Invicti Servicenow AVIT Job difference in count and status

[prit123]

We have found the No of AVITs in Invicti and Servicenow are different.

Also the status difference in both the system. In invicti the AVIT status is Fixed but in ServiceNow the AVIT status is still showing Open. Does the ServiceNow Job brings all the data that is available in Invicti or  the delta data that is being modified in Invicti. What can the reason of AVIT still open in ServiceNow.  

[Sachin_Nasa]

Hi @prit123 ,

In ServiceNow Vulnerability Response (SecOps), the Invicti integration processes delta updates, not a full data refresh. Status changes from Invicti, such as Fixed, are updated in ServiceNow only if the integration mapping and job logic support status updates. If the “Fixed” status is not mapped to a resolved or closed state in ServiceNow, the AVIT will remain Open. Reviewing the integration job configuration, status mapping, and applied filters is required to ensure status updates are reflected correctly.

If you find this response helpful, please mark it as Helpful and accept it as the solution if it addresses your question—it would encourage me to contribute more to the ServiceNow Community.

Thanks & regards,
Sachin Narayanasamy

[prit123]

@Sachin_Nasa  - We found the mapping for fixed in state map. 

But for one of the scenario we have found the Fixed UnConfirmed record is not there in AVIT Import table itself though Invicti team have done it Infront of us. And integration run status shows success.  

[Sachin_Nasa]

Hi @prit123 ,

Thanks for the update.
If the “Fixed Unconfirmed” item is not showing up in the AVIT import table—even though Invicti sent it and the integration run was successful—then something is stopping the record before it reaches the import table.

Here are the most common reasons this happens:

1. Filters in the Transform Map or Script
There might be conditions that block certain statuses (like Fixed Unconfirmed) from being inserted.

2. Missing or Invalid Data
If required fields are missing (for example: URL, plugin ID, host, scanner ID), ServiceNow may quietly skip the record.

3. Integration Script Logic
The Scripted REST API or MID script might be written in a way that ignores certain statuses.

4. Duplicate Handling
If the system thinks the record is a duplicate based on correlation ID, it may discard it instead of creating an import row.

5. Check the Raw Payload Logs
Please check if the “Fixed Unconfirmed” item appears in the REST API logs or the ECC Queue (if using MID Server).

• If it doesn’t appear, the data never reached ServiceNow.
• If it appears, but isn’t in the import table, then a filter or script blocked it during processing.
  
  If you find this response helpful, please mark it as Helpful and accept it as the solution if it addresses your question—it would encourage me to contribute more to the ServiceNow Community.
  
  Thanks & regards,
  Sachin Narayanasamy

[prit123]

@Sachin_Nasa  Going through some of the records in the JSON we received from Invicti, we could see CWE null is being passed by Invicti for which the AVIT's were not created. But couldn't see any error message stating the same in logs or import set.

Secondly case -some records where not sent at all from Invicti, when found ServiceNow is querying Invicti based on the last seen date. And in Invicti the last seen date has not changed but the state did changed in Invicti (state change manually in Invicti instead of a scan). So we didn't got the data. Should we get the data based on last seen date.