---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Viewing data and field mapping

# Vulnerability Response Integration with Cisco AI Defense data mapping {#ariaid-title1}

Release version: Australia  
Updated September 15, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Vulnerability Response Integration with Cisco AI Defense data mapping

This integration enables ServiceNow customers to view and manage imported vulnerability and model validation data from Cisco AI Defense scans within their ServiceNow AI Platform instance.
It organizes scan results, validation findings, and policy details into specific tables, facilitating comprehensive vulnerability response and AI security exposure management.
Show full answer Show less  

## Data Organization and Key Tables

The imported data is structured into three main categories:

* **Vulnerability Scan Data:** Includes summaries of scan statuses and severity, individual vulnerability findings, discovered AI assets, detailed vulnerability entries, and model file metadata.
* **Model Validation Data:** Contains validation job results, specific threat prompts tested against AI models, attack outcomes, severity levels, and associated threat signatures mapped to recognized frameworks such as MITRE ATT\&CK and NIST AI standards.
* **Policy Data:** Comprises AI security policies imported from Cisco AI Defense, including policy status, connection types, and related guardrail rules with actions and directions.

## Using the Data in ServiceNow

ServiceNow customers can access and analyze this data via the AI Security Exposure Management dashboard under the Security Exposure Management workspace. Key functionalities include:

* Reviewing scan metrics, vulnerabilities, models, and model files scanned.
* Examining AI validation findings such as mitigated findings, active guardrails, models tested, and number of attacks.
* Assessing AI posture findings, including agents, tools, system prompts, and MCP servers with findings.

## Troubleshooting and Best Practices

* If integration is not running, verify API credentials, network connectivity, and review system logs for errors.
* If no data appears, confirm that scans with severity findings exist in Cisco AI Defense and that transform maps are active.
* To address authentication errors, validate Tenant API Key, API URL, and ensure an active Cisco AI Defense subscription.
* Manually test integrations before scheduling automated syncs and adjust limit parameters based on data volume.
* Regularly monitor import set processing for errors and schedule syncs during low system load periods.
* Utilize ServiceNow AI Platform reporting features to track AI security trends effectively.

## Role Requirements

Access to this integration requires the **snvulciscoaidf.read** or **snvulciscoaidf.admin** roles.  
View and work with imported data from the Vulnerability Response Integration with Cisco AI Defense scan results and model validation data on records and dashboards in your ServiceNow AI Platform instance.
Role required: sn_vul_cisco_ai_df.read or sn_vul_cisco_ai_df.admin.
After the integration runs, data appears in the following tables organized by data type.{#use-cisco-ai-defense-integration__data-tables-intro}
{#use-cisco-ai-defense-integration__id_z5d_stc_nkc__entry__2}

| Table name | Description |
|-|-|
| AI Scan Summary (sn_sec_ai_scan_summary) | Overview of all vulnerability scans, including scan status, findings by severity (Critical, High, Medium, Low), and total findings count. |
| AI Vulnerability Finding (sn_sec_ai_scan_finding) | Individual vulnerabilities found, including vulnerability ID, description, category, and severity level. |
| Discovered AI Assets (sn_sec_ai_src_ci) | AI models and files discovered during scans. |
| AI Vulnerability Entry (sn_sec_ai_vul_entry) | Detailed vulnerability information. |
| Model File (sn_sec_ai_file) | File metadata including file name, file path, file size, file format, and last scanned timestamp. |
[Table 1. Tables and data description]

{#use-cisco-ai-defense-integration__id_z5d_stc_nkc} {#use-cisco-ai-defense-integration__id_gnj_vtc_nkc__entry__2}

| Table name | Description |
|-|-|
| AI Validation Findings (sn_sec_ai_validation_finding) | Validation job results including status, attack counts, and outcomes. |
| AI Validation Threat (sn_sec_ai_validation_threat) | Specific threat prompts tested against the model, including attack prompt, model response, attack result status (FAILED, SUCCESS), and severity level. |
| AI Threat Signature (sn_sec_ai_threat_signature) | Attack patterns detected, including attack category (for example, CYBERBULLYING, HARASSMENT), attack technique (for example, keyboard_augmenter), MITRE ATT\&CK mappings, and NIST AI standards mappings. |
[Table 2. Model validation tables and data]

{#use-cisco-ai-defense-integration__id_gnj_vtc_nkc} {#use-cisco-ai-defense-integration__id_policy_tbl_nkc__entry__2}

| Table name | Description |
|-|-|
| Cisco AI Defense Policy (sn_vul_cisco_ai_df_policy) | AI security policies imported from Cisco AI Defense, including policy status and connection type. |
| Cisco AI Defense Policy Guardrail (sn_vul_cisco_ai_df_m2m_policy_guardrail) | Guardrail rules linked to each imported policy, including guardrail action and direction. |
[Table 3. Policy tables and data]

{#use-cisco-ai-defense-integration__id_policy_tbl_nkc}

See [Viewing AI Exposures](https://www.servicenow.com/docs/P8GUyl9Gm5LN36RikAsmpg "Access the entire attack surface across various types of findings on the AI Security Exposure Management dashboard with the AI Exposures module. AI Security Exposure Management is a dedicated module of the Security Exposure Management workspace.") for more information about the finding types and the data displayed on the AI Security Exposure Management dashboard.  
1. Navigate to AllSecurity Exposure Management workspaceAI Security Exposure ManagementAI Vulnerabilities. The scan metrics are displayed.
2. Select a scan metrics card to open it.
   * Open Vulnerabilities
   * Models scanned
   * Model files scanned
   {#use-cisco-ai-defense-integration__ul_gmx_dfc_nkc}
3. Select the AI validation findings tab.
4. Select a validation metrics card to open it.
   * Open validation findings
   * Mitigated findings
   * Active guardrails
   * Models tested
   * Number of attacks
   {#use-cisco-ai-defense-integration__ul_dn3_ysc_nkc}
5. Select the AI posture findings tab.
6. Select a Posture metrics card to open it.
   * Open posture findings
   * Agents with findings
   * Tools with findings
   * System prompts with findings
   * MCP servers with findings
   {#use-cisco-ai-defense-integration__ul_j1v_dtc_nkc}
{#use-cisco-ai-defense-integration__ol_p2n_f5c_nkc} Integration not running:

* Verify API credentials are correct.
* Check network connectivity to Cisco AI Defense.
* Review system logs for error messages.

{#use-cisco-ai-defense-integration__ul_hyz_qpf_tkc}

No data appearing:

* Verify that scans or validations exist in Cisco AI Defense.
* Confirm that scans have severity findings. The integration only fetches scans with issues.
* Verify transform maps are active.

{#use-cisco-ai-defense-integration__ul_iyz_qpf_tkc}

Authentication errors:

* Confirm the Tenant API Key is valid.
* Confirm the API URL is correct.
* Verify your Cisco AI Defense subscription is active.
{#use-cisco-ai-defense-integration__ul_jyz_qpf_tkc}
* Test each integration manually before scheduling.
* Adjust limit parameters based on your data volume.
* Regularly check import set processing for errors.
* Run automated syncs when system load is low.
* Use ServiceNow AI Platform reporting to track AI security trends.
{#use-cisco-ai-defense-integration__ul_kyz_qpf_tkc}

*[\>]: and then