Invicti Vulnerability Integration

  • Release version: Yokohama
  • Updated July 6, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Invicti Vulnerability Integration

    The Invicti Vulnerability Integration enables ServiceNow customers to import and manage application security data from the Invicti product within the ServiceNow AI Platform®. This integration supports multiple testing types—Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Interactive Application Security Testing (IAST), and Software Composition Analysis (SCA)—to provide a comprehensive view of application vulnerabilities. By integrating with ServiceNow’s Application Vulnerability Response feature, customers can efficiently prioritize and remediate flaws in their code.

    Show full answer Show less

    Key Features

    • Data Import and Mapping: Imports vulnerability scan data from Invicti into ServiceNow, mapping third-party vulnerability findings directly into the instance for actionable insights.
    • Integration Types: Supports both Enterprise (legacy) and Platform integrations, compatible with Unified Security Exposure Management (USEM) and non-USEM environments.
    • Chained Scheduled Jobs: Automates daily data synchronization through chained integration jobs that run sequentially to keep vulnerability data current, with options for manual execution.
    • Detailed Integration Components:
      • Platform Integrations: Include Application List (on-demand import of scanned applications), Scan Summary (automatically imports scan metadata), and Findings (imports detailed vulnerability findings).
      • Enterprise Integrations: Include Application List Import (links applications to discovered or scanned application tables based on system property settings), Scan List Integration (imports scan run times), and Vulnerable Item Integration (imports specific vulnerability details).
    • Configuration Flexibility: Allows configuration of CI lookup rules and system properties to define how applications and vulnerabilities link to configuration items or product models in ServiceNow.
    • Vulnerability Mapping: Vulnerabilities from Invicti are mapped with unique identifiers (e.g., Invicti-DirectoryListing) for clear identification within the ServiceNow instance.

    Practical Benefits for ServiceNow Customers

    • Enables seamless integration of Invicti scan data into ServiceNow for holistic vulnerability management.
    • Automates vulnerability data updates, reducing manual effort and improving data accuracy.
    • Supports enhanced prioritization and remediation workflows through enriched data on application vulnerabilities.
    • Facilitates flexible configuration to align with existing CMDB and vulnerability response processes.
    • Provides compatibility options to support both legacy and modern USEM architectures, allowing phased upgrades.

    The Invicti Vulnerability Integration uses application data imported from the Invicti product to help you determine the impact and priority of flaws in your code.

    Invicti Vulnerability Integration

    The Invicti Vulnerability Integration collects scanner data and makes that data available to the ServiceNow AI Platform®. It easily integrates with the ServiceNow® Application Vulnerability Response feature of Vulnerability Response to map imported third-party application vulnerability information into your instance.

    The integration imports the following types of scanned data.
    • Dynamic Application Security Testing (DAST)
    • Static Application Security Testing (SAST)
    • Interactive Application Security Testing (IAST)
    • Software Composition Analysis (SCA)

    For more information about DAST and IAST, see Exploring Application Vulnerability Response.

    Available versions

    Release version Release notes
    If you intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version starting with 30.x when installing or upgrading. Application Vulnerability Response release notes

    For compatibility information, see KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes
    If you don't intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version number below 30.x when installing or upgrading.

    Integrations

    The following integrations are included in the base system. The integrations are chained so that after one integration successfully completes, the next integration is initiated. The integrations run in the order listed in the following table.

    After the initial run, every day, scheduled jobs are chained to run these integrations automatically in order. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.

    Starting with version v30.2 (Unified Security Exposure Management (USEM)) and v2.0 (non-Unified Security Exposure Management (USEM)), the integrations are grouped under Enterprise and Platform types.

    All the integrations are compatible with legacy (non-Unified Security Exposure Management (USEM)) and Unified Security Exposure Management (USEM).

    • Enterprise - Legacy integrations import DAST, SAST, IAST, and SCA scanned data.
    • Platform - Integrate application vulnerabilities from Invicti for DAST, SAST, IAST, and SCA into a unified platform alongside infrastructure vulnerabilities, providing you with a comprehensive view of your security posture.
    The Platform Integrations are chained like the Enterprise integrations where the next integration in the chain runs after the successful completion of the proceeding integration. The sequence starts with the Application List integration, but the run type is on_demand.
    Table 1. Platform Invicti Vulnerability Integration integrations
    Integration Description
    Application List Initiate this integration on-demand. Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications.
    Scan Summary If configured and activated, this integration is initiated automatically after the Application List Integration is successfully completed. Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. Updates existing records or creates new ones.
    Findings If configured and activated, this integration is initiated after the Scan Summary Integration is successfully completed. Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®.
    Table 2. Enterprise Invicti application vulnerability integrations
    Integration Description
    Invicti Application List Application Imports applications scanned by Invicti into the Discovered Applications [sn_vul_app_release] table or the Scanned Application [sn_vul_app_scanned_application] table based on how the sn_vul.use_product_model system property is set for the configuration item (CI) lookup rule records.
    • If the product model property is set to true, an application is inserted in the Discovered Application release table. It links to a product model using product model lookup rules. If a model is not found, a model is created: a software model if a version is present in the import, and an application model if it's version agnostic.
    • If the product model property is set to false, it links to a CI via lookup rules. If lookup rules fail, then a Scanned Application record is created and inserted in the Scanned Application table.
    You can choose to activate lookup rules with configuration items (CIs) as the lookup targets by modifying the system property. If you modify it, you should also activate CI Lookup rules to match the lookup target. For more information, see:
    Invicti Scan List Integration This integration is initiated after the Application List Integration is successfully completed. This integration imports data about the date and time a scan was run.
    Invicti Application Vulnerable Item Integration This integration is initiated after the Scan List Integration is successfully completed.

    View details such as total processing times, average times for pre- and post-integration run processes, and reports on the integration run records for the Application Vulnerable Item integration.

    Each vulnerability in Invicti has a type, for example,DirectoryListing. This type is mapped as a unique ID in your instance and displayed as part of the value in the Vulnerability field on the application vulnerable item (AVI) record: Invicti-DirectoryListing.

    For more information about mapping, see Invicti Vulnerability Integration state mapping.

    The upper limit for items per page for all three integrations is 200.