--- sourceDocument: zurich Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/delta-yokohama-zurich Release : - zurich ft:locale : - en-US ft:publication_title : - zurich Combined Product Files ft:clusterId : - delta3zy bundleId : - delta3zy --- # Combined Configuration Compliance release notes for upgrades from Yokohama to Zurich # Combined Configuration Compliance release notes for upgrades from Yokohama to Zurich {#ariaid-title1} Release version: Zurich Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 13 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Configuration Compliance release notes for upgrades from Yokohama to Zurich This document consolidates all release notes for the Configuration Compliance application to assist ServiceNow customers upgrading from the Yokohama release to the Zurich release. It covers important upgrade information, new features, changes, deprecations, activation instructions, and additional requirements, providing a comprehensive guide to prepare for and understand the enhancements in Zurich. Show full answer Show less ## Important Upgrade Information * If you are upgrading Configuration Compliance but not moving to Unified Security Exposure Management (USEM), install versions below v30.x and use supported third-party integrations. * The **Missing Assets \[snvulwizmissingasset\]** table used by Vulnerability Response Integration with Wiz is deprecated. After upgrading to version 1.1, backdate existing Wiz primary integrations by three days and run them to ensure data consistency. * Refer to the Vulnerability Response Compatibility Matrix and Release Schema Changes for detailed compatibility and version information. ## New Features * **Wiz Integration Enhancements:** * Identify and select Wiz resource types to import across primary vulnerability and compliance integrations (except Wiz Container Vulnerability Integration). * Activate default Wiz Backfill Integrations to process missing assets not handled by primary integrations. * Import test results associated with virtual machines via the Wiz Host Test Result Vulnerability Integration. * **Manual Remediation Task Creation:** Users with `snvulc.admin` or `snvulc.remediationowner` roles can manually create remediation tasks from Configuration Test Results in Vulnerability Manager and IT Remediation Workspaces, grouping records by chosen criteria. * **Risk Score Change Visibility:** Optionally enable the system property `snseccmn.riskscorechangesaddworknotes` to track risk score changes in the Work notes section of test results. * **Remediation Task Rule Execution Modes:** Choose between *Match First* mode (applies only the first matching rule per finding) or the default *Match All* mode during ingestion. * **Optimized Tenable.io Compliance Results Ingestion:** The older integration is replaced with separate Fixed and Open Compliance Results integrations to optimize ingestion performance and scalability. * **Unified Microsoft Defender Integration:** Combines Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management plugins into one, adding container image vulnerability ingestion and providing a guided migration path. * **Qualys Integration API Upgrades:** Supports newer API versions, enhanced data fields ingestion, and allows selection between v2.0 and v5.0 API streaming modes for PCRS Policy Host and Test Results. * **Configure Test Result Granularity:** Starting with versions 15.4.3 (Qualys) and 15.6.1 (Tenable), split configuration test results into unique findings for improved visibility at the instance level. * **Related Lists Row Limit:** System property `snvulcmn.relatedlist.setmaxrow` controls the maximum number of rows shown in related lists to improve performance and readability. * **State Management Enhancements:** Improved logic for state roll-up and roll-down between remediation tasks and findings enhances accuracy, reduces manual effort, and streamlines workflows. * **Qualys Parameter to Ignore Passed Results:** New integration parameter `ignorepassedresult` lets you exclude passed test results from import, helping focus on current issues without affecting closure of existing results. ## Changes and Deprecations * The **Missing Assets \[snvulwizmissingasset\]** table is deprecated; backfill integrations now handle missing assets by default. * The `isignored` column in Host Test Results and Test Results integrations is replaced by `isresultignored`. * Source severity is now mapped to the Priority column on the Test Results \[snvulcresult\] table. * Resource type filters are configurable on the Wiz Configuration page, with integration instance settings taking precedence. * Descriptions column length increased for Host Vulnerability import table. * Deprecated standalone Microsoft Defender for Cloud plugin; migrate to the unified Microsoft Defender Integration. * Deprecated Tenable.io Compliance Results Integration replaced by two optimized integrations. ## Activation and Additional Requirements * Configuration Compliance and related third-party integrations are installed via the ServiceNow Store; request access accordingly. * No additional browser or accessibility requirements changes noted for Zurich beyond the introduction of the Coral theme with a dark mode option to enhance usability. ## Practical Guidance for ServiceNow Customers * Before upgrading, review and complete all pre- and post-upgrade tasks specified to ensure a smooth transition. * Utilize new manual remediation task creation capabilities to gain better control over remediation workflows. Consolidated page of all release notes for Configuration Compliance from Yokohama to Zurich. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Configuration Compliance release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Configuration Compliance to Zurich Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-configurationcompliance-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Upgrade information : If you are currently using Configuration Compliance, and you do not intend to upgrade to Unified Security Exposure Management (USEM), install a version below v30.x of Configuration Compliance and for upgrades to supported third-party integration applications. The Missing Assets \[sn_vul_wiz_missing_asset\] table used for storing assets imported by the backfill integrations for the [Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) is deprecated. If you are currently using the Vulnerability Response with Wiz integrations, after updating to version 1.1, you must backdate any of your existing Wiz primary integrations by three days and run them. Please review more information about the Wiz integration at [SecOps articles on the Security Operations Community](https://www.servicenow.com/community/secops-articles/announcement-wiz-integration-with-servicenow-secops/ta-p/3325055). For more information about the released versions of the Vulnerability Response application as well as the third-party and ServiceNow applications that are compatible with the Zurich release, see the [Vulnerability Response Compatibility Matrix and Release Schema Changes \[KB0856498\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0856498) article in the Now Support Knowledge Base. | [ ] ## New features Between your current release family and Zurich, new features were introduced for Configuration Compliance. {#dfrn3-configurationcompliance-summary__entry__8} | Release | Release notes | |-|-| | Yokohama | [Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=yokohama&ft:locale=en-US) : Identify the Resource Types (assets) reported by Wiz in your environment on the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance that you want to import. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. [Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=yokohama&ft:locale=en-US) : Retrieve and process data stored on the Wiz Missing Assets \[sn_vul_wiz_missing_asset\] table for missing assets that were not processed by the primary compliance integrations with specialized Wiz Backfill Integrations. * Test Results Backfill Integration * Host Test Results Backfill Integration * Issues Backfill Integration The Wiz Backfill Integrations are activated by default. [Wiz Host Test Result Vulnerability Integration](https://www.servicenow.com/docs/access?context=wiz-host-test-result-tab-filters&family=yokohama&ft:locale=en-US) : Import test results associated with the resource type, VIRTUAL MACHINE with the Wiz Host Test Result Vulnerability Integration. This integration is activated by default. [Create remediation tasks manually in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/access?context=vmws-create-remediation-task&family=yokohama&ft:locale=en-US) : With the sn_vulc.admin role, you can create remediation tasks manually by selecting some or all the records in the Configuration Test Results lists in the Vulnerability Manager Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating remediation tasks. [Create remediation tasks manually in the IT Remediation Workspace](https://www.servicenow.com/docs/access?context=itr-ws-create-remediation-task&family=yokohama&ft:locale=en-US) : With the sn_vulc.remediation_owner role, you can create remediation tasks manually by selecting desired records in the Configuration Test Results lists in the IT Remediation Workspace. These records are grouped into one or more remediation tasks according to the grouping criteria selected while creating remediation tasks. [View risk score details of a test result in the Work notes section](https://www.servicenow.com/docs/access?context=config-compliance-calculator-rules&family=yokohama&ft:locale=en-US) : Starting with v15.2.1 of Configuration Compliance, the system property sn_sec_cmn.risk_score_changes_add_worknotes is inactive by default. If you enable it, only then you can see all the changes related to the risk score of a test result in the Work notes section. Additionally, the work notes are updated only if there's a change in the risk score. [Quick Start Tests for Configuration Compliance](https://www.servicenow.com/docs/access?context=available-quick-start-tests&family=yokohama&ft:locale=en-US) : After upgrades and deployments of new applications or integrations, run quick start tests to verify that Configuration Compliance works as expected. If you customized Configuration Compliance, copy the quick start tests and configure them for your customizations. | | Zurich | [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US) : You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US) : Starting with v 6.1.3, the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. [Unified Microsoft Defender Integration for Security Exposure Management](https://www.servicenow.com/docs/access?context=ms-defender-sem&family=zurich&ft:locale=en-US) : The Microsoft Defender for Cloud and Microsoft Defender Threat and Vulnerability Management (MS TVM) plugins are now consolidated into a single plugin: Microsoft Defender Integration for Security Exposure Management. This consolidation deprecates the standalone Microsoft Defender for Cloud plugin. The unified plugin also introduces container image vulnerability ingestion from Microsoft Defender for Cloud, creating Container Vulnerable Items on your instance. A guided migration path is available to transfer existing data from the deprecated applications to the unified plugin. [Qualys Integration -- API enhancements](https://www.servicenow.com/docs/access?context=qualys-rest-messages-cc&family=zurich&ft:locale=en-US) : Qualys Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. Use the new `posture_api_version` integration instance parameter to choose between the default v2.0 APIs or the newer v5.0 streaming APIs for the PCRS Policy Host and PCRS Test Results integrations. [Enhancements to the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) : The Missing Assets \[sn_vul_wiz_missing_asset\] is deprecated. After updating to version 1.1, you must backdate your existing primary Wiz integrations by three days and run them. The backfill integrations are activated by default. After you backdate and run your integrations, the following backfill integrations are no longer required: * Host Vulnerability Backfill Integration * Test Results Backfill Integration * Host Test Results Backfill Integration * Issues Backfill Integration The \[is_ignored\] column is deprecated for the Host Test Results and Test Results Integrations. This column was replaced by the \[is_result_ignored\] column. Source severity is mapped to the Priority column on the Test Results \[sn_vulc_result\] table. Resource type filters are on the Test Results, Issues, and Host Test Results configuration tabs on the Wiz Configuration page. You can add any of the resource types listed. Note: If you configure resource types on the Resource Type Configuration tab, and you choose to configure parameters on the integration instance records, your configurations on integration instance take precedence over your settings on the Resource Type Configuration tab. See [Identify Wiz Resource types](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=zurich&ft:locale=en-US) for more information. Additional attributes imported from Wiz that are not stored in the Discovered items \[sn_sec_cmn_src_ci\] table are stamped with Asset Attributes in this table. Test results from the Host misconfiguration integration are classified as result type 'host_misconfiguration'. Data for resources that have the validated_at_runtime flag set to 'yes' is imported and populated on detections. The is_ignored column is deprecated on the Host Test Results and Test Results Integrations. This column was replaced by the is_result_ignored column. The CMDB internet-facing field on the discovered item is mapped to Limited Internet Exposure on findings. Column length for the descriptions in the Host Vulnerability import table has been increased. [Identify Wiz Resource Types for import](https://www.servicenow.com/docs/access?context=wiz-assets-resources-tab&family=zurich&ft:locale=en-US) : Identify the Resource Types (assets) reported by Wiz in your environment on the Wiz Integration Resource Type configuration page in your ServiceNow AI Platform instance that you want to import. The Resource Types that you select apply to all the primary Wiz vulnerability and compliance integrations except the Wiz Container Vulnerability Integration. [Wiz Backfill Integrations](https://www.servicenow.com/docs/access?context=wiz-backfill&family=zurich&ft:locale=en-US) : Retrieve and process data stored on the Wiz Missing Assets \[sn_vul_wiz_missing_asset\] table for missing assets that were not processed by the primary compliance integrations with specialized Wiz Backfill Integrations. * Test Results Backfill Integration * Host Test Results Backfill Integration * Issues Backfill Integration The Wiz Backfill Integrations are activated by default. [Wiz Host Test Result Vulnerability Integration](https://www.servicenow.com/docs/access?context=wiz-host-test-result-tab-filters&family=zurich&ft:locale=en-US) : Import test results associated with the resource type, VIRTUAL MACHINE with the Wiz Host Test Result Vulnerability Integration. This integration is activated by default. [Qualys parameter to ignore passed test results](https://www.servicenow.com/docs/access?context=Qualys-cc-Integration&family=zurich&ft:locale=en-US) : Starting with v15.2.5 of Configuration Compliance, the ignore_passed_result integration instance parameter for the Qualys Integration for Security Operations has been added. This parameter is set to false by default so that passed test results imported by Qualys are not ignored. Set the parameter to true to ignore passed test results on import. Note: If activated, this parameter does not impact closure of the test results. For example, if you activate the parameter, and a failed test result from a previous import has since passed, it will be closed correctly. [The Wiz Configuration Compliance (Test Results) and Issues Integrations](https://www.servicenow.com/docs/access?context=vr-wiz-exploring-host-cf&family=zurich&ft:locale=en-US) : * Import configuration test results with the Wiz Configuration Compliance Integration (Wiz Test Results) to detect non-compliant cloud configurations. Findings are mapped to cloud test results (CTRs) in the Configuration Compliance application to help you enforce security policies and standards across your cloud environment. * Import data with the Wiz Issues Integration that can help you identify assets that are involved in toxic combinations of vulnerabilities and misconfigurations. These findings are also mapped to CTRs with Wiz Issues labeled as the source to help you track and remediate assets that may pose complex multi-vector risks. | [ ] ## Changes Between your current release family and Zurich, some changes were made to existing Configuration Compliance features. {#dfrn3-configurationcompliance-summary__entry__14} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | [Remediation task rule execution mode](https://www.servicenow.com/docs/access?context=sem-grouping-multiple-findings-remediation-tasks-processing&family=zurich&ft:locale=en-US) : You can now choose how remediation task rules are evaluated during ingestion. The new Match First execution mode evaluates rules sequentially and applies only the first matching rule, assigning each finding to exactly one remediation task. The default Match All mode continues to evaluate all applicable rules. [Optimized Tenable.io Compliance Results ingestion](https://www.servicenow.com/docs/access?context=tenable-io-integrations-list&family=zurich&ft:locale=en-US) : Starting with v\[VERSION\], the Tenable.io Compliance Results Integration is replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. Optimized Tenable.io Compliance Results ingestion : Starting with v\[VERSION\], the Tenable.io Compliance Results Integration is deprecated and replaced by the Tenable.io Fixed Compliance Results Integration and Tenable.io Open Compliance Results Integration. Compliance results are now imported based on their status, optimizing ingestion performance and scalability for environments with large volumes of compliance data while keeping remediation and compliance tracking aligned with the current state of findings. [Qualys Integration -- API enhancements](https://www.servicenow.com/docs/access?context=qualys-rest-messages-cc&family=zurich&ft:locale=en-US) : Qualys Integration has been upgraded to support newer Qualys API versions across Host Detection, Host List, Knowledgebase, PC Controls, PC Policies, and PCRS integrations. The integrations now ingest additional data fields, including vulnerability detection source, authentication privilege status, active status for controls and policies, and cloud metadata, giving you better visibility into your vulnerability and compliance data. Use the new `posture_api_version` integration instance parameter to choose between the default v2.0 APIs or the newer v5.0 streaming APIs for the PCRS Policy Host and PCRS Test Results integrations. [Configure Test Result Granularity](https://www.servicenow.com/docs/access?context=cc-tenable-tr-granularity&family=zurich&ft:locale=en-US) : Starting with v15.6.1, you can configure the granularity of Tenable Configuration Test Results (CTRs) to split results into unique findings. For example, if a database has five instances, the system generates five distinct test results, one per instance, providing improved visibility into individual patching efforts. [Configure Test Result Granularity](https://www.servicenow.com/docs/access?context=cc-qualys-tr-granularity&family=zurich&ft:locale=en-US) : Starting with v15.4.3, you can configure the granularity of Qualys Configuration Test Results (CTR) in configuration compliance and split CTRs into unique findings. For example, if a database has five instances, the system generates five distinct test results, one per instance, providing improved visibility into individual patching efforts. [Configure maximum rows in related lists](https://www.servicenow.com/docs/access?context=vr-max-rows-rel-list&family=zurich&ft:locale=en-US) : To improve readability and performance, you can now limit the number of rows shown in related lists on forms by setting the system property sn_vul_cmn.related_list.set_max_row. [Improved state management for remediation tasks and vulnerable items](https://www.servicenow.com/docs/access?context=vr-rt-states&family=zurich&ft:locale=en-US) : State management logic for roll down of state from remediation tasks (RTs) to findings and roll up of state from findings to RTs has been refined across all modules. Updates improve accuracy by handling mixed item states (a combination of Deferred and Closed), supporting closure of tasks in sub-states like In-Review, and reopening tasks based on the Assigned To field. The update also improves handling of False Positive state transitions based on scanner results as source of truth. These enhancements reduce manual effort, clarify task ownership, and streamline remediation workflows. | [ ] ## Removed Between your current release family and Zurich, some Configuration Compliance features or functionality were removed. {#dfrn3-configurationcompliance-summary__entry__20} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Deprecations Between your current release family and Zurich, some Configuration Compliance features or functionality were deprecated. {#dfrn3-configurationcompliance-summary__entry__26} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Activation information Review information on how to activate Configuration Compliance. {#dfrn3-configurationcompliance-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | Activation information : Install Configuration Compliance by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Configuration Compliance is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install Configuration Compliance and third-party integrations by requesting them from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: Configuration Compliance is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Configuration Compliance we have noted them here. {#dfrn3-configurationcompliance-summary__entry__38} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Configuration Compliance we have noted them here. {#dfrn3-configurationcompliance-summary__entry__44} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Configuration Compliance, such as specific requirements or compliance levels. {#dfrn3-configurationcompliance-summary__entry__50} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | Accessibility information : Dark theme : The new Coral theme includes a dark theme option for web and mobile experiences. This option is commonly used to alleviate eye strain and improve readability. | [ ] ## Localization information If there are specific localization considerations for Configuration Compliance we have noted them here. {#dfrn3-configurationcompliance-summary__entry__56} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Configuration Compliance we have noted them here. {#dfrn3-configurationcompliance-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | * With the sn_vulc.admin role, create remediation tasks manually in the Vulnerability Manager Workspace. * With the sn_vulc.remediation_owner role, create remediation tasks manually in the IT Remediation Workspace. See [Configuration Compliance](https://www.servicenow.com/docs/access?context=vr-config-compliance-landing&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * If you are currently using Configuration Compliance and you want to upgrade to Unified Security Exposure Management (USEM), see [Unified Security Exposure Management release notes](https://www.servicenow.com/docs/access?context=secops-sem-rn&family=zurich&ft:locale=en-US) for more information about USEM and the Unified Security Exposure Management migration. * Import Wiz issues and configuration test results from the Wiz scanners into test results in the Configuration Compliance application with the Vulnerability Response Integration with Wiz. * With the sn_vulc.remediation_owner role, create remediation tasks manually in the IT Remediation Workspace. * With the sn_vulc.admin role, create remediation tasks manually in the Vulnerability Manager Workspace. See [Configuration Compliance](https://www.servicenow.com/docs/access?context=vr-config-compliance-landing&family=zurich&ft:locale=en-US) for more information. | [ ]