---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Integration imports

# Configuration Compliance imported data for Microsoft Defender for Cloud Integration {#ariaid-title1}

Release version: Yokohama  
Updated July 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configuration Compliance imported data for Microsoft Defender for Cloud Integration

Configuration Compliance imports and manages policies, tests, authoritative sources, and test results from Microsoft Defender for Cloud through scheduled integrations.
This enables ServiceNow customers to view and remediate security compliance data within Configuration Compliance, leveraging up-to-date assessments and authoritative standards.
Show full answer Show less  

## Key Features

* **Terminology Updates:** From version 14.9 onward, terms like Test Result Group and Rules have been renamed to Remediation Task Group and Remediation Task Rules for clarity.
* **Test Groups:** Groups of configuration tests linked to authoritative documents, modifiable to fit organizational needs. They are populated automatically via the Policy Definitions Integration scheduled job.
* **Tests:** Collections of data records that define governance for assets, retrieved via the Assessment Metadata Integration job. Tests link to test groups for organization.
* **Authoritative Sources:** Industry-standard references (e.g., ISO 27001, PCI DSS 3.2.1) used to generate vulnerability alerts. Retrieved through the Compliance Standards \& Controls Integration job.
* **Assets and Cloud Attributes:** Resource tags and cloud metadata (such as Cloud Account, Region, Resource Type, and Provider) imported for filtering and assignment in Configuration Compliance. Host tags are case-insensitive and intended for condition building only.
* **Test Results:** Imported from Microsoft Defender for Cloud via the Assessment Integration job and remediated using Remediation Tasks. Includes incremental updates based on status changes, with a weekly Comprehensive Assessment Integration to capture all unresolved results from the last seven days.
* **CI Lookup Rules:** Automatically identify configuration items (CIs) in the CMDB by matching imported resource data, aiding in remediation. Base rules exist for Resource ID, Name, and S3 Bucket.
* **Container Vulnerability Items:** Imported container vulnerability data from Microsoft Defender for Cloud using the Container Image Vulnerabilities Integration job, with data ingestion controlled via a Start Time parameter.

## Practical Use and Configuration

* Scheduled integration jobs automate the import of compliance data; customers can also run these integrations manually, following the order: Policy Definitions Integration, then Assessment Metadata Integration, then Compliance Standards \& Controls Integration.
* The Assessment Integration uniquely supports incremental data import based on Start Time and status changes, ensuring efficient updates.
* Resource tags imported as host tags support filtering in compliance rules but should be used cautiously due to case insensitivity and grouping implications.
* CI Lookup Rules help link imported compliance data to existing CMDB records, facilitating effective remediation workflows.
* Container vulnerability data ingestion is configurable by date, enabling targeted updates or full data imports as needed.

## Expected Outcomes

With Microsoft Defender for Cloud integration in Configuration Compliance, ServiceNow customers can maintain an accurate, standards-aligned view of their security posture, automate the import of relevant compliance and vulnerability data, and efficiently manage remediation tasks. This integration supports ongoing compliance monitoring and enhances security exposure management by linking compliance data directly to CIs in the CMDB and enabling detailed filtering and assessment of assets based on cloud metadata.  
Configuration Compliance imports policies, tests, authoritative sources, and test results from third-party integrations and stores them in modules for viewing.  
Note:  
Starting with v14.9 of Configuration Compliance, the following terms have been renamed:{#cc-asc-policies__entry__2}

| Terminology prior to v14.9 | Terminology v14.9 onwards |
|-|-|
| Test Result Group | Remediation Task |
| Group Rules | Remediation Task Rules |
| Policy | Test group |
[Table 1. Changes in terminology]

## Test groups {#cc-asc-policies__section_jcn_mbs_kbb}

A group of configuration tests constitutes a test group. Test groups are related to authoritative documents and test records, and they can be modified to meet the needs of your organization. One configuration test can belong to
multiple test groups.  
If the Microsoft Defender for Cloud Integration is installed, test groups are retrieved and populated by the Policy Definitions Integration scheduled job. Navigate to AllMicrosoft Defender for Cloud IntegrationAdministrationIntegrationsPolicy Definitions Integration to view the scheduled job.  
Note:  
If you choose to run the integration manually, run the Policy Definitions Integration first.

## Tests {#cc-asc-policies__section_cx4_nbs_kbb}

Tests are libraries of data records that organize scans of computing assets. Configuration tests define how assets must be governed.

A Configuration Compliance test is the mechanism third-party integration applications use to group assets by test results type.  
If the Microsoft Defender for Cloud Integration is installed, the Assessment Metadata Integration scheduled job retrieves the tests. Navigate to AllIntegrationPrimary IntegrationsAssessment Metadata Integration to view the scheduled job.  
Note:  
If you choose to run the integration manually, run the Assessment Metadata Integration after the Policy Definitions Integration.

The test group to which a test belongs is populated in the Test Groups column of the Tests list.

## Authoritative sources {#cc-asc-policies__section_isy_nbs_kbb}

Configuration Compliance uses authoritative sources and citations when generating vulnerability alerts for tests. Authoritative sources usually map to sections of published industry standards, such as ISO 27001 and PCI DSS 3.2.1.

These source records contain references to information about known software and hardware configuration issues from experts in the field of computer security. They define requirements for security policies and procedures.  
If the Microsoft Defender for Cloud Integration is installed, the Compliance Standards \& Controls scheduled job retrieves the authoritative sources and citations. Navigate to AllMicrosoft Defender for Cloud IntegrationIntegrationsCompliance Standards \& Controls Integration to view this scheduled job.  
Note:  
If you choose to run the integration manually, run the Compliance Standards \& Controls Integration after the Assessment Metadata Integration.

## Assets {#cc-asc-policies__section_vqb_nvl_mqb}

The Assessment integration provides vital information such as resource tags and cloud attributes. This information is displayed in the Discovered Item form.  It is used primarily for filtering in  Configuration Compliance Assignment and Remediation Task Rules.

* Resource tags: All cloud resource tags are imported as host tags as part of the  Assessment integration. The cloud tags for any cloud resource type are stored here, whether the resource is a host or not.
  * Tag storage is not case-sensitive. If a  Tokyo  tag is created, then a  TOKYO  tag cannot be stored in the Host tag table. Tokyo and TOKYO are considered to be the same host tag. Whichever tag was imported first wins.
  * Using host tags as a group key in a group rule can have unexpected results. Host tags are intended for use only in the condition builder.
  {#cc-asc-policies__ul_lgd_rnc_htb}
* Cloud attributes for assets: Following are the cloud attributes that the integrations retrieve from Microsoft Defender for Cloud:
  * Cloud Account
  * Cloud Region
  * Cloud Resource Type
  * Cloud Service Provider
  {#cc-asc-policies__ul_vmk_14c_htb}
{#cc-asc-policies__ul_llk_zmc_htb}

## Test results {#cc-asc-policies__section_zfx_b1t_kbb}

Configuration Compliance does not calculate the test results, but imports them as part of a third-party integration. Once they are viewable in Configuration Compliance, they are remediated using Remediation Tasks.

If the Microsoft Defender for Cloud integration is installed, the Assessment Integration scheduled job retrieves the test results. Navigate to AllMicrosoft Defender for Cloud IntegrationIntegrationsAssessment Integration to view this scheduled job.

The Assessment Integration import is the only integration that uses the Start Time parameter in the Integration Details tab. All other Configuration Compliance imports bring in all available data regardless of Start Time.

When the Assessment Integration import is complete, an event is started to trigger end-of-import calculations.

The Assessment Integration pulls the data assessments only if there is a status change from the last successful integration run for the last one day by default. So, if the assessment fails continuously for
the past few days, the integration will not fetch the assessment as there is no status change for the assessment. To keep the test results up to date with the defender assessments, a new Comprehensive Assessment Integration is added which pulls the data from the past seven days. It runs weekly and pulls all the test results, which are not passed.

## CI lookup rules for identifying CIs from Microsoft Defender for Cloud integrations {#cc-asc-policies__section_psy_q34_2rb}

When data is imported from a third-party integration, Configuration Compliance automatically uses resource data to search for matches in the Configuration Management Database (CMDB), using CI Lookup Rules. These rules are used to identify the configuration items (CIs) and add them to the test result record to aid in remediation. Base system CI lookup rules are
available for Resource ID, Name, and S3 Bucket. For more information on CI lookup rules, see [CI lockup rules for Microsoft Defender for Cloud Integration for Security Operations](https://www.servicenow.com/docs/xcgsTTqaKP~_upE5sLvE6w "You can use the configuration item (CI) lookup rules for the Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud integrations to find a correct match to commonly used resource types in the Configuration Management Database (CMDB).").

## Container vulnerability item {#cc-asc-policies__var.mstv-sem}

When the Microsoft Defender for Cloud integration is configured, the Container Image Vulnerabilities scheduled job retrieves container vulnerable items.

Navigate to AllMicrosoft Defender Integration for Security Exposure ManagementMicrosoft Defender for Cloud IntegrationIntegrationsContainer Image Vulnerabilities Integration.  
The Container Image Vulnerabilities Integration import uses the Start time parameter on the Integration Details tab to control data ingestion:

* If Start time is empty, the integration imports all available container vulnerability data.
* If Start time is set, the integration imports only data created or updated after the specified time.

*[\>]: and then