---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create a Vulnerability Response CI lookup rule

# Create a Vulnerability Response CI lookup rule {#ariaid-title1}

* Release version: Australia
* 
* Updated June 5, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

The CI Lookup Rules module contains
rules that are used to find the matching record for host information received during
third-party vulnerability integration imports. The host information is matched with the
discovered items, unmatched configuration item classes, and the Configuration Management Database (CMDB).

## Before you begin

Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://servicenow-prod.fluidtopics.net/msi8kaFkGNjyRib_XBHEzQ "Assign the Vulnerability Response persona roles to groups or users with Setup Assistant."). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://servicenow-prod.fluidtopics.net/WeKNf9YHNMJmJIA6yCsRvA "After you complete your initial assignment of persona roles using Setup Assistant, manage additional granular role assignments to users or groups from the User Administration module in your instance.").
Role required: sn_vul.vulnerability_admin

## About this task

Creating CI lookup rules requires advanced ServiceNow and Vulnerability Response expertise. Rather than modifying one of the existing lookup rules, consider copying it and modifying the copy. When you are satisfied that the new rule does what you want, deactivate the original.  
Note:  
Rules, once removed, cannot be recovered. Rather than removing existing rules, deactivate them when creating new ones.

## Procedure

1. Navigate to AllSecurity OperationsCMDBCI Lookup Rules.
2. Click New.
3. On the form, fill in the fields.  
   {#create-ci-identifier-rules__table_t4d_4bd_5t__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the rule. |
   | Lookup method | Method used for matching. Choices are: * Script: Pre-built (IP address, DNS name, and so on) or custom script. * Field matching: Search on table or field in the CMDB. {#create-ci-identifier-rules__ul_ojb_mjb_qcb} |
   | Type | Type used with the Script Lookup method. |
   | Order | Order of precedence for the rule. Rules with the lowest order are evaluated first. |
   | Active | Check box for whether the rule is active or disabled. |
   | Source | Source used as input to this rule. |
   | Source field | Source field used as input to this rule. Select any field, but it is treated as a string value. |
   | Condition | Condition based on which the CI lookup rule is applied. This condition depends on the attribute from the third-party scanner. Note: The asset attribute is a part of the payload. It is received from the third-party scanner. See the Discovered Items table for payload examples. |
   | Script | Editable sample script, based on the Type, is shown. Implement the custom script following the comments included in the template of the default function. Note: The process function has three parameters: rule, sourceValue, and sourcePayload |
   | Search on table | Table to search within the CMDB. Used with field matching Lookup Method. |
   | Search on field | Field that contains information that can be used to locate a CI. Used with the field matching Lookup method. This field may be on the CI record, or on a related record, such as a network adapter. |
   | Applies to | This field has no value by default. For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) like the Vulnerability Response Integration with Wiz, for example, select one as it applies to each rule: * Discovered Item - for Vulnerability Response lookup rules. * Discovered Application - for Application Vulnerability Response lookup rules. {#create-ci-identifier-rules__ul_qlg_kfh_kjc} Note: If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly. With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run. |
   [Table 1. CI lookup rule form]

   {#create-ci-identifier-rules__table_t4d_4bd_5t}
4. Click Submit.  
   For more information implementation information for CI Lookup Rules see, [Steps to help prevent duplicate or orphaned records after running Vulnerability Response CI lookup rules](https://servicenow-prod.fluidtopics.net/DA2_cEfqqQXs7KYpaBa8GA "Take steps to help prevent duplicate or orphan records resulting from matching (configuration items (CIs) within the CMDB.").  
   Figure 1. Example of a CI lookup rule using a condition builder for V12.0
   Figure 2. Example of a CI lookup rule using a script prior to V12.0
* **[Ignore CI classes](https://servicenow-prod.fluidtopics.net/_ePaKee3N7E9o7oYAwvelg)**   
  To ignore some configuration item (CI) classes, for example Load Balancer \[cmdb_ci_lb\], when running CI Lookup Rules, set the ignoreCIClass \[sn_sec_cmn.ignoreCIClass\] system property.
* **[Filter decommissioned CIs](https://servicenow-prod.fluidtopics.net/NsHnfm4~aMj_hMsW4UvnJA)**   
  Filter decommissioned configuration items (CIs) while running the CI lookup rules. To filter decommissioned CIs when running the Security Operations CMDB CI lookup rules, set the filterOutDecommissionedCI `[`sn_sec_cmn.filterOutDecommissionedCI`]` system property to true.
* **[Auto-promote CIs](https://servicenow-prod.fluidtopics.net/c9OCXMmkR~Gc1ZaexhQlcA)**   
  Edit the JSON string in the autoPromoteFields `[`sn_sec_cmn.autoPromoteFields`]` system property so your configuration item (CI) lookup rules auto-promote all the Security Operations CMDB CIs to matching entries in the \[cmdb_ci\] table.

**Related reference**   

* [Vulnerability Response vulnerable item form fields](https://servicenow-prod.fluidtopics.net/3UUZMdj_UtcWxtNPHu8V2A "Vulnerable items are automatically created during third-party vulnerability integration imports.")

*[\>]: and then