Exploring Container Vulnerability Response

Versão de lançamento: Australia

Atualizado 12 de mar. de 2026

3 min. de leitura

The Container Vulnerability Response application imports container vulnerable items (CVITs). According to the rules, the feature enables you to remediate the container vulnerabilities. Container Vulnerability Response is available through a separate subscription.

Container images overview

Unlike traditional applications, containers package all the application source codes along with their dependencies into a binary file called a container image. The image is published to a registry to provide an option to run this image as an application or a container instance on any platform. The stages in a container pre-deployment life cycle are as follows:

Compose the container image: The container image is composed and pointed to a source code or a dependent library.
Build the container image
Publish the container image: The container image file is published to a registry. Each image has its own unique ID based on the contents of the image. These images are pulled from the registry into the run-time environment in post-deployment mode. The images then run as container instances on the host in the production environment.

Scanning container images

A container image can be scanned for vulnerabilities either before or after deployment. If container images are scanned during the pre-deployment phase, you may get many vulnerability alerts, which may not need your immediate attention. However, scanning for vulnerabilities during the post-deployment phase provides greater benefits, such as the following:

Providing visibility on the risk associated with the deployed applications.
Providing a focused view on only the images in the production environment.
Identifying and prioritizing the vulnerabilities that must be acted on immediately.
Grouping and assignment of vulnerabilities based on the metadata of the image. For example, an image repository, an image label, and other attributes related to the container image can be used for grouping and assignment rules.

Each container image has the following key components:

Container or image repository: Represents the docker image with a given repository or name. It hosts all the versions of the image.
Docker image: Represents a specific version of the build docker image.
Docker container: Represents a running instance of the docker image. Each version has a unique ID and has multiple instances of the containers running in the production environment.

Scanner findings and container vulnerable items (CVITs)

Third-party scanner products import and evaluate container image vulnerability data for vulnerable and non-compliant assets in any environments where container images are run including your enterprise environment and your cloud infrastructure.

A finding or container vulnerability finding is a term used to describe a container image that has a known vulnerability in your environment that is found by a scanner.

Findings are imported from third-party scanners are mapped to container vulnerable items (CVITs) in your ServiceNow AI Platform® to support triage, risk prioritization, and targeted remediation workflows for container-based workloads.

Closing CVITs

CVIT states
Why/reasons CVITs get closed
Exceptions
False positives

CVIT states

Container Vulnerability Response modules and working with CVITs

The Container Vulnerability Response module provides details on the following:

Container Vulnerable Items: The container vulnerable items (CVITs) are grouped and listed based on assignment, criticality, exploitability, and remediation status.
Libraries: Get access to the National Vulnerability Database (NVD) and third-party libraries. While the NVD library provides information limited to vulnerability item ID, the third-party library provides most of the details on a vulnerability item. Information in the NVD screen is populated only when the NVD integration is triggered.
Administration: The Administration module provides information on the vulnerable items' assignment rules, remediation target rules, and container vulnerability integrations. In addition, you can also configure the duration after which a vulnerable item should be auto closed. You can use the Configure VI Granularity section to configure the granularity of CVITs by specifying the key combinations. By default, a CVIT is created for a combination of an image repository, an image tag, and a vulnerability. You can add additional components to the key for further granularity. For example, you can create a CVIT for a combination of image repository, image tag, vulnerability, and cluster.

Available versions


Release version	Release Notes
If you intend to upgrade to Unified Security Exposure Management (USEM), please select a version starting with 30.x when installing or upgrading. Container Vulnerability Response v30.2 Container Vulnerability Response v30.1	For full details, please refer to the Knowledge Base article [KB2556844] and Installing Security Exposure Management Workspace applicationsdocumentation before proceeding.
If you do not intend to upgrade to Unified Security Exposure Management (USEM), please select a version below 30.x when installing or upgrading. Container Vulnerability Response v2.1	Container Vulnerability Response release notes For compatibility information, see KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes.