---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Adding proof to Rapid7 vulnerable item keys

# Adding proof to Rapid7 vulnerable item keys {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Add proof as a vulnerable item (VI) key for the Rapid7 VIs. Including the
proof for specific vulnerabilities enables the Rapid7 scanner integration to
create VIs for each proof received from Rapid7.

A VI key is the combination of vulnerability, configuration item (CI), and integration
instance. Splitting detections into different VIs based on proof creates multiple VIs. You can
assign the vulnerabilities to the appropriate remediation owners.

For example, there might be two detections with the same vulnerability and CI, but with
different proofs, leading to the creation of one VI. Starting from Vulnerability Response V17.1, you can identify and remediate vulnerabilities by adding
proof as the VI key.

You can add the proof as a VI key in the following way:

Navigate to AllVulnerability ResponseAdministrationConfigure VI granularity and select the option to include proof.

Use case: Including proof in VI key for existing VIs or splitting existing VIs based on detection proof

To create VIs based on proof, you can use the R7 log4j vulnerabilities. For example, you can
use one of the multiple R7 log4j vulnerabilities such as
`R7-apache-log4j-core-cve-2021-44228`,
`R7-amazon_linux-cve-2021-44228`, or
`R7-amazon-linux-ami-2-cve-2021-44228`.

If all the detections in a VI have the same proof, then the existing VI is updated to include
'Proof in the VI Key (external_id)'. If there are multiple detections with different
proofs, then the existing VI is closed. The detections are split across the new VIs with
'Proof in the VI Key (external_id)'.  
Note:  
If you provide the vulnerability ID, the existing VIs are split based on the proof.
The new vulnerabilities for this vulnerability ID also have proof as one of the VI
keys.

*[\>]: and then