# Improving Vulnerability Management Through Process Mining
## 4 An Exemplary Use Case
### Data Understanding
#### 4.5.1 Data Integration  
As depicted in Table 2, there are four different data sources for vulnerabilities. Theses vulnerabilities are stored within one central VM system called ServiceNow. We decided that only ServiceNow data were relevant to the business goals for two reasons. First, these data are the part of the VM process managed by the security team and, second, there were organizational rules in place that designated ServiceNow as the central tool for the VM process. This meant that all VM-related activities had to happen from within the tool--including, for example, writing emails. The discovery phase is not relevant as it is managed by external companies.  
To integrate the data of ServiceNow into Celonis, a data connection between the two systems was created. Celonis offers a pre-defined ServiceNow integration. It only needs a ServiceNow user with read-only access to the necessary tables.  
After the connection was created, the necessary tables were extracted. This was performed as an extraction data job. The vulnerability management module of ServiceNow contains 113 tables. The current process mainly uses the tables depicted in Figure 6.  
The sn_vul_vulnerable_item table combines vulnerabilities and the assets that they affect as imported by the various sources. The sn_vul_vulnerability table is connected with one vulnerable_item in the sn_vul_vulnerable_item table via the help table sn_  
Figure 6: ServiceNow tables used in the VM process.  
val_m2m_vul_group_item. It contains the process information for each vulnerability, such as the state, the assigned person, and the work notes. Sn_vul_entry contains general information about the vulnerabilities without a connection to a certain asset such as the CVSS score. Entries can be connected to several different vulnerable_items.  
In addition to these main tables, there are several tables with enhancement data. These include the following tables:  
* sys_user: this table contains all usernames, their real names, department, and assignment groups;
* sys_user_group: this table contains information about assignment groups;
* cmdb_ci: this table contains all configuration items, such as servers and applications.  
All seven tables mentioned above were extracted. All columns were extracted for each table. After a test load, all entries were loaded in a full load. A schedule was set up to reload the entire data in a weekly manner while a so-called delta load happened on a daily basis. A delta load only extracts the data that were newly created or updated since the last load. The extraction uses the field sys_updated_on to filter out the new data. This delta load is necessary to be able to satisfy the business goal of continuous process management. In this way, the process owner can always analyze the up-to-date state of the process and is able to react in a timely manner. No additional filters were defined.  
Finally, to be able to use process mining, the most important table that was extracted was the sys_audit table. The sys_audit table is the event log of every ServiceNow event. It tracks the changes in every field of every table. For this project, the sys_audit table was filtered to only include changes made to sn_vul_vulnerability tables since this table includes all process instances of interest to the vulnerability management process. The rest of the tables only include enhancement data.