---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Remediate

# Remediating Application Vulnerability Response vulnerabilities {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Remediating Application Vulnerability Response vulnerabilities

Monitoring and remediating Application Vulnerability Response (AVR) vulnerabilities is a manual, structured process that starts with reviewing the status of application vulnerable items (AVITs) and concludes with their closure once remediated.
The Zurich release of Application Vulnerability Response provides tools and procedures designed to enhance the efficiency and productivity of this remediation workflow.
Show full answer Show less  

## Key Features

* **Rule Validation:** Ensure Configuration Item (CI) Lookup and Assignment rules for AVITs are correctly configured to identify applications and assign remediation tasks automatically. Guidance is available for revising these rules to fit your environment.
* **Remediation Target Tracking:** Validate and manage remediation target rules linked to AVITs, which are applied when AVITs are imported. This helps track the remediation progress accurately.
* **Dashboards and Reporting:** Use built-in dashboards and reports to monitor AVIT aging and remediation status. Activating the Performance Analytics for Vulnerability Response application enables roles such as App-Sec Managers and Security Champions to access tailored dashboards, including the Application Vulnerability Response Overview and My Application Vulnerabilities dashboards, facilitating focused monitoring of vulnerabilities.
* **Risk and Assignment Management:** Review and update AVIT risks as necessary and reassign items to appropriate groups for remediation, ensuring prioritization and accountability.
* **Automated Rescanning and Closure:** Third-party vulnerability scans trigger automatic rescans. AVITs marked as Fixed are automatically closed upon import, while unresolved AVITs are reopened for further action.
* **Integration with Veracode:** For AVITs sourced from Veracode, detailed scan data including HTTP requests/responses and solution recommendations are accessible directly within the Application Vulnerable Item records and Vulnerability Response workspaces, enhancing insight into remediation actions.

## Practical Benefits

This remediation process enables ServiceNow customers to effectively monitor, prioritize, and remediate application vulnerabilities with clarity and control. The integration of automated rules, analytics dashboards, and third-party scan data helps streamline vulnerability management workflows, reduces manual effort, and improves response times, ultimately enhancing application security posture.  
Monitoring remediation is a process that begins with reviewing status and ends with closing application vulnerable items (AVITs). Application Vulnerability Response offers tools and procedures to make that process more productive and efficient.

## Application Vulnerability Response remediation process {#avm-monitor-rem-prog__section_jk2_s4q_2db}

Application vulnerable item remediation is done manually.  
An overview of the process:

* Log in to your Application Vulnerability Response instance.
* Validate that your rules (CI Lookup, Assignment) for application vulnerable items are working as expected. For information on revising CI Lookup Rules, see [Identify applications in Application Vulnerability Response automatically](https://www.servicenow.com/docs/mle0HcQSM53kyTnOk0RriQ "When data is imported from a third-party integration, Application Vulnerability Response automatically uses application data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. These rules identify applications for the application vulnerable item (AVI) record to aid in remediation."). For information on Assignment rules, see [Assign application vulnerable items in Application Vulnerability Response automatically](https://www.servicenow.com/docs/flCe81nQEhPKp4uC8EaWFg "Automatically assign application vulnerabilities based on application tags, or any of the assignment groups in the Configuration Item [cmdb_ci] or platform assignment groups, to reduce the mean time to assignment.").
* Validate that your remediation targets are correct. See [Automate remediation target tracking in Application Vulnerability Response](https://www.servicenow.com/docs/0l27GSEJdAMDWeHDvWeWGw "Application Remediation Target Rules define the expected timeframe for remediating application vulnerable items (AVIs), providing a timeframe for remediating the vulnerability itself. For example, if an application vulnerable item contains a critical risk rating then the vulnerability on that item needs to be fixed within 15 days.") for information on how remediation target rules work and how to revise them. [View the remediation target status of an application vulnerable item](https://www.servicenow.com/docs/QXrdB3XzisGJFr4ulHqYnw "When an application vulnerable item (AVI) has nearly reached (or passed) its remediation target date, as defined by a remediation target rule, the AVI record is updated with a status. This information can help you proactively monitor upcoming remediation activities.").  
  Note:  
  Remediation target rules belong to AVITs. These rules are run when the AVIT is imported.
* Review the dashboards or reports. For example, view dashboards that show AVITs aging by states.  
  Note:  
  When the Performance Analytics for Vulnerability Response application (com.snc.vulnerability.analytics) is activated, users with certain roles can view data of interest to the members of the App-Sec Manager and Security Champion groups.

  For App-Sec Managers, Performance Analytics for Vulnerability Response contains the Application Vulnerability Response Overview, which can help you monitor areas of concern. See [Analytics and Reporting Solutions for Application Vulnerability Response](https://www.servicenow.com/docs/v8yhIevrIHIWlyGUwuvgvQ "Platform Analytics Solutions contain prepackaged Platform Analytics content for use with other ServiceNow AI Platform products. This Platform Analytics Solution presents important metrics for analyzing your Application Vulnerability Management process.") and [Application Vulnerability Management \[PA\] dashboard](5XamHcPX0nWEHACT5yeUGg "Track the volume, performance and progress of application vulnerabilities from initial analysis and detection to containment or remediation.").

  Starting with version 13.0 of the Vulnerability Response application: For Security Champions, Performance Analytics for Vulnerability Response contains the My Application Vulnerabilities dashboard, which can help you monitor your areas of concern. See [My Application Vulnerabilities dashboard](https://www.servicenow.com/docs/ulAi_zgok8BlD76PEg02Yw "This dashboard presents important metrics for analyzing your Application Vulnerability Management process, such as viewing remediation target attainment rates.").

  Starting with version 13.0 of the Vulnerability Response application: To limit the amount of data gathered for reports or related lists, see [Define service classifications for Vulnerability Response reporting and related lists](https://www.servicenow.com/docs/nzIPoi6ien2BRWnDYvP7Vw "Bring more focus to reporting and related lists in Vulnerability Response by defining service classifications. In addition, reducing the number of requested service classifications can improve the performance of Vulnerability Response data gathering.").
* Review the state of AVITs, in order of priority, searching for what has changed.
* Revise the risk for the AVITs, as needed. See [Create an application vulnerability calculator](https://www.servicenow.com/docs/xv2OfMWlShMbD_VVSY7UcQ "An application vulnerability calculator is a pre-defined formula to calculate a target field when certain criteria are met. Calculators, which calculate the application vulnerable item (AVI) Risk Score, can contain Risk Rules. Risk calculations offer insight in prioritizing remediation.") for more information.
* Reassign the AVIT to an assignment group for remediation, if needed.
* Rescans are triggered automatically by the third-party import schedule.
* After rescan, if the state is Fixed, AVITs are automatically closed during import.
* After the scan, if the state is not Fixed, the AVIT is reopened.
{#avm-monitor-rem-prog__ul_ng1_dy2_ycb}

## Get more details from Veracode {#avm-monitor-rem-prog__section_epw_wbf_dbc}

Select Get More Details on application vulnerable items (AVITs) that have Veracode as the Source on the Application Vulnerable Item \[sn_vul_app_vulnerable_item\] table or from the list views in the Vulnerability Response Workspaces to view the following Veracode data.

* HTTP Source request and Source response details for Dynamic Application Security Testing (DAST) scans are displayed on the HTTP Request/Response related list.
* Solution recommendations from Veracode are displayed on the Findings related list.
* HTTP Source request, Source response, and recommendations are displayed on the Details tab In the Vulnerability Response Vulnerability Response workspaces.
* The Description column is supported on the Application Vulnerable Item \[sn_vul_app_vulnerable_item\] table.
{#avm-monitor-rem-prog__ul_k1l_hcf_dbc}