---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Access the Vulnerability Entities

# Access the Vulnerability Entities {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 9 minutes to read

The TISC uses the following entities to store and organize vulnerability, product, and vendor intelligence data.

## Product {#access-the-vulnerability-entities__product}

The Product entity stores information about software and hardware products that may be affected by vulnerabilities from the table `sn_sec_tisc_intel_product`.
{#access-the-vulnerability-entities__table_org_vgc_j3c__entry__2}

| Label | Description |
|-|-|
| ID | Indicates the Product ID, which must be unique. |
| Name | Indicates the name of the product. The value should be the product's full canonical name, including version number. |
| Vendor | Indicates the corresponding vendor for the product. References the Vendor table (`sn_sec_tisc_vendor`). Vendors can be created in the Threat Intelligence Library. |
| Product Family | Indicates the product family that the product falls into. |
| Architecture | Specifies the architecture for which the product is intended, such as x86, ARM, or x64. |
| Host Name | Specifies the host name or system name where the product is installed or running. |
| Language | Specifies the language or locale of the product. |
| Patch Level | Indicates the patch level or update level of the product. |
| Service Pack | Indicates the service pack level applied to the product. |
| Specification | Provides additional specification details about the product. |
| Product Group | Indicates the parent product group this product belongs to. References the product table itself, as product groups are also stored in the product table. |
| Last Modified in Source | Timestamp indicating when the product information was last modified in the source system. |
| Created in Source | Timestamp indicating when the product was first created in the source system. |
| Replaced By Product | Reference to a product that replaces this product. Used when a product has been superseded or replaced by a newer version or alternative. |
| Product Version(s) | Specifies the version or versions of the product as comma-separated values. Indicates specific version numbers for product identification. |
| Product Version Range | Specifies a range of product versions affected. Used in vulnerability contexts to indicate version ranges using operators or specific version bounds. |
| Is Product Group | Boolean flag indicating whether this entry represents a product group rather than an individual product. |
| CPE | The Common Platform Enumeration (CPE) attribute that provides standardized product identification using CPE 2.3 or CPE 2.2 format. |
| Status | Indicates the current lifecycle status of the product. Valid values: * Active: Product is currently active and supported. * Legacy (End of Product): Product has reached end-of-life but may still be in use. * Deprecated By Vendor: Product has been officially deprecated by the vendor and is no longer supported. {#access-the-vulnerability-entities__ul_prg_vgc_j3c} |
[ ]

{#access-the-vulnerability-entities__table_org_vgc_j3c}

## Remediation {#access-the-vulnerability-entities__remediation}

The Remediation entity stores information about available fixes, mitigations, and workarounds for vulnerabilities from the table `sn_sec_tisc_vulnerability_remediation`.
{#access-the-vulnerability-entities__table_m5k_shc_j3c__entry__2}

| Label | Description |
|-|-|
| Remediation Id | Auto-generated unique identifier for the remediation record. Used for internal tracking and reference purposes. |
| Description | Contains a thorough human-readable discussion of the remediation, including detailed steps and guidance for addressing the vulnerability. |
| Prerequisites | Lists the conditions that must be met for the vulnerability remediation to apply. Contains any vendor-defined constraints or requirements for obtaining and applying the fix. |
| Action Link | Contains the URL where the remediation can be obtained. |
| Type | Specifies the category of the remediation. The following are the valid values for this type: * Workaround: A temporary solution that mitigates the vulnerability without fixing the root cause. * Mitigation: Actions that reduce the severity or impact of the vulnerability. * Vendor fix: An official patch or update provided by the vendor that resolves the vulnerability. * First fixed: The first version where the vulnerability has been fixed. * None available: No remediation is currently available. * Will not fix: The vendor has decided not to fix this vulnerability. * No fix planned: There are no plans to fix this vulnerability in the future. {#access-the-vulnerability-entities__ul_n5k_shc_j3c} |
| Restart Category | Indicates whether a restart is necessary after remediation and, if so, this specifies the required type of restart. The following are the valid values for this category: * Connected: Restart of connected systems or services is required. * Dependencies: Restart of dependent components or services is required. * Machine: Full machine or system restart is required. * Parent: Restart of the parent process or service is required. * Service: Restart of the specific service is required. * System: System level restart is required. * Vulnerable component: Only the vulnerable component needs to be restarted. * Zone: Restart of the security zone or container is required. {#access-the-vulnerability-entities__ul_o5k_shc_j3c} |
| Remediation Published Date | Contains the date from which the remediation is available. |
| Vulnerability | Reference to the vulnerability being remediated. |
| Products | Specifies a list of products to give context to the remediation. Contains references to products affected by or related to this remediation. |
[ ]

{#access-the-vulnerability-entities__table_m5k_shc_j3c}

## Vendor {#access-the-vulnerability-entities__vendor}

The Vendor entity stores information about organizations that develop or distribute products from the table `sn_sec_tisc_intel_vendor`.
{#access-the-vulnerability-entities__table_tq5_thc_j3c__entry__2}

| Label | Description |
|-|-|
| Name | Indicates the name of the vendor. |
| Contact Details | Provides contact information for the vendor, such as email addresses and phone numbers. |
| Organization | Specifies organizational context for the vendor, such as department, division, or organizational unit. |
| Description | Provides a detailed description of the vendor's role, scope, and relevant background information. |
| Website URL | Contains the vendor's official website URL. |
[ ]

{#access-the-vulnerability-entities__table_tq5_thc_j3c}

## CWE Weakness {#access-the-vulnerability-entities__cwe_weakness}

The CWE Weakness entity stores Common Weakness Enumeration records that describe categories of software weaknesses from the table `sn_sec_tisc_cwe_weakness`.
{#access-the-vulnerability-entities__table_bhf_vhc_j3c__entry__2}

| Label | Description |
|-|-|
| ID | Indicates the unique CWE identifier, such as CWE-79 or CWE-89, that standardizes the identification of software weaknesses. |
| Name | Indicates the name of the CWE weakness as defined in the CWE catalog. |
| Description | Provides a detailed description of the weakness, its characteristics, and potential security implications. |
| Type | Specifies the type classification of the CWE weakness. The following are the valid values for this type: * Primary: The initial, underlying weakness that directly enables a subsequent weakness to occur. * Secondary: The weakness that is triggered or made possible by the occurrence of the primary weakness. {#access-the-vulnerability-entities__ul_chf_vhc_j3c} |
[ ]

{#access-the-vulnerability-entities__table_bhf_vhc_j3c}

## Vulnerability Product Mapping {#access-the-vulnerability-entities__vulnerability_product_mapping}

The Vulnerability Product Mapping entity defines the relationship between vulnerabilities and affected products from the table `sn_sec_tisc_m2m_vulnerability_product`.
{#access-the-vulnerability-entities__table_efl_whc_j3c__entry__2}

| Label | Description |
|-|-|
| Vulnerability | Reference to the vulnerability record that affects the associated product. |
| Product | Reference to the product record that is affected by the associated vulnerability. |
| Status | Indicates the relationship status between the vulnerability and product. Valid values: * Known affected: Product version is confirmed to be affected by the vulnerability. * Known not affected: Product version is confirmed to not be affected by the vulnerability. * First affected: First version of the product affected by the vulnerability. * First fixed: First version where the vulnerability has been fixed. * Fixed: Product version has been fixed and is no longer vulnerable. * Last affected: Last version of the product affected by the vulnerability. * Recommended: Recommended version to use to avoid the vulnerability. * Under investigation: Product version is currently being investigated by the vendor; it is not yet known whether this version is affected. {#access-the-vulnerability-entities__ul_ffl_whc_j3c} |
[ ]

{#access-the-vulnerability-entities__table_efl_whc_j3c}

## Related Vulnerability CWE {#access-the-vulnerability-entities__related_vulnerability_cwe}

The Related Vulnerability CWE entity maps vulnerabilities to their associated CWE weaknesses from the table `sn_sec_tisc_m2m_vulnerability_cwe`.
{#access-the-vulnerability-entities__table_pcm_xhc_j3c__entry__2}

| Label | Description |
|-|-|
| Vulnerability | Reference to the vulnerability record associated with the CWE weakness. |
| CWE | Reference to the CWE weakness record. |
[ ]

{#access-the-vulnerability-entities__table_pcm_xhc_j3c}

## CWE Weakness Relationship {#access-the-vulnerability-entities__cwe_weakness_relationship}

The CWE Weakness Relationship entity defines hierarchical and associative relationships between CWE weakness records from the table `sn_sec_tisc_m2m_cwe`.
{#access-the-vulnerability-entities__table_hzn_yhc_j3c__entry__2}

| Label | Description |
|-|-|
| Source CWE | Reference to the source CWE weakness record in the relationship. |
| Target CWE | Reference to the target CWE weakness record in the relationship. |
| Relationship Type | Specifies the type of relationship between the source and target CWE weaknesses. Valid values: * Parent/Child: Hierarchical relationship where one CWE is a parent or child of another. * Peer: Peer relationship where CWEs are at the same level or category. * Requires/Can Precede: One CWE requires or can precede another in an attack chain. * Can Also Be: One CWE can also be classified or manifested as another. {#access-the-vulnerability-entities__ul_izn_yhc_j3c} |
[ ]

{#access-the-vulnerability-entities__table_hzn_yhc_j3c}

## Attribute {#access-the-vulnerability-entities__attribute}

The Attribute entity defines metadata attributes that can be assigned to vulnerabilities from the table `sn_sec_tisc_intel_attribute`.
{#access-the-vulnerability-entities__table_tv2_13c_j3c__entry__2}

| Label | Description |
|-|-|
| Name | Indicates the name used to identify the attribute in the system. |
| Description | Provides a detailed description of the attribute's purpose, usage, and meaning. |
| Active | Boolean flag indicating whether the attribute is currently active and available for use. |
| Internal Identifier | Contains the internal system identifier for the attribute. Used for programmatic reference and integration purposes. |
| Attribute Type | Specifies the category or type of the attribute. The following are the valid values for this type: * Score attribute: Attribute related to scoring metrics. * Threat attribute: Attribute related to threat characteristics or properties. * Other attribute: General purpose attribute not fitting other categories. * Score value: Attribute representing a specific score or numerical value. {#access-the-vulnerability-entities__ul_uv2_13c_j3c} |
[ ]

{#access-the-vulnerability-entities__table_tv2_13c_j3c}

## Vulnerability Attribute Value {#access-the-vulnerability-entities__vulnerability_attribute_value}

The Vulnerability Attribute Value entity stores attribute values assigned to specific vulnerabilities from the table `sn_sec_tisc_m2m_vulnerability_attribute_value`.
{#access-the-vulnerability-entities__table_ah4_b3c_j3c__entry__2}

| Label | Description |
|-|-|
| Vulnerability | Reference to the vulnerability record that has this attribute value assigned. |
| Attribute | Reference to the attribute definition being assigned to the vulnerability. |
| Qualitative Value | Contains the qualitative or text-based value for the attribute, such as "High" or "Critical". Used when the attribute value is descriptive rather than numeric. |
| Quantitative Value | Contains the quantitative or numeric value for the attribute, such as CVSS scores or probability values. Used when the attribute value is a number or decimal. |
[ ]

{#access-the-vulnerability-entities__table_ah4_b3c_j3c}

## Vulnerability Identifier {#access-the-vulnerability-entities__vulnerability_identifier}

The Vulnerability Identifier entity stores alternative or supplementary identifiers for vulnerabilities from the table `sn_sec_tisc_vulnerability_identifier`.
{#access-the-vulnerability-entities__table_aly_c3c_j3c__entry__2}

| Label | Description |
|-|-|
| Vulnerability | Reference to the vulnerability record that this identifier represents. |
| Identifier | Contains the unique identifier value for the vulnerability. This can be a vendor-specific ID or standardized identifier such as GHSA-xxxx-xxxx-xxxx or OSV-xxxx-xxxx. |
| Identifier Assigned By | Indicates the organization or authority that assigned the identifier, such as MITRE, NVD, or GitHub. |
[ ]

{#access-the-vulnerability-entities__table_aly_c3c_j3c}

## Vulnerability Vendor Comment {#access-the-vulnerability-entities__vulnerability_vendor_comment}

The Vulnerability Vendor Comment entity stores vendor-provided statements and comments about specific vulnerabilities from the table `sn_sec_tisc_m2m_vulnerability_vendor_comment`.
{#access-the-vulnerability-entities__table_v4b_23c_j3c__entry__2}

| Label | Description |
|-|-|
| Vulnerability | Reference to the vulnerability record that the vendor is commenting on. |
| Vendor | Reference to the vendor providing the comment. |
| Comment | Contains the vendor's comment or statement about the vulnerability, including vendor-specific clarifications or additional context. |
| Comment Date | Timestamp indicating when the vendor comment was published or last updated. |
[ ]

{#access-the-vulnerability-entities__table_v4b_23c_j3c}

## Product Identifier {#access-the-vulnerability-entities__product_identifier}

The Product Identifier entity stores alternative identifiers associated with products from the table `sn_sec_tisc_intel_product_identifier`.
{#access-the-vulnerability-entities__table_r4g_f3c_j3c__entry__2}

| Label | Description |
|-|-|
| Product | Reference to the product record that this identifier belongs to. |
| Identifier Type | Specifies the type of identifier used for product identification. The following are the valid values for this category: * Hashes: Cryptographic hash values for verifying product integrity, such as SHA-256 or MD5. * Model Numbers: Manufacturer's model numbers or part numbers. * PURL: Package URL, a standardized way to identify software packages. * SBOM URLs: URLs pointing to Software Bill of Materials documents. * Serial Numbers: Unique serial numbers assigned to product instances. * SKUs: Stock Keeping Units for product identification. * Generic URIs: Generic Uniform Resource Identifiers for product references. {#access-the-vulnerability-entities__ul_s4g_f3c_j3c} |
| Identifier | Contains the actual identifier value, such as a hash value, model number, PURL string, or serial number. |
| Additional Information | Provides supplementary information about the identifier, including additional context or notes that clarify or qualify it. |
[ ]

{#access-the-vulnerability-entities__table_r4g_f3c_j3c}

## Related Product {#access-the-vulnerability-entities__related_product}

The Related Product entity defines relationships between products from the table `sn_sec_tisc_m2m_product`.
{#access-the-vulnerability-entities__table_tyg_g3c_j3c__entry__2}

| Label | Description |
|-|-|
| Source Product | Reference to the source product in the relationship. |
| Target Product | Reference to the target product in the relationship. |
[ ]

{#access-the-vulnerability-entities__table_tyg_g3c_j3c}

## Vulnerability Class {#access-the-vulnerability-entities__section_ey4_2t3_m3c}

The vulnerability class options are configured in the `sn_sec_tisc_vulnerability_class` table, enabling you to define and manage vulnerability class selections on the Vulnerabilities page.
{#access-the-vulnerability-entities__table_fy4_2t3_m3c__entry__2}

| Field | Description |
|-|-|
| Name | Name of the vulnerability class. |
| Description | A brief description of the vulnerability class. |
[ ]

{#access-the-vulnerability-entities__table_fy4_2t3_m3c}