A zero day by definition is a vulnerability that is published prior to the vendor/owner having a patch. In other words its a flaw you cannot fix on 'day zero'. While you could create VIT's via Exposure Assessment if there is a known CVE published, using the software publisher, product, version option, or even manual upload, you may want to think thru the necessity of doing so. Big 3 scanning vendors (Qualys, Tenable, Rapid7) are pretty quick to publish their signatures and most likely would be 24 hours or less. Going thru the trouble of creating VIT's outside your BAU process might be an overkill during this short window. There is also the issue of duplicate tickets once the scanners start feeding you detections as well. You may want to look at beginning a Security or regular Incident process (if the zero day is Critical) for tracking, running targeted scans once the signature is published, and adhoc imports of the results into ServiceNow for holistic tracking.
In my experience, anything truly Critical usually has a more manual and focused response and we backfill the documentation of VIT's while "flying the plane". If a Zero Day is not Critical (not all of them are!), your routine SLA's should not be greatly impacted by a day or two of missing VIT's.
