--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Invicti Vulnerability Integration # Invicti Vulnerability Integration {#ariaid-title1} Release version: Australia Updated July 6, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Invicti Vulnerability Integration The Invicti Vulnerability Integration enables ServiceNow customers to import and utilize vulnerability data scanned by the Invicti product. This integration supports multiple scan types including Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Interactive Application Security Testing (IAST), and Software Composition Analysis (SCA). By importing this data, you can better assess the impact and prioritize remediation of application vulnerabilities within your ServiceNow AI Platform® instance. Show full answer Show less This integration is designed to seamlessly integrate with the ServiceNow Application Vulnerability Response feature, ensuring that third-party application vulnerability data is mapped accurately into your environment. ## Integration Versions and Compatibility * If you plan to upgrade to a version compatible with Unified Security Exposure Management (USEM), you should select versions starting with 30.x. * If you are not upgrading to USEM-compatible versions, choose versions below 30.x. * All integrations support both legacy (non-USEM) and Unified Security Exposure Management environments. ## Integration Types and Workflow The integrations included in the base system run in a chained sequence, where completion of one triggers the next. Scheduled jobs automate this process daily, but manual execution is also supported to maintain synchronization with vulnerability management systems. ### Enterprise Integrations * **Invicti Application List Application:** Imports scanned applications into either the Discovered Applications or Scanned Application tables, depending on configuration. * **Invicti Scan List Integration:** Imports metadata about scan execution times following application list import. * **Invicti Application Vulnerable Item Integration:** Imports detailed vulnerability findings, updating or creating application vulnerable items linked to your vulnerability response. Configuration allows flexibility in linking imported applications to Configuration Items (CIs) or product models by adjusting system properties and lookup rules, enabling better alignment with your asset management practices. ### Platform Integrations * **Application List Integration:** Run on-demand to import the list of applications scanned in Invicti Platform as discovered applications. * **Scan Summary Integration:** Automatically triggered after Application List integration, it pulls scan metadata to correlate with vulnerability findings. * **Findings Integration:** Triggered after Scan Summary integration, it imports vulnerability findings into Vulnerability Response, creating or updating records accordingly. This grouping provides a unified view by combining application vulnerabilities from Invicti with infrastructure vulnerabilities for comprehensive security posture management. ## Practical Considerations for ServiceNow Customers * Scheduled jobs simplify vulnerability lifecycle management by keeping your ServiceNow instance synchronized with Invicti scan data daily. * Adjusting system properties and activating CI lookup rules allow you to tailor how scanned applications are linked within your environment, improving asset and vulnerability tracking. * Each vulnerability type from Invicti is mapped uniquely in ServiceNow, enabling clear identification and consistent tracking in the Vulnerability Response application. * The integration supports up to 200 items per page during data import to balance performance and completeness. The Invicti Vulnerability Integration uses application data imported from the Invicti product to help you determine the impact and priority of flaws in your code. ## Invicti Vulnerability Integration {#invicti-vuln-integration__section_zvz_c51_vzb} The Invicti Vulnerability Integration collects scanner data and makes that data available to the ServiceNow AI Platform®. It easily integrates with the ServiceNow® Application Vulnerability Response feature of Vulnerability Response to map imported third-party application vulnerability information into your instance. The integration imports the following types of scanned data. * Dynamic Application Security Testing (DAST) * Static Application Security Testing (SAST) * Interactive Application Security Testing (IAST) * Software Composition Analysis (SCA) {#invicti-vuln-integration__ul_ssr_tw1_vzb} For more information about DAST and IAST, see [Exploring Application Vulnerability Response](https://www.servicenow.com/docs/f_ns8m5SwM0B38fyd4Ck7w "Application vulnerabilities are vulnerabilities on your custom software applications that are scanned throughout the application’s development life cycle."). ## Available versions {#invicti-vuln-integration__section_esm_d51_vzb} {#invicti-vuln-integration__table_fpy_bw1_vzb__entry__2} | Release version | Release notes | |-|-| | If you intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version starting with 30.x when installing or upgrading. | [https://www.servicenow.com/docs/access?context=secops-app-vuln-resp-rn\&version=australia\&pubname=australia-release-notes\&ft:locale=en-US](https://www.servicenow.com/docs/access?context=secops-app-vuln-resp-rn&version=australia&pubname=australia-release-notes&ft:locale=en-US) For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498) | | If you don't intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version number below 30.x when installing or upgrading. | | [ ] {#invicti-vuln-integration__table_fpy_bw1_vzb} ## Integrations {#invicti-vuln-integration__section_dq3_351_vzb} The following integrations are included in the base system. The integrations are chained so that after one integration successfully completes, the next integration is initiated. The integrations run in the order listed in the following table. After the initial run, every day, scheduled jobs are chained to run these integrations automatically in order. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems. Starting with version v30.2 (Unified Security Exposure Management (USEM)) and v2.0 (non-Unified Security Exposure Management (USEM)), the integrations are grouped under Enterprise and Platform types. All the integrations are compatible with legacy (non-Unified Security Exposure Management (USEM)) and Unified Security Exposure Management (USEM). * Enterprise - Legacy integrations import DAST, SAST, IAST, and SCA scanned data. * Platform - Integrate application vulnerabilities from Invicti for DAST, SAST, IAST, and SCA into a unified platform alongside infrastructure vulnerabilities, providing you with a comprehensive view of your security posture. The Platform Integrations are chained like the Enterprise integrations where the next integration in the chain runs after the successful completion of the proceeding integration. The sequence starts with the Application List integration, but the run type is on_demand.{#invicti-vuln-integration__section_dq3_351_vzb__entry__2} | Integration | Description | |-|-| | Application List | Initiate this integration on-demand. Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. | | Scan Summary | If configured and activated, this integration is initiated automatically after the Application List Integration is successfully completed. Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. Updates existing records or creates new ones. | | Findings | If configured and activated, this integration is initiated after the Scan Summary Integration is successfully completed. Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. | [Table 1. Platform Invicti Vulnerability Integration integrations] {#invicti-vuln-integration__table_ezq_lw1_vzb__entry__2} | Integration | Description | |-|-| | Invicti Application List Application | Imports applications scanned by Invicti into the Discovered Applications \[sn_vul_app_release\] table or the Scanned Application \[sn_vul_app_scanned_application\] table based on how the sn_vul.use_product_model system property is set for the configuration item (CI) lookup rule records. * If the product model property is set to true, an application is inserted in the Discovered Application release table. It links to a product model using product model lookup rules. If a model is not found, a model is created: a software model if a version is present in the import, and an application model if it's version agnostic. * If the product model property is set to false, it links to a CI via lookup rules. If lookup rules fail, then a Scanned Application record is created and inserted in the Scanned Application table. {#invicti-vuln-integration__ul_rdz_qys_d1c} You can choose to activate lookup rules with configuration items (CIs) as the lookup targets by modifying the system property. If you modify it, you should also activate CI Lookup rules to match the lookup target. For more information, see: * [Configure the Invicti Vulnerability Integration](https://www.servicenow.com/docs/bXccrWLlcwmVs~BCf0aM8A "Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.") * [Create a CI lookup rule](https://www.servicenow.com/docs/cYesQhAYuo9aAtGPm342qA "The CI Lookup Rules module contains rules that define what fields have matching data in the Configuration Management Database (CMDB). These rules are used to identify applications and application releases and add them to the application vulnerable item (AVI) record to aid in remediation.") * [Reapplying lookup rules in Application Vulnerability Response](https://www.servicenow.com/docs/ZuoGc27187dD~zpQWY9fkQ "You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models) on discovered application records.") {#invicti-vuln-integration__ul_zhk_klt_d1c} | | Invicti Scan List Integration | This integration is initiated after the Application List Integration is successfully completed. This integration imports data about the date and time a scan was run. | | Invicti Application Vulnerable Item Integration | This integration is initiated after the Scan List Integration is successfully completed. View details such as total processing times, average times for pre- and post-integration run processes, and reports on the integration run records for the Application Vulnerable Item integration. Each vulnerability in Invicti has a type, for example,DirectoryListing. This type is mapped as a unique ID in your instance and displayed as part of the value in the Vulnerability field on the application vulnerable item (AVI) record: Invicti-DirectoryListing. For more information about mapping, see [Invicti Vulnerability Integration state mapping](https://www.servicenow.com/docs/oa1mTkUw6D1Lqd6F9r398g "The following source states from the Invicti Vulnerability Integration and their target states in your instance are listed in the following table."). | [Table 2. Enterprise Invicti application vulnerability integrations] {#invicti-vuln-integration__table_ezq_lw1_vzb} The upper limit for items per page for all three integrations is 200.