CMDB Detection Promotion Rules for Vulnerability Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current CMDB designs generate a large volume of vulnerable items (VIs) that are either less critical or irrelevant, leading to resource overhead in processing and memory, while critical VIs may be overlooked due to the vast collection of VIs.
Innovation Solution
A modified CMDB design stores detected CI vulnerabilities as lightweight detection objects in a non-audited table, with detection promotion rules defining conditions for creating VIs, reducing resource consumption by only generating VIs for high-risk or critical detections, and allowing for the modification of existing VIs based on predefined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If VIs are created for all detected vulnerabilities, then comprehensive vulnerability tracking is achieved, but resource consumption and processing overhead increase significantly
Solution Approach 1:
The patent extracts only the essential vulnerability detection data into a separate detections table, separating it from the full VI creation process. This allows comprehensive tracking of all vulnerabilities while avoiding the resource-intensive VI creation workflow for low-priority items, thus resolving the contradiction between tracking completeness and processing overhead
Solution Approach 2:
The patent applies different quality levels to different vulnerability detections by using detection promotion rules that evaluate severity, exploitability, and other criteria. Only high-priority detections receive full VI treatment, while lower-priority ones remain as lightweight detection records, optimizing resource allocation based on local vulnerability characteristics
2Loss of information
If VIs are created for all detected vulnerabilities, then complete vulnerability record is maintained, but memory resources are consumed by redundant VIs
Solution Approach 1:
The patent segments vulnerability information into two parts: essential detection data stored in a lightweight detections table for all vulnerabilities, and full VI objects created only for high-priority cases. This segmentation maintains complete vulnerability information while dramatically reducing the quantity of stored VI objects
Solution Approach 2:
The patent uses lightweight detection objects as temporary or low-cost storage for vulnerability information, reserving expensive full VI objects only for critical cases. These detection objects serve as a cost-effective alternative that preserves information without the overhead of complete VI structures
3Adaptability or versatility
If VIs are created with workflows and auditing, then comprehensive vulnerability management is achieved, but processing and memory resources are significantly consumed
Solution Approach 1:
The patent performs preliminary evaluation of vulnerability detections using promotion rules that assess severity, exploitability, and other criteria before initiating full VI creation workflows. This preliminary action filters out low-priority detections, allowing comprehensive management capabilities to be applied only where necessary, thus reducing overall system complexity
Solution Approach 2:
The patent introduces detection promotion rules as an intermediary layer between vulnerability detection and full VI creation. This intermediary evaluates detections and determines whether full VI management workflows should be initiated, reducing complexity by preventing unnecessary workflow activations while preserving comprehensive management for critical cases
Data Source
AI summary
A modified configuration management database (CMDB) system is disclosed in which detected configuration item (CI) vulnerabilities are stored as less-resource-intensive detection objects, rather than as more-resource-intensive vulnerable item (VI) objects. The system includes a vulnerability response (VR) server that enables promotion rules to be created and periodically applied to the stored detections. When the conditions of a detection promotion rule are satisfied by information relating to a stored detection, a new VI may be created and related to the stored detection within the CMDB. The disclosed promotion rules can be configured to ensure that VIs are only automatically created for high-risk or relevant detections, substantially reducing the number of VIs to be created, stored, and managed. As such, the disclosed system substantially reduces resource consumption and improves the efficiency and operation of the CMDB.