---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Early Warning CVD Attributes field reference

# Early Warning CVD Attributes field reference {#ariaid-title1}

* Release version: Australia
* 
* Updated June 23, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Early Warning CVD Attributes table stores vulnerability intelligence signals for vulnerabilities. Each attribute represents a threat indicator ingested from the Early Warning feed.
Early warning threat signals are stored in the Armis Early Warning CVD Attributes \[sn_vul_ew_cvd_attributes\] table, a specialized extension table for vulnerability attributes. Each record in this table represents a unique CVE and
stores the set of vulnerability intelligence attributes ingested from Armis.

## Attribute fields {#r-early-warning-cvd-attributes__section_attributes}

{#r-early-warning-cvd-attributes__section_attributes__entry__2}

| Field | Description |
|-|-|
| CVE ID | Identifier of the CVE record, such as `CVE-2026-33824`. |
| CWE | Common Weakness Enumeration identifier associated with the CVE, such as `CWE-415`. |
| Date Added | Date and time when this CVE was added to the Armis Early Warning dataset. |
| Intel Date | Date and time when Armis first obtained intelligence about this CVE. |
| Admiralty Score | NATO grading system for vulnerability intelligence confidence and reliability. Scores range from A1 (highest confidence) to F6 (lowest confidence). Use this score to assess the credibility of associated threat signals. |
| Vendor/Project | Name of the vendor or project associated with the affected software. |
| Research Date | Date when academic or security research was published that details the vulnerability, its impact, or exploitation techniques. |
| Honeypot Date | Date and time when honeypot systems recorded exploit activity against this CVE. A honeypot is a decoy system deliberately exposed to attackers. This field is empty when no honeypot activity has been observed. |
| Product | Name of the specific product affected by the CVE, such as `Windows 10 1607`. |
| Notification Date | Date and time when ServiceNow received notification of this CVE from Armis. |
| Updated On | Date and time when this record was last updated in ServiceNow. |
| Enabled | Option to indicate whether this CVE record is active and included in risk scoring and downstream processing. |
| Special | Option to flag this CVE as a special case for further review or custom handling. |
| Summary Note | Free-text summary describing the intelligence gathered for this CVE, including the source of the information and the basis for the admiralty score. |
| External Note | Structured free-text field containing sub-categories of intelligence detail: Intel Source, Honeypot, Research, Detection, Vulnerable, Malware hash, Analyst note, Intel note, and Admiralty score. Values are reported as `NA` when no data is available for a sub-category. |
[ ]