---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Assign application vulnerable items in Application Vulnerability Response automatically

# Assign application vulnerable items in Application Vulnerability Response
automatically {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Assign Application Vulnerable Items in Application Vulnerability Response Automatically

This feature enables automatic assignment of application vulnerabilities based on application tags or assignment groups from the Configuration Item (cmdbci) or platform assignment groups, streamlining the assignment process and reducing the mean time to assignment.
Show full answer Show less  

## Key Features

* **User Group:** Select from existing ServiceNow AI Platform user groups for assignment.
* **User Group Field:** Choose from available assignment group fields in the cmdbci table, including Configuration Item: Approval Group, Assignment Group, and Support Group.
* **Script:** Define custom conditions for assignment using scripting, enabling advanced configurations.

## Assignment Rule Evaluation Process

When a new or reopened application vulnerable item (AVI) is created, assignment rules are evaluated in order of priority. If no match is found, an AVI is assigned to a default group if available; otherwise, it remains unassigned.

## Reapplying Assignment Rules

To update assignments after changing rules, use the Apply Changes button to rerun rules on active open AVIs, excluding those manually assigned. The Reapply all assignment rules scheduled job can be configured to run periodically or on demand, ensuring effective management of assignment rules across your environment.

Be mindful of the frequency of the scheduled job to maintain system performance based on the volume of active AVIs in your environment.  
Automatically assign application vulnerabilities based on application tags, or any of
the assignment groups in the Configuration Item \[cmdb_ci\] or platform assignment groups, to
reduce the mean time to assignment.

## Assigning application vulnerable items automatically {#avm-assignment-rules__section_mnr_hff_t3b}

There are three different ways to assign AVIs using Assign using:  
Note:  
The assignment recommendation feature in Vulnerability Response is not available for Application Vulnerability Response.

* User Group: This option allows you to select any of the existing ServiceNow AI Platform® user groups.
* User Group Field: This option allows you to choose any assignment group field available using the cmdb_ci table. By default, you see the following three group fields in the list menu under User group field.
  * None: Indicates no default value for this mandatory field
  * Configuration Item: Approval Group
  * Configuration Item: Assignment Group
  * Configuration Item: Support Group
  {#avm-assignment-rules__ul_zbz_n4j_2gb}
* Script: This option allows you to define the conditions using a script. This option requires coding or advanced ServiceNow expertise.
{#avm-assignment-rules__ul_th4_znj_2gb}

Run high priority rules (items that need special handling, where risk is critical, or an
AVI should be handled by regulatory compliance) first. Next, run your general rules, where
no special handling is required, and you know who should be responsible for them. Finally,
create a default rule to assign AVIs to the group that will figure out what assignment group
it should belong to. This group could add another rule to cover their decisions. This
default rule would run last.

## Assignment rule evaluation process {#avm-assignment-rules__section_vnf_rff_t3b}

When a new AVI is created, imported, or reopened after being closed, the assignment rules
are evaluated against it. An AVI is only evaluated once, unless it is reopened after being
closed. You can manually reapply rules after changes.  
The following process is used for each new, updated, or reopened AVI:

* For each vulnerability assignment rule, the AVI is compared to the assignment filter, lowest order rule first.
* Where the condition matches, the AVI is assigned an assignment group. The lookup stops.
* Where the conditions do not find a match among all the other rules, the AVI is assigned to the default assignment group, if a default rule exists.  
  Note:  
  If there is no default rule, then the AVI remains unassigned.
{#avm-assignment-rules__ul_a2p_fj1_gdb}  
Assignment type, whether Manual or Rule and Assignment rule is available from the Form Layout slushbucket on the application vulnerable item (AVI) form. Any AVI that was originally assigned by a rule but later manually reassigned contains a reference to the original rule. Use Assignment rule and Assignment type information to identify cases where the assignment rules did not find a correct match for the intended recipient. Or which rules had the most reassignments.  
Note:  
The assignment rules do not reevaluate manually created assignments.

## Reapplying assignment rules {#avm-assignment-rules__section_nxb_xnp_s3b}

When you change an assignment rule, use the Apply Changes button on the Assignment Rules list view to rerun all the changed rules on all active Open AVIs (except those that were manually assigned).  
Note:  
If the Reapply all vulnerability assignment rules scheduled job
has not run before the first time you use Apply Changes, then it
runs all the assignment rules on all Open AVIs except those AVIs that were manually
assigned. After that, all subsequent uses of Apply Changes rerun
only the changed rules and any dependent rules. Changes to one rule may result in an AVI
matching a different unmodified rule.


The scheduled job \[Reapply all assignment rules\] is inactive, by
default. When activated, it applies all the rules to all open AVIs except those manually
assigned. It can run Daily, Weekly,
Monthly, Periodically, Once, or On Demand. Depending on how many active AVIs you
have in your environment, remember to set the Run field
appropriately following the initial run to prevent performance impacts.