What this integration brings into ServiceNow
With a single install, the integration covers three core AWS security scenarios:
- Host and Lambda vulnerabilities from AWS Inspector & Security Hub flow into Vulnerable Items (VITs) in USEM Vulnerability Response.
- Container image vulnerabilities from AWS Inspector & Security Hub flow into Container Vulnerable Items (CVITs) in USEM Container Vulnerability Response.
- Configuration and posture findings from AWS Security Hub flow into Test Results (TRs) in USEM Configuration Compliance.
Why it matters
Before this integration, getting AWS findings into ServiceNow SecOps usually meant one of two things:
- Maintaining custom integrations built with Lambda functions, API mappings, and transformation scripts - often fragile and expensive to maintain & upkeep.
- Leaving AWS findings in a separate console, disconnected from the remediation workflows teams use.
Now, AWS security data shows up where teams already work:
- The same dashboards
- The same SLAs
- The same approval, exception, and remediation workflows
Cloud risk is no longer just observed - it’s prioritised and acted on.
Smart defaults, your controls
The integration gives teams control over what gets ingested, including filters for:
- Severity and CVSS score
- Exploit availability
- AWS region and account ID
It supports multi‑region ingestion and delta sync, so updates are incremental rather than full reimports - helping teams stay current without unnecessary noise.
Try it
Download the AWS Integration for Security Exposure Management from the ServiceNow Store and follow the documentation to get started.
Note: This integration requires the Unified Security Exposure Management (USEM) plugin and a Container Vulnerability Response (CVR) licence.
Over to you
If you’ve been running a custom AWS‑to‑ServiceNow integration, we’d love to hear what’s been working - and what hasn’t.
And if this is new territory for your team, what questions can we help answer? Let us know in the comments.
