--- sourceDocument: Brazil Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Vulnerability Response vulnerable item detections from third-party integrations # Vulnerability Response vulnerable item detections from third-party integrations {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Vulnerability Response vulnerable item detections from third-party integrations The Vulnerability Response application in ServiceNow supports integration with third-party vulnerability scanners, allowing you to import detailed detection data about vulnerabilities found in your enterprise environment. These detections represent distinct occurrences of vulnerabilities as reported by scanners and are paired with vulnerable item (VI) records in your ServiceNow AI Platform instance. The VI state is automatically updated based on detection status, and if no matching VI exists, a new one is created. Show full answer Show less Starting from Vulnerability Response version 21.1.2, a system property allows your instance to update a VI with details from the last open detection, enhancing accuracy of fields like IP address, port, protocol, and proof. You can customize which detection fields update the VI and view these details via the "Last Open Detection" tab on the VI form. A provided scheduled job helps update VIs with last open detection values for records opened in the past year. When configuration items (CIs) change, detection records may be reassigned between VIs accordingly, with updates rolled up based on the system property settings. ## Supported Versions and Integrations The Vulnerability Response application requires a supported third-party integration to import detection data. Supported integrations include: * Qualys Host Detection Integration * Rapid7 Data Warehouse and Vulnerable Item Resolution Integration (InsightVM) * Tenable Vulnerability Integration * Microsoft Defender Vulnerability Management These integrations are available via separate subscriptions on the ServiceNow Store and require configuration in your instance for data import. ## Key Concepts * **Vulnerability:** Weakness data imported from scanners and matched against CIs in the CMDB. * **Vulnerable Item (VI):** A record created or updated when a vulnerability matches a CI. * **Detection:** A distinct scanner-reported occurrence of a vulnerability, containing enriched data such as first/last found dates, IP address, port, and proof. Detections are displayed on both detection and VI records. * **Detection Key:** A hashed combination of fields used to uniquely identify and link detections to VIs. The fields vary by integration and scanner type. * **Deduplication:** The process of collapsing multiple detections into a single VI based on matching criteria. ## Handling Resolved and Closed Vulnerabilities Vulnerable items marked as Resolved but not transitioned to Closed or Fixed will be reopened if new detections are found during subsequent scans. Closed VIs with substates such as Fixed or Stale are also reopened if matching new detections occur. This ensures that your vulnerability records accurately reflect current scanner findings. For Rapid7 integrations, you can configure an option to reopen resolved VIs based on their age. For Qualys, VIs revert to Open if new detections have a last found date later than the Resolved date. ## Viewing Detection Data You can view imported detection data directly on the VI records within your ServiceNow AI Platform instance. This visibility helps you analyze vulnerability details and verify integration data on integration run records. View all of the information that is gathered by third-party scans in your ServiceNow AI Platform® instance. View the returned results of the scans on detection and vulnerable item (VI) records in your instance as these results are viewed on the scanners. ## Overview {#vr_host_detections__section_mtv_dk1_wkb} The Vulnerability Response application supports third-party Integrations that retrieve vulnerable item data from your enterprise environment. Detailed data about detections, that is, single, distinct occurrences of vulnerabilities as reported by the scanners of your third-party integrations, are imported and displayed on both the detection and the vulnerable item records in your ServiceNow AI Platform instance. Third-party Integrations retrieve vulnerable item detection data. Detections are distinct occurrences of vulnerabilities as reported by the scanners. Detection data are paired with vulnerable items and VI state is updated based on the state of the detections. If a VI is not found, a new one is created. Detections are only opened or closed by data found directly by a scanner. In previous versions of Vulnerability Response, vulnerable item detections, the relationship between a CI (asset) in your environment and an imported vulnerability from a third-party scanner, created a unique vulnerable item in your ServiceNow AI Platform instance. The granularity of the original data provided by the scanner is preserved. With detections, the detection data is paired with vulnerable items. During an ingestion, if a vulnerable item is not found, a new VI is created. Starting from version 21.1.2 of Vulnerability Response, a system property sn_vul.show_last_open_detection is provided in the base system. By default, the value of this property is set to false, and the current behavior of aggregating the values from the initial detection to the VI remains unchanged. However, if it is set to true, a VI is automatically updated with the last open detection after an ingestion. The fields such as IP address, SSL, Port, Protocol, NetBIOS, and Proof are updated for the VI detections. If needed, you can customize the detection fields that should be updated by modifying the DetectionBase script. To view the values for the last open detection, navigate to the Last Open Detection tab on the VI form view. To update all the VIs opened in the past year with the last open detection values, you can run the scheduled job Update Last Open Detection Value To VITs on-demand. This scheduled job is also provided in the base system. Note: When a configuration item (CI) changes on a discovered item, the corresponding updates are also reflected in the detections. As a result, the detections may be moved from one VI to another VI. Based on this change and the value of the sn_vul.show_last_open_detection property, the values of the detections are rolled up to the source and target VIs. ## Supported versions of Vulnerability Response {#vr_host_detections__section_t5s_br1_wkb} For more information about installing or updating the Vulnerability Response application, see [Install Vulnerability Response](https://www.servicenow.com/docs/qM8FLrUzwodKBxSptLwH3A "Before you run the Vulnerability Response application in your ServiceNow AI Platform instance, you must get entitlement and download the application from the ServiceNow Store, install it on your ServiceNow AI Platform instance, and activate it."). ## Supported third-party integrations {#vr_host_detections__section_ok4_5k1_wkb} A supported third-party integration with your Vulnerability Response application is required for vulnerable item detections. The following third-party integrations are supported by the Vulnerability Response application for vulnerable item detections: * Qualys Host Detection Integration * Rapid7 Data Warehouse: * Vulnerable Item Integration * Vulnerable Item Resolution Integration {#vr_host_detections__ul_fjw_1cc_wkb} * Rapid7  Vulnerable Item Resolution Integration (InsightVM) * Insight VM integration * Vulnerable Item Integration - API {#vr_host_detections__ul_wzt_pcc_wkb} * Tenable Vulnerability Integration * Microsoft Defender Vulnerability Management {#vr_host_detections__ul_vyf_4k1_wkb} These third-party integrations are available with a separate subscription from the ServiceNow Store. For more information about these integrations, see [Vulnerability Response integrations](https://www.servicenow.com/docs/mL4s4OXp~T5tbyCNd3o2EQ "Vulnerability Response includes support for third-party integrations. Included in this section are some basic guidelines for developing your own integrations.") and [Security Operations and the ServiceNow Store](https://www.servicenow.com/docs/ZtVWjwQgCFBPJF8J_uu3Aw "Starting with Madrid, all Security Operations applications and supported integrations are available for download from the ServiceNow Store. This allows you to obtain new and updated features more rapidly. Before you can use any Security Operations applications, you must verify that you have entitlement to them (that is, you have valid licenses to use them), download them from the ServiceNow Store, and activate them.") for more information about obtaining entitlement. To verify that your third-party scanner is configured for import, see [Install and configure the Rapid7 Integration for Security Operations application](https://www.servicenow.com/docs/rlL9uMZbIdEvRuxvw9E0FA "After you complete the set up steps for the integration so that it properly integrates with Vulnerability Response, get entitlements, download, and install the application on your ServiceNow AI Platform instance.") and [Install the Qualys Vulnerability Integration](https://www.servicenow.com/docs/oOiSN2nx1gh0TCMFmjKPfQ "Before you run the Qualys Vulnerability Integration in your instance, you must install and configure the Qualys Vulnerability Integration application. This application is available as a separate subscription."). ## Key terms for vulnerable item detections {#vr_host_detections__section_yvj_jl1_wkb} Vulnerability : Data about weaknesses in software, operating systems, and assets imported from internal and external sources. This data is imported and compared to existing assets (configuration items, CIs) listed in the CMDB. Vulnerable item : A vulnerable item is created or updated when an imported vulnerability matches a CI in the CMDB. Detection : A single, distinct occurrence of a vulnerability as reported by a scanner referred to as a Vulnerable Item Detection within the ServiceNow AI Platform environment. A detection includes enriched data about a vulnerability and any corresponding vulnerable items. This data is displayed on the Detection record (VID#) and the vulnerable item list view that includes the following details: * First found (data) * Last found (date) * DNS name * Net BIOSname * IP address * Port * Protocol * Proof * SSL * Times found {#vr_host_detections__ul_t3m_vl1_wkb} Note: Adding a business rule on the detection table will impact the performance of the ingestion. Detection key : A hashed combination of fields that provided a way to identify and tie a detection to a vulnerable item. Detection keys are integration-specific. {#vr_host_detections__table_prn_3y4_5pb__entry__7} | Scanner | Vulnerability | Port | Protocol | Asset ID | Proof | NIC | |-|-|-|-|-|-|-| | Qualys | Yes | Yes | Yes | Yes | No | NA | | Tenable | Yes | Yes | Yes | Yes | No | NA | | Rapid7 | Yes | Yes | Yes | Yes | Yes (it is not case sensitive) | Yes | [Table 1. Detection key configurations] {#vr_host_detections__table_prn_3y4_5pb} Note: * If the detection key is not specified, or for versions earlier than Vulnerability Response 14.0, the detection key is a combination of vulnerability entry, port, protocol, asset ID, and proof. * Starting with v19.0 of Vulnerability Response, a new detection key NIC is added for Rapid7 InsightVM, that is activated by default. Existing detections without NIC are updated with the first incoming NIC in the payload from Rapid7. The detection key is recalculated and repopulated on the detection including NIC. New detections are created if similar detections are seen with different NIC values. This data is not rolled up to the Vulnerable Item table. The NIC value is stored in a new column on the sn_vul_detection_key_config and sn_vul_detection table. {#vr_host_detections__ul_if4_hjb_fyb} De dup : The process used by the Vulnerability Response application of collapsing of individual detections into a single VI when the data meets certain hard-coded criteria. VI External ID : The value stored in the External ID field of the VI table. This value is a hash comprised of the combination of keys within a VI that represents what makes it unique within the application. It is composed of a CI and a vulnerable entry. ## Reopen resolved vulnerable items {#vr_host_detections__section_b3m_bg5_vlb} Vulnerable items set to Resolved in your ServiceNow AI Platform instance but not transitioned to Closed/Fixed by the subsequent integration runs are reopened if they are detected during rescans. Closed VIs with a substate of fixed or stale are reopened if a new detection is created and the VIs can be matched with the new vulnerability. As per the script include, DetectionBase, method _shouldReOpenVI(), if the VIT was earlier Closed with substate Fixed, Stale, or CI Decommissioned, it is reopened, and the detection is mapped to the existing VIT. For example, say a VIT's closed date is later than the last_found date of a detection. You would expect these VIT records to remain closed. However, if you see a previously closed VIT reopened, it means that the VIT was closed by an earlier detection and the vulnerability was found again in a later scan. When a new detection is found that matches the closed VIT that has the same vulnerability on the VIT's configuration item, the VIT is reopened. For Rapid7 detections, an option is now available on the Rapid7 configuration page in your instance to reopen resolved VIs by age. If enabled, VIs set to Resolved but then not transitioned to Closed/Fixed by subsequent scans transition back to Open after the number of days you enter. For Qualys detections, if the scanner continues to find VIs that were set to Resolved but then not transitioned to Closed/Fixed by subsequent scans, these VIs move back to Open when the last found date is later than the Resolved date. ## View detection data {#vr_host_detections__section_y4f_zm1_wkb} You view the data imported from vulnerable item detections on the VI record. For more information, see [View Vulnerability Response vulnerable item detection data](https://www.servicenow.com/docs/laWd6hHLL_bHE03iWhogPA "The complete data gathered by your third-party scanner integrations with Vulnerability Response are displayed on the Detections and Initial Detections tabs on the vulnerable item records (VIT). It is also displayed on Detection records on the Vulnerable Item Detection list in your ServiceNow AI Platform instance.") and [Verify Vulnerability Response vulnerable item detection data on integration run (VINTRUN) records](https://www.servicenow.com/docs/BEodPSInuDU8xOWsu~PVSQ "From integration run records in your ServiceNow AI Platform instance, you can locate third-party integration vulnerable item detection data based on the date and time of scans. Verify the scan successfully completed, view the number (counts) of individual detections, as well as any vulnerable items (VIs) that are created or updated directly as a result of the scans.").