---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Field mapping

# Field mapping for the Prisma AIRS integration {#ariaid-title1}

Release version: Brazil  
Updated September 15, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
These tables map Prisma AIRS payload fields to target tables and columns in your ServiceNow
ServiceNow AI Platform instance.

## Field mapping for scan findings {#palo-alto-prisma-airs-mapping__field-mapping-scan-findings}

The following tables show how Prisma AIRS payload fields map to ServiceNow AI Platform target tables and columns for scan finding data.
{#palo-alto-prisma-airs-mapping__table_hjj_224_kjc__entry__3}

| Input field (payload key) | Target table | Target column |
|-|-|-|
| asset.asset_type | sn_sec_ai_src_ci | asset_type |
| asset.asset_id | sn_sec_ai_src_ci | source_asset_id |
| asset.asset_name | sn_sec_ai_src_ci | asset_name |
| asset.version | sn_sec_ai_src_ci | version |
| asset.asset_name | cmdb_ai_model_product_model | name |
| asset.version | cmdb_ai_model_product_model | version |
| vulnerability.source_vul_id | sn_sec_ai_vul_entry | id |
| vulnerability.description | sn_sec_ai_vul_entry | description |
| scan.scan_id | sn_sec_ai_scan_summary | scan_id |
| scan.scan_name | sn_sec_ai_scan_summary | scan_name |
| scan.start_time | sn_sec_ai_scan_summary | start_time |
| scan.end_time | sn_sec_ai_scan_summary | end_time |
| scan.scan_status | sn_sec_ai_scan_summary | scan_status |
| file.file_id | sn_sec_ai_file | id |
| file.file_path | sn_sec_ai_file | path |
| file.file_size | sn_sec_ai_file | size |
| file.file_name | sn_sec_ai_file | name |
| file.format | sn_sec_ai_file | format |
| file.last_scanned | sn_sec_ai_file | last_scanned |
| scan_finding.short_description | sn_sec_ai_scan_finding | short_description |
| scan_finding.detection_category | sn_sec_ai_scan_finding | detection_category |
| scan_finding.source_severity | sn_sec_ai_scan_finding | source_severity |
[Table 1. Input fields for scan findings]

{#palo-alto-prisma-airs-mapping__table_hjj_224_kjc} {#palo-alto-prisma-airs-mapping__table_ijj_224_kjc__entry__4}

| Field | Target table | Target column | Source |
|-|-|-|-|
| source | sn_sec_ai_src_ci | source | metadata (integration source) |
| is_model_scanned | sn_sec_ai_src_ci | is_model_scanned | Set to true (reporting_type=SCAN) |
| product_model | sn_sec_ai_src_ci | product_model | chain output (AISecModelCIHandler) |
| cmdb_ci | sn_sec_ai_src_ci | cmdb_ci | chain output (AISecModelCIHandler) |
| source | sn_sec_ai_vul_entry | source | metadata |
| source | sn_sec_ai_scan_summary | source | metadata |
| src_ci | sn_sec_ai_scan_summary | src_ci | chain output (discovered_ai_asset) |
| source | sn_sec_ai_file | source | metadata |
| model | sn_sec_ai_file | model | chain output (discovered_ai_asset) |
| source | sn_sec_ai_scan_finding | source | metadata |
| src_ci | sn_sec_ai_scan_finding | src_ci | chain output (discovered_ai_asset) |
| vulnerability | sn_sec_ai_scan_finding | vulnerability | chain output (AISecVulEntryHandler) |
| scan_summary | sn_sec_ai_scan_finding | scan_summary | chain output (AISecScanSummaryHandler) |
| file | sn_sec_ai_scan_finding | file | chain output (AISecFileHandler) |
[Table 2. Auto-populated fields for scan findings]

{#palo-alto-prisma-airs-mapping__table_ijj_224_kjc}

Tables populated by scan findings:

* AI Scan Findings \[sn_sec_ai_scan_finding\]
* AI Scan Summaries \[sn_sec_ai_scan_summary\]
* Discovered AI Assets \[sn_sec_ai_src_ci\]
* AI Vulnerability Entries \[sn_sec_ai_vul_entry\]
* Model Files \[sn_sec_ai_file\]
{#palo-alto-prisma-airs-mapping__ul_jjj_224_kjc}

## Field mapping for posture findings {#palo-alto-prisma-airs-mapping__field-mapping-posture-findings}

{#palo-alto-prisma-airs-mapping__table_kjj_224_kjc__entry__3}

| Input field (payload key) | Target table | Target column |
|-|-|-|
| asset.asset_type | sn_sec_ai_src_ci | asset_type |
| asset.asset_id | sn_sec_ai_src_ci | source_asset_id |
| asset.asset_name | sn_sec_ai_src_ci | asset_name |
| asset.version | sn_sec_ai_src_ci | version |
| asset.asset_name | cmdb_ai_model_product_model | name |
| asset.version | cmdb_ai_model_product_model | version |
| posture_rule.rule_id | sn_sec_ai_posture_rule | id |
| posture_rule.short_description | sn_sec_ai_posture_rule | short_description |
| finding_evidence.category | sn_sec_ai_finding_evidence | category |
| finding_evidence.details | sn_sec_ai_finding_evidence | details |
[Table 3. Input fields for posture findings]

{#palo-alto-prisma-airs-mapping__table_kjj_224_kjc} {#palo-alto-prisma-airs-mapping__table_ljj_224_kjc__entry__4}

| Field | Target table | Target column | Source |
|-|-|-|-|
| source | sn_sec_ai_src_ci | source | metadata (integration source) |
| product_model | sn_sec_ai_src_ci | product_model | chain output (AISecModelCIHandler) |
| cmdb_ci | sn_sec_ai_src_ci | cmdb_ci | chain output (AISecModelCIHandler) |
| source | sn_sec_ai_posture_rule | source | metadata |
| source | sn_sec_ai_posture_finding | source | metadata |
| ai_posture_rule | sn_sec_ai_posture_finding | ai_posture_rule | chain output (AISecPostureRuleHandler) |
| src_ci | sn_sec_ai_posture_finding | src_ci | chain output (discovered_ai_asset) |
| source | sn_sec_ai_finding_evidence | source | metadata |
| finding | sn_sec_ai_finding_evidence | finding | chain output (AISecPostureFindingHandler) |
[Table 4. Auto-populated fields for posture findings]

{#palo-alto-prisma-airs-mapping__table_ljj_224_kjc}

Tables populated by posture findings:

* AI Posture Finding \[sn_sec_ai_posture_finding\]
* AI Posture Rule \[sn_sec_ai_posture_rule\]
* Discovered AI Assets \[sn_sec_ai_src_ci\]
* Finding Evidence \[sn_sec_ai_finding_evidence\]
* AI Model Product Model \[cmdb_ai_model_product_model\]
{#palo-alto-prisma-airs-mapping__ul_mjj_224_kjc}

## Field mapping for validation findings {#palo-alto-prisma-airs-mapping__field-mapping-validation-findings}

{#palo-alto-prisma-airs-mapping__table_njj_224_kjc__entry__3}

| Input field (payload key) | Target table | Target column |
|-|-|-|
| asset.asset_type | sn_sec_ai_src_ci | asset_type |
| asset.asset_id | sn_sec_ai_src_ci | source_asset_id |
| asset.asset_name | sn_sec_ai_src_ci | asset_name |
| asset.version | sn_sec_ai_src_ci | version |
| asset.asset_name | cmdb_ai_model_product_model | name |
| asset.version | cmdb_ai_model_product_model | version |
| threat_signature.threat_category | sn_sec_ai_threat_signature | threat_category |
| threat_signature.threat_sub_category | sn_sec_ai_threat_signature | threat_sub_category |
| threat_signature.attack_technique | sn_sec_ai_threat_signature | attack_technique |
| threat_signature.attack_threat | sn_sec_ai_threat_signature | attack_threat |
| threat_signature.mitre_technique\[\].technique_id | sn_sec_cmn_mitre_technique | technique_id |
| threat_signature.mitre_technique\[\].technique_name | sn_sec_cmn_mitre_technique | technique_name |
| threat_signature.mitre_technique (resolved) | sn_sec_ai_threat_signature | mitre_technique_list |
| validation_finding.prompt | sn_sec_ai_validation_finding | prompt |
| validation_finding.short_description | sn_sec_ai_validation_finding | short_description |
| threat.prompt | sn_sec_ai_validation_threat | prompt |
| threat.response | sn_sec_ai_validation_threat | response |
| threat.source_severity | sn_sec_ai_validation_threat | source_severity |
| threat.status | sn_sec_ai_validation_threat | status |
| threat.last_seen | sn_sec_ai_validation_threat | last_seen |
[Table 5. Input fields for validation findings]

{#palo-alto-prisma-airs-mapping__table_njj_224_kjc} {#palo-alto-prisma-airs-mapping__table_ojj_224_kjc__entry__4}

| Field | Target table | Target column | Source |
|-|-|-|-|
| source | sn_sec_ai_src_ci | source | metadata (integration source) |
| is_model_validated | sn_sec_ai_src_ci | is_model_validated | Set to true (reporting_type=VALIDATION) |
| product_model | sn_sec_ai_src_ci | product_model | chain output (AISecModelCIHandler) |
| cmdb_ci | sn_sec_ai_src_ci | cmdb_ci | chain output (AISecModelCIHandler) |
| source | sn_sec_ai_threat_signature | source | metadata |
| prompt_hash | sn_sec_ai_validation_finding | prompt_hash | auto-generated (SHA256 of prompt) |
| response_hash | sn_sec_ai_validation_finding | response_hash | auto-generated (SHA256 of response) |
| ai_threat_signature | sn_sec_ai_validation_finding | ai_threat_signature | chain output (AISecThreatSignatureHandler) |
| src_ci | sn_sec_ai_validation_finding | src_ci | chain output (discovered_ai_asset) |
| source | sn_sec_ai_validation_finding | source | metadata |
| prompt_hash | sn_sec_ai_validation_threat | prompt_hash | auto-generated (SHA256 of prompt) |
| response_hash | sn_sec_ai_validation_threat | response_hash | auto-generated (SHA256 of response) |
| ai_validation_finding | sn_sec_ai_validation_threat | ai_validation_finding | chain output (AISecValidationFindingHandler) |
| source | sn_sec_ai_validation_threat | source | metadata |
[Table 6. Auto-populated fields for validation findings]

{#palo-alto-prisma-airs-mapping__table_ojj_224_kjc}

Tables populated by validation findings:

* AI Threat Signatures \[sn_sec_ai_threat_signature\]
* AI Validation Threats \[sn_sec_ai_validation_threat\]
* AI Validation Findings \[sn_sec_ai_validation_finding\]
{#palo-alto-prisma-airs-mapping__ul_pjj_224_kjc}

## Field mapping for Red Team scan guardrails {#palo-alto-prisma-airs-mapping__field-mapping-guardrails}

{#palo-alto-prisma-airs-mapping__table_qjj_224_kjc__entry__3}

| Input field (payload key) | Target table | Target column |
|-|-|-|
| job_uuid | sn_vul_prisma_airs_red_team_scan_guardrails | job_uuid |
| policy_id | sn_vul_prisma_airs_red_team_scan_guardrails | policy_id |
| display_name | sn_vul_prisma_airs_red_team_scan_guardrails | policy_name |
| config | sn_vul_prisma_airs_red_team_scan_guardrails | policy_config |
[Table 7. Input fields for Red Team scan guardrails]

{#palo-alto-prisma-airs-mapping__table_qjj_224_kjc}

Tables populated by Red Team scan guardrails: Prisma AIRS Red Team Scan Guardrails \[sn_vul_prisma_airs_red_team_scan_guardrails\].