---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure a Common Vulnerability Reporting Framework vendor other than Cisco

# Configure a Common Vulnerability Reporting Framework vendor other than Cisco {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Configure a Common Vulnerability Reporting Framework (CVRF) vendor other than Cisco with API support.

## Before you begin

Role required: sn_vul.vulnerability_admin or sn_vul.admin (deprecated), or admin

## Procedure

1. Navigate to AllVulnerability ResponseConnection \& CredentialConnection \& Credential Aliases.
2. Create a record with the vendor-supported authentication type.  
   For more information on how to authenticate a vendor, see [Configure Connection and Credential aliases](https://servicenow-prod.fluidtopics.net/Ti7v7wZRYqFZqkJrlqowDQ "Configure Connection and Credential aliases to authenticate vendors. In advisory parsing, third-party vendors are authenticated.").
3. Navigate to AllVulnerability ResponseFlow Designer.
4. Duplicate the flow called "Advisory Parsing".  
   Note:  
   * If any of the actions needs to be changed, copy the action and use it in the new flow.
   * Update the pagination-related logic as per the vendor
   {#configure-cvrf-vendor__ul_ycv_mpp_psb}
5. If the date range parameter logic is not the same as Cisco, copy the action Update Pagination Parameters and make changes as required for the vendor.
6. Navigate to AllVulnerability ResponseEnrichment Data Mappings.
7. Create a record as per Cisco by changing the Property key value as per the vendor.  
   This logic is for mapping required fields from an advisory payload to a ServiceNow table.
8. Map the following API tags from API Payload.  
   These tags need to be mapped with details to be filled in the Enrichment Data Mapping table. By default, the Cisco-specific mapping is shipped.  
   Note:  
   You need to create a record if you need to configure multiple vendors that publish advisories.
   {#configure-cvrf-vendor__table_cmf_zmp_psb__entry__3}

   | Advisory payload tag | Column from table sn_vul_cvrf_solution_integration_update | Description |
   |-|-|-|
   | CVRF URL | cvrf_url | Tag name that contains the CVRF URL. |
   | Advisory ID (Unique key for response) | Id | Tag name that contains a unique identifier. |
   | Last modified date | last_modified_date | Tag name that contains the date when the record was last updated. |
   | securityAdvisoryIntegrationSysId | integration | Refers to the integration scheduled job sysId, which creates the vulnerability solution records. |
   [ ]

   {#configure-cvrf-vendor__table_cmf_zmp_psb}
9. Based on the response format, change the logic of parsing by copying the action Retrieve List from the Advisory Parsing flow.

*[\>]: and then