Best Practice for Implementing Notifications for Vulnerability Items Without CI in a Custom App

[alikirmizi]

Hi everyone,

we are currently building a custom application on ServiceNow to support parts of our Vulnerability Management process. One of the requirements is to detect and notify users when new Vulnerability Items (VIs) are created without an associated Configuration Item (CI).

We want to establish a robust mechanism that:

1. identifies Vulnerability Items where ci is empty, and
2. sends a notification through one of these channels:
   • email (HTML preferred)
   • PDF report

Essentially, as soon as new VIs appear without a CI, someone should be proactively informed.

What is the best practice to implement this kind of detection + notification logic in a custom ServiceNow application?

I’m mainly looking for architectural guidance on how you would set this up in the most scalable and maintainable way.

Thanks in advance for any suggestions!

Best regards

[pavani_paluri]

Hi @alikirmizi ,

When a new VI record is created, check if the CI field is empty. You can do this with a Business Rule (runs automatically when a record is inserted) or a Flow Designer flow (triggered on record creation).

If you’re importing data in bulk, you might also want a scheduled job that scans for VIs without CIs once a day.

Create a notification that sends an HTML email with the VI details (ID, description, severity, etc.).
PDF report: If you want a digest instead of one email per record, schedule a report that lists all VIs missing CIs and email it as a PDF.

Use real‑time email alerts for immediate awareness.
Use scheduled PDF reports for oversight and trend tracking.
Centralize your notification templates so you don’t duplicate formatting in multiple places.
Use Flow Designer where possible — it’s easier to maintain than scripted Business Rules.

Mark it helpful if this helps you to understand. Accept solution if this give you the answer you're looking for

Kind Regards,

Pavani P