---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Automated creation of zero day vulnerability

# Automated creation of zero day vulnerability {#ariaid-title1}

* Release version: Australia
* 
* Updated March 30, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

A zero day vulnerability scenario demonstrates how TISC detects and manages vulnerabilities that have not yet received CVE assignments.

Role required: sn_sec_tisc.admin

This feature enables automatic detection and processing of zero day vulnerabilities through configurable tagging rules. For more information, see [Configure Tagging Rules in TISC](https://servicenow-prod.fluidtopics.net/XW1_Z3rDv5Te81E_Y_HAgQ "Use tagging rules to automatically assign tags and taxonomies to RSS feeds. Tagging rules evaluate incoming feed data based on defined criteria and apply the appropriate tags and taxonomies when a match is found.").

Prerequisite:

Verify that the RSS Feeds with Zero Day mentions tagging rule is enabled. This ensures automatic association of the RSS Feeds with the Vulnerability Intelligence: ZERODAY taxonomy.

## Zero Day Vulnerability Processing - Vulnerability Source Record Creation {#tisc-zero-day-vuln-scenario__section_b2j_wgm_t3c}

Zero Day Vulnerability Processing - Vulnerability Source Record Creation.  
A Vulnerability Source record is automatically created when:

* an RSS feed record is associated with a specific Zero Day taxonomy value.
* an RSS feed which is associated with the zero day taxonomy is updated and contains new entities such as CWE IDs, CVE IDs, CPEs, or Product IDs.
{#tisc-zero-day-vuln-scenario__ul_rsl_ygm_t3c}

Record identification: Each Vulnerability Source record is uniquely identified using the RSS feed GUID, ensuring traceability to the original source.

The processing layer creates a zero day vulnerability record for the corresponding vulnerability source record, only when the vulnerability record doesn't exists.  
TISC automatically populates the following fields of Vulnerability Source and Vulnerability record:{#tisc-zero-day-vuln-scenario__table_otv_3hm_t3c__entry__2}

| Field | Description |
|-|-|
| Name | Combination of RSS feed GUID and timestamp. |
| Description | Indicates the record is created from the RSS feed, including the GUID reference. |
| Zero day flag | Set to True. |
| CVE ID | Populated when exactly one CVE is identified. |
| Additional Context | Includes extracted CVE IDs and Product IDs. |
[ ]

{#tisc-zero-day-vuln-scenario__table_otv_3hm_t3c}  
The following entities are extracted from RSS feeds:

* CVE IDs (vulnerabilities)
* CWE IDs (weaknesses)
* CPEs and Product IDs (affected products)
{#tisc-zero-day-vuln-scenario__ul_oks_dwt_v3c}

For more information about the extraction and correlation mechanism, see [KB2936701](https://support.servicenow.com/kb?sys_kb_id=ef0c61718348c3d0cdbbc430feaad32e&id=kb_article_view) article.