion rule object based on the stored detection objects; and determining that the one or more promotion conditions of the active detection promotion rule object have been satisfied by a detection object of the stored detection objects, and in response, creating a new VI object in the VIs table and relating the new VI object to the detection object. ### Claim 2 (depends on 1) The system of claim 1, wherein each of the one or more promotion conditions comprises: an attribute, wherein the attribute is an attribute of a detection object, an attribute of a vulnerability object related to the detection object, or an attribute of a CI object related to the detection object; a comparison operator that is associated with the attribute; and an attribute value that is associated with the attribute. ### Claim 3 (depends on 2) The system of claim 2, wherein the comparison operator is one of: “is/equals”, “is one of”, “is not one of”, “contains”, “is greater than”, or “is less than”. ### Claim 4 (depends on 2) The system of claim 2, wherein the attribute value comprises a binary value, one or more integer values, a text string, an object, or a group of objects. ### Claim 5 (depends on 2) The system of claim 2, wherein the one or more promotion conditions comprise a plurality of promotion conditions, wherein the plurality of promotion conditions are combined using Boolean AND/OR operators. ### Claim 6 (depends on 1) The system of claim 1, wherein the at least one processor is configured to execute the instructions stored in the at least one memory to cause the CMDB system to perform actions comprising: receiving a request to create a new detection promotion rule object, wherein the request comprises one or more promotion conditions of the new detection promotion rule object; and creating the new detection promotion rule object in the detection promotion rule table having the one or more promotion conditions in response to receiving the request. ### Claim 7 (depends on 1) The system of claim 1, wherein the at least one processor is configured to execute the instructions stored in the at least one memory to cause the CMDB system to perform actions comprising: receiving, from an external server, scanning data from a vulnerability scan of a client network, wherein the scanning data comprises information regarding the detections of the vulnerabilities of CIs associated with the client network; and creating a respective detection object in the detections table for each of the detections of the vulnerabilities of CIs associated with the client network in the scanning data. ### Claim 8 (depends on 7) The system of claim 7, wherein the database comprises a vulnerabilities table configured to store vulnerability objects representing the vulnerabilities detected for the stored CI objects, and wherein the at least one processor is configured to execute the instructions stored in the at least one memory to cause the CMDB system to perform actions comprising: receiving vulnerability data from the external server, wherein the vulnerability data comprises information regarding the vulnerabilities detected for the CI objects associated with the client network; and creating a new vulnerability object in the vulnerabilities table for each of the detected vulnerabilities in the vulnerability data, and relating each vulnerability object to one or more corresponding detections objects in the detections table. ### Claim 9 (depends on 8) The system of claim 8, wherein, to evaluate the one or more promotion conditions of the active detection promotion rule object based on the stored detection objects, the at least one processor is configured to execute the instructions stored in the at least one memory to cause the CMDB system to perform actions comprising: evaluating the one or more promotion conditions of the active detection promotion rule object based on attribute values of the detection objects stored in the detections table, as well as attribute values of the vulnerability objects stored in the vulnerabilities table that are related to the detection objects. ### Claim 10 (depends on 1) The system of claim 1, wherein the CMDB is hosted as part of a client instance by a data center. ### Claim 11 A method of operating a vulnerability response (VR) server of a configuration management database (CMDB), comprising: receiving, from an external server, scanning data from a vulnerability scan of a client network, wherein the scanning data comprises information regarding detections of vulnerabilities of configuration items (CIs) associated with the client network; storing a set of detections based on the received scanning data; and for each active detection promotion rule of a set of detection promotion rules: evaluating one or more promotion conditions of the active detection promotion rule based on the stored set of detections; and determining that the one or more promotion conditions of the active detection promotion rule have been satisfied by a detection of the stored set of detections, and in response, creating a new vulnerable item (VI) and relating the new VI to the detection. ### Claim 12 (depends on 11) The method of claim 11, wherein evaluating comprises: evaluating the one or more promotion conditions of the active detection promotion rule attributes of a stored set of CIs that are related to the stored set of detections, a stored set of vulnerabilities that are related to the stored set of detections, or a combination thereof. ### Claim 13 (depends on 12) The method of claim 12, comprising: receiving, from a client device, a request to create a new detection promotion rule, wherein the request comprises the one or more promotion conditions; and creating the new detection promotion rule having the one or more promotion conditions in response to receiving the request. ### Claim 14 (depends on 11) The method of claim 11, wherein each of the one or more promotion conditions comprises: an attribute, wherein the attribute is a detection attribute, a vulnerability attribute, or a configuration item (CI) attribute related to the set of detections; a comparison operator that is associated with the attribute, wherein the comparison operator is one of: “is/equals”, “is one of”, “is not one of”, “contains”, “is greater than”, or “is less than”; and an attribute value that is associated with the attribute, the attribute value comprises a binary value, one or more integer values, a text string, an object, or a group of objects. ### Claim 15 (depends on 11) The method of claim 11, wherein the external server is a management, instrumentation, and discovery (MID) server associated with the client network. ### Claim 16 One or more non-transitory, computer-readable media at least collectively storing instructions executable by a processor of a vulnerability response server, the instructions comprising instructions to: receive, from an external server, scanning data from a vulnerability scan of a client network, and in response, store a set of detections based on the received scanning data, wherein the received scanning data comprises information regarding detected vulnerabilities of configuration items (CIs) associated with the client network; evaluate the one or more promotion conditions of a detection promotion rule based on the stored set of detections; and determine that the one or more promotion conditions of the detection promotion rule have been satisfied by a detection of the stored set of detections, and in response, creating a new vulnerable item (VI) and relating the new VI to the detection. ### Claim 17 (depends on 16) The media of claim 16, wherein the instructions comprise instructions to: evaluate one or more promotion conditions of a second detection promotion rule based on the stored set of detections; and determine that the one or more promotion conditions of the second detection promotion rule have been satisfied by a second detection of the stored set of detections, and in response, creating a second new vulnerable item (VI) and relating the second new VI to the second detection. ### Claim 18 (depends on 16) The media of claim 16, wherein the instructions comprise instructions to: receive vulnerability data from the external server, wherein the vulnerability data comprises information regarding the vulnerabilities detected for the CIs associated with the client network; and creating a set of vulnerabilities based on the received vulnerability data and relating each vulnerabilities of the set of vulnerabilities to one or more corresponding detections of the set of detections. ### Claim 19 (depends on 18) The media of claim 18, wherein the instructions to evaluate the one or more promotion conditions comprise instructions to: evaluate the one or more promotion conditions of the detection promotion rule based on the vulnerabilities of the set of vulnerabilities that are related to the one or more corresponding detections of the stored set of detections. ### Claim 20 (depends on 16) The media of claim 16, wherein the instructions to evaluate the one or more promotion conditions comprise instructions to: receive, from a client device, a request to create the detection promotion rule, and in response, create the detection promotion rule, wherein the request includes the one or more promotion conditions of the detection promotion rule.