--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Severity mapping for Vulnerability Response # Severity mapping for Vulnerability Response {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Severity Mapping for Vulnerability Response The Vulnerability Response module in ServiceNow utilizes the National Vulnerability Database (NVD) for standardized severity mapping. This feature is crucial for enterprises to assess and prioritize vulnerabilities effectively. Third-party integrations, such as Rapid7, Qualys, Tenable.io, and Microsoft TVM, provide additional severity mappings that can be customized based on business needs. Show full answer Show less ## Key Features * **Severe Mapping from Third-Party Integrations:** Each integration calculates the normalized severity based on entries from the `snvulnvdentry` table using Business Rules. This ensures that the severity of vulnerabilities is consistent across different integrations. * **Source Severity Mapping:** Data from respective vulnerability databases is mapped to the `sourceseverity` table, allowing for a unified view of vulnerability severity irrespective of the source. * **Priority Assignment:** For some integrations, the priority of vulnerabilities is dynamically set based on background Business Rules that assess the severity levels and map them accordingly. ## Key Outcomes ServiceNow customers can expect the following benefits: * Enhanced ability to prioritize vulnerabilities based on a consistent severity mapping approach. * Increased efficiency in vulnerability management through automated mappings that reduce manual intervention. * Improved visibility into the security posture of the organization by integrating various third-party data sources into a single platform. Vulnerability Response ships with National Vulnerability Database (NVD) to normalized ServiceNow severity mapping. ServiceNow third-party integrations provide severity mappings upon installation. These maps can be adjusted by changing the fields in existing maps. ## Rapid7 Vulnerability Integration Severity Mapping {#vulnerability-response-severity-mapping__section_oyy_pnn_2cc} Normalised_Severity Calculate normalised_severity on third-part entry using the severity coming from sn_vul_nvd_entry table. This is set using Business Rules for Lookup normalized severity on sn_vul_entry table. Source_severity Data from the severity_score table is mapped to source_severity table while the Rapid7 Vulnerability Integration- API is running. Priority This field is empty. ## Qualys Vulnerability Integration Severity Mapping {#vulnerability-response-severity-mapping__section_iqv_r4n_2cc} Normalised_Severity Calculate normalised_severity on third-part entry using the severity coming from sn_vul_nvd_entry table. This is set using Business Rules for Lookup normalized severity on sn_vul_entry table. Source_severity Data from the SEVERITY_LEVEL is mapped to the source_severity table while the Qualys Knowledge Base Integration is running. Priority Data for the Priority field is obtained from SEVERITY table and mapped to priority table while Qualys Host Detection Integration is running using the Business Rule mapped to Qualys Data. Note: Business Rules run in the background and checks the priority for Qualys and accordingly maps the Priority. So, to map Qualys data, BR is responsible. ## Tenable.io Vulnerability Integration Severity Mapping {#vulnerability-response-severity-mapping__section_qnw_npn_2cc} Normalised_Severity Calculate normalised_severity on third-part entry using the severity coming from sn_vul_nvd_entry table. This is set using Business Rules for Lookup normalized severity on sn_vul_entry table. Source_severity Data from risk_factor table is mapped to source_severity table while the Tenable.io Plugin Integration is running. Priority Data from severity_id is mapped to source_severity while the Tenable.io Open Vulnerabilities Integration is running. VPR Data from score is mapped to Source_risk_score while Tenable.io Plugin Integration is running. Data from Calculated from score is mapped to Source_risk_rating while Tenable.io Plugin Integration is running. ## Tenable.sc Vulnerability Integration Severity Mapping {#vulnerability-response-severity-mapping__section_zkg_2qn_2cc} Normalised_Severity Calculate normalised_severity on third-part entry using the severity coming from sn_vul_nvd_entry table. This is set using Business Rules for Lookup normalized severity on sn_vul_entry table. Source_severity Data for riskFactor table is mapped to source_severity while the Tenable.io Plugin Integration is running. Priority Data from severity received as "severity": { "id": "0", "name": "Info", "description": "Informative" } is mapped to source_severity while the Tenable.io Open Vulnerabilities Integration is running. VPR Data from vprScore is mapped to Source_risk_score while Tenable.io Plugin Integration is running. Data from Calculated from vprScore is mapped to Source_risk_rating while Tenable.io Plugin Integration is running. ## TVM Severity Mapping {#vulnerability-response-severity-mapping__section_gp5_hrn_2cc} Normalised_Severity Calculate normalised_severity on third-part entry using the severuty coming from sn_vul_nvd_entry table. This is set using Business Rules for Lookup normalized severity on sn_vul_entry table. Source_severity Data from severity table is mapped to source_severity while Microsoft TVM Vulnerability(CVE) Integration is running. Priority This field is empty.