---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Vulnerability Response integrations

# Vulnerability Response integrations {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Vulnerability Response integrations

Vulnerability Response in ServiceNow supports integrations with third-party vulnerability scanners and data sources to import vulnerabilities, reconcile them with CMDB assets, and automate remediation workflows.
Starting with version 30.0, administrators can monitor and troubleshoot installed integrations directly within the Security Exposure Management Workspace Administration console, improving operational visibility and health.
Show full answer Show less  

## Key Features

* **Integration Monitoring:** View run statuses and troubleshoot third-party integrations from the Security Exposure Management Workspace.
* **Vulnerability Import and Reconciliation:** Import vulnerability data from sources such as the National Vulnerability Database (NVD), Qualys, Rapid7, Tenable, and others, then reconcile findings with CMDB assets to create vulnerable items automatically.
* **Automated Remediation:** Vulnerable items are grouped into tasks, prioritized with business context risk scores, and assigned to appropriate teams.
* **Integration Management:** Many integrations can be installed, configured, scheduled, and launched on-demand via the Setup Assistant; some, like Rapid7, require configuration outside the assistant.
* **Handling Large Data Imports:** To prevent integration timeouts during large data imports, heartbeat timestamps are sent periodically from version 18.2.4 onward, enabling the system to detect stalled import queues and time them out to maintain processing efficiency.
* **Process State Updates:** Integration process state names were updated starting in version 17.1 for clearer status tracking.
* **CSDM Integration:** Vulnerability Response and related applications contribute data to and consume data from CSDM tables, enhancing cross-product functionality within ServiceNow Security Operations.
* **Manual Integration Support:** Customers can create custom integrations not available in the ServiceNow Store to extend Vulnerability Response capabilities.

## Practical Implications for ServiceNow Customers

By leveraging Vulnerability Response integrations, customers can centralize vulnerability data from multiple external sources, gain comprehensive visibility into their security posture, and streamline remediation efforts with automated task creation and prioritization. Monitoring and troubleshooting tools in the platform help maintain integration health, ensuring continuous data flow and accurate vulnerability tracking. Integration with CSDM tables ensures that vulnerability data is contextualized with asset and configuration data, increasing the value of security insights across ServiceNow products. Additionally, the option to build manual integrations provides flexibility for unique or emerging requirements.  
Vulnerability Response includes support for third-party integrations. Included in this
section are some basic guidelines for developing your own integrations.

## Third-party integrations {#vuln_integrations__section_k3d_nzy_mbb}

Starting with v30.0 of Vulnerability Response, monitor installed integrations within the Security Exposure Management Workspace Administration console. Administrators can now view and troubleshoot integration run statuses for installed third-party applications, ensuring better visibility and operational health. For more
information, see [Review Unified Security Exposure Management integrations](https://servicenow-prod.fluidtopics.net/n9CV2GWwldUPDJklm6Yxww "The integration dashboard provides an overview of the installed third-party applications and the status of the integration runs.").

Imported vulnerabilities from the National Vulnerability Database (NVD) and detection data from third-party scanners are reconciled with the assets in your CMDB. When an imported vulnerability matches an existing asset, a
vulnerable item is created. Vulnerable items are grouped automatically into tasks for remediation, risk-scored with business context, prioritized and assigned to appropriate teams for remediation.  
Note:  
Third-party integrations are treated separately. If more than one third-party integration application is in use in your environment there is no vulnerable item (VI) deduplication across integrations. For example, VI
deduplication between Rapid7 and Qualys is not available.

However, mismatches in detection count between a third-party scanner (for example, Qualys) to VIs in your ServiceNow instance are expected, since we dedupe across IPs, ports and so on.

The following table provides a list of Vulnerability Response infrastructure integrations created by ServiceNow® and partners to import vulnerabilities and create vulnerable items.

For information about third-party integrations supported by Application Vulnerability Response see, [Integrating Application Vulnerability Response with other applications](https://servicenow-prod.fluidtopics.net/r93WHsyNRy7m1s7pRtbYpw "Vulnerability Response includes support for third-party integrations.")  
* [CISA Known Exploit Vulnerability (KEV) Integration](https://servicenow-prod.fluidtopics.net/h~5vrVBtkzuhGX_VN9~5QQ "The Vulnerability Response integration with the CISA Known Exploited Vulnerabilities (KEVs) catalog ingests data to help you effectively prioritize and remediate these vulnerabilities.")
* [Understanding the Microsoft Threat and Vulnerability Management Vulnerability integrations for Security Exposure Management](https://servicenow-prod.fluidtopics.net/zidYOmc32tY4Sfp0ltHCtw "The Microsoft Threat and Vulnerability Management integrations are included with the Microsoft Defender Integration for Security Exposure Management application available with a subscription from the ServiceNow Store.")
* [Understanding the HCL BigFix patch orchestration integration with Vulnerability Response](https://servicenow-prod.fluidtopics.net/h73nSOqPqd59_wefnz5Itg "You can manage patches and patch deployments for critical vulnerabilities for large groups of assets with the Vulnerability Response patch orchestration integration with the HCL BigFix product.")
* [Vulnerability Response patch orchestration integration with Microsoft SCCM](https://servicenow-prod.fluidtopics.net/PZV21C07W_aS_du2IqIsmA "The Vulnerability Response integration with the Microsoft System Center Configuration Manager (SCCM) supports patch management and deployment for critical vulnerabilities across your assets.")
* [Understanding the NVD integrations](https://servicenow-prod.fluidtopics.net/eFiXOlP4oTeyfPz4Q0roQA "The NVD integrations use data imported from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) product to help you determine the impact and priority of flaws in your code. Run this integration as part of your initial setup of Vulnerability Response and prior to importing vulnerability data into your instance with a third-party scanner product.")
* [Qualys Vulnerability Integration](https://servicenow-prod.fluidtopics.net/voPK7ViYvD_BP1vyXszRpQ "The Qualys product sensors collect the data and automatically send it to the Qualys application, which continuously analyzes and correlates the information. It easily integrates with Vulnerability Response as the Qualys Vulnerability Integration to map vulnerabilities to CIs and business services to determine impact and priority of potentially malicious threats.")
* [Understanding the Rapid7 Vulnerability Integration](https://servicenow-prod.fluidtopics.net/x6g91G68OSnfYIpX~hjiww "The ServiceNow Rapid7 Vulnerability Integration uses data imported from the Rapid7 data warehouse or the Rapid7 InsightVM products to help you determine the impact and priority of potentially malicious threats.")
* [Shodan Exploit Integration](https://servicenow-prod.fluidtopics.net/wW1CSIenF6IXdyMxgvBbuw "The ServiceNow Shodan Exploit Integration application uses data imported from the Shodan search engine to help you determine the impact and priority of potentially malicious exploits.")
* [Understanding the Tenable Vulnerability Integration](https://servicenow-prod.fluidtopics.net/LBEiVzZ9snj0he1KfeiBpw "The Vulnerability Response Integration with Tenable application developed by ServiceNow engineering for the Tenable Vulnerability Integration uses data imported from the Tenable.io, Tenable.sc, and Tenable.cs products to help you prioritize and remediate vulnerabilities for your assets. The application is available with a separate subscription from the ServiceNow Store.")
* [Microsoft Security Response Center Solution Integration](https://servicenow-prod.fluidtopics.net/uGtfwU~G6AAnO0qVqVqlIw "Review and implement proposed remediation solutions provided by the Microsoft Security Response Center Solution Integration.")

  The
  Microsoft Security Response Center Solution Integration is available with Vulnerability Solution Management. For information on the installation and
  configuration of the Microsoft Security Response Center Solution Integration and
  the Red Hat Solution Integration, see [Install the Solution Management for Vulnerability Response application](https://servicenow-prod.fluidtopics.net/y_INCI~k10rb44Ipf472Ew "Before you can use the Solution Management for Vulnerability Response feature of Vulnerability Response in your instance, you must complete the installation of the Vulnerability Solution Management application. This application is available as a separate subscription in the ServiceNow Store."). You can
  configure, edit, schedule, and launch on-demand the Microsoft Security Response Center Solution Integration and the Red Hat Solution Integration from within the Setup
  Assistant.
{#vuln_integrations__ul_anp_nkz_wvb}

## Additional notes for integrations {#vuln_integrations__section_aw5_cnz_wvb}

If multiple deployments are supported for an integration, see [Create domain-separated imports for an integration](https://servicenow-prod.fluidtopics.net/0N9JZHv_nZJYrkMbQYSBbQ "If you require imported data to be in a specific domain, the user assigned to run the integrations must belong to that domain.").

* You can install, configure, schedule, and launch on-demand many of the integration applications from within Setup Assistant.
* You can install the Rapid7 Vulnerability Integration application from Setup Assistant, but configuration is not supported for this integration from within the Setup Assistant. See [Install the Rapid7 Vulnerability Integration](https://servicenow-prod.fluidtopics.net/8QYrJRzRRzMx_oecEzk4tw "After you complete the set up steps for the integration so that it properly integrates with Vulnerability Response, get entitlements, download, and install the application on your ServiceNow AI Platform instance.") for more information.
* The Tenable for Vulnerability Response application by Tenable is created and maintained by Tenable. See their documentation at [Tenable for Vulnerability Response.](https://docs.tenable.com/snow/Content/Welcome.htm)

{#vuln_integrations__ul_ev2_rlz_wvb}  
During integration execution, multiple processes are generated, and data is received in the form of pages. Each process can contain one or more import queue entries with attached data in pages. These entries must process the data within the one-hour time limit. However, if the payload size is large, the processing time may exceed one hour or get stuck, resulting in an integration timeout error. The integration continues to process the data despite the timeout error. To avoid this miscommunication, starting from version 18.2.4 of Vulnerability Response, timestamps (heartbeats) are sent periodically to indicate if the queue is active and processing data. The Last Record Processed field in the Import Queue Entry page is updated based on the count of records the import queue creates or updates. In case an import queue entry exceeds the one-hour time limit, the system checks the Last Record Processed field to see if it is also older than one hour. If it is, this indicates that the import queue entry is stuck, and it is timed out to prevent any further delays in processing.  
Note:  
The Last Record Processed field is updated based on what is defined in the following system properties:

* sn_sec_cmn.record_threshold_heartbeat: Defines the number of processed records, after which the heartbeat (timestamp) is sent to the import queue entry.
* sn_sec_cmn.maximum_heartbeat_delay: Defines the time after which the import queue entry must be timed out.
{#vuln_integrations__ul_g23_sgw_dyb}  
Starting from VR v17.1, the following integration process state names have been updated:{#vuln_integrations__table_zcs_bcy_x5b__entry__2}

| State name prior to V17.1 | State name V17.1 onwards |
|-|-|
| Processing | Retrieving |
| WaitComplete | Waiting/Processing |
[ ]

{#vuln_integrations__table_zcs_bcy_x5b}  
Note:  
You can view the attachments that are downloaded and processed. When the status of the integration run is `waitcomplete`, it displays the percentage of integration that is complete.

## Vulnerability Response applications and CSDM tables {#vuln_integrations__id_u43_wzh_q2c}

The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications. See [Vulnerability Response applications and CSDM tables](https://servicenow-prod.fluidtopics.net/CZ4qzzPgaYYJ6UkJzQAHiQ "The Vulnerability Response, Application Vulnerability Response, third-party vulnerability integrations and Software Bill of Materials applications manage (contribute data to) CSDM tables. These applications also use data from CSDM tables that other applications generate. Several ServiceNow products, therefore, benefit from and add value to these Security Operations applications.") for more information.

## Manually created integrations {#vuln_integrations__section_v1z_dy2_dbb}

You can add other integrations that are not available as ServiceNow Store applications, as needed. See
[Manually create a vulnerability integration](https://servicenow-prod.fluidtopics.net/N~R2nD9HvzuqZOO8dB1KFg "Vulnerability integrations provide the ability for customers and vendors to enrich the vulnerability data on their instance by retrieving data from external systems and vendors. This ability can simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.") for more information.