Components installed with Application Vulnerability Response
Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs.
Starting with v24.0.6 of Application Vulnerability Response, the most frequently used system properties are now accessible within the Application Vulnerability Response application. To view these system properties, navigate to AllApplication Vulnerability ResponseProperties.
Note: The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see Find components installed with an application.
Demo data is available for this feature.
Roles installed
Granular roles in Application Vulnerability Response are assigned to specific User Groups, by default.
Note: Using granular roles outside these user groups requires coding and advanced Application Vulnerability Response or ServiceNow expertise.
|
Role title [name] |
Description |
Contains roles |
|---|---|---|
|
V20.0: sn_vul.app_manage_auto_exception_rule |
Create, update, delete, and cancel (deactivate) exception rules. |
sn_vul.app_read_auto_exception_rule |
|
sn_vul.app_manage_group_rules |
Read, write, delete, and all operations on application remediation task rules. |
|
|
V20.0: sn_vul.app_exception_approver |
Approves exception rules and exception rule extension requests.Starting from v20.0, the granular role, sn_vul.app_read_all, has been removed for this role so that you can access the application vulnerable items and remediation tasks assigned to you and your group instead of all the application vulnerable items and remediation tasks. |
|
|
sn_vul.app_false_positive_approver |
Approves or rejects false positive requests. |
sn_vul.view_manager_workspace |
|
sn_vul.app_read_assigned |
View application vulnerable items (AVIs) assigned to you either in both the Classic UI and IT Remediation Workspace.Important: Starting with v24.0 of Vulnerability Response, the sn_vul.app_read_assigned role has the privilege to access the IT Remediation Workspace. |
sn_vul.view_rem_workspace |
|
sn_vul.app_read_all |
View all AVIs and related information either in the Classic UI or Vulnerability Manager Workspace.Important: Starting with v24.0 of Vulnerability Response, the sn_vul.app_read_all role has the privilege to access the Vulnerability Manager Workspace. |
sn_vul.view_manager_workspace |
|
sn_vul.app_write_assigned |
Update AVIs assigned to you. |
|
|
sn_vul.app_write_all |
Update all AVIs and related information. |
|
|
sn_vul.app_update_assignment_group |
Update AVI Assignment group. |
Note: When used outside of the default user group requires sn_vul.app_write_all or sn_vul.app_write_assigned. |
|
sn_vul.app_update_assigned_to |
Update AVI assignee. |
Note: When used outside of the default user group requires sn_vul.app_write_all or sn_vul.app_write_assigned. |
|
sn_vul.app_configure_integrations |
Configure third-party integrations. |
sn_vul.app_read_all sn_vul.app_read_integrations sn_sec_int.admin sn_vul_veracode.configure_integration sn_vul.configure_nvd_administration Note: To define or edit an App-Sec Manager user group by single or specific integrations, see Vulnerability Response personas and granular roles. |
|
sn_vul.app_read_integrations |
View all third-party integrations. |
|
|
sn_vul_veracode.configure_integration |
Define, update, and delete Veracode integrations. |
|
|
sn_vul.app_manage_assignment_rules |
Define, update, and delete AVI assignment rules. |
sn_vul.app_read_all sn_vul.app_read_assignment_rules |
|
sn_vul.app_read_assignment_rules |
View assignment rules. |
|
|
sn_vul.app_manage_remediation_target_rules |
Define, update, and delete AVI remediation target rules. |
sn_vul.app_read_all sn_vul.app_read_remediation_target_rules |
|
sn_vul.app_manage_risk_score_configurations |
Define, update, and delete AVR calculators and risk rules. |
sn_vul.app_read_all sn_vul.app_read_risk_score_configuration sn_sec_cmn.calc.write |
|
sn_vul.app_read_risk_score_configuration |
View AVR calculators and risk rules. |
|
|
sn_vul.app_manage_applications |
View, update, and delete application records. |
|
|
sn_vul.app_manage_app_sc |
Gives a Security Champion the ability to add or remove themselves from the Scanned Application related list. |
|
|
sn_vul.app_pa_sc_view |
Provides relevant view to the specific Security Champion. |
|
|
sn_vul.app_manage_app_vul_permissions |
[internal] Used by sn_vul.app_manage_applications. |
|
|
sn_vul.app_manage_normalized_severity |
Update mapping to normalized severity. |
sn_vul.app_read_normalized_severity |
|
sn_vul.app_read_normalized_severity [Removed in v12.1. Don’t use.] |
View normalized severity records. |
|
|
sn_vul.app_read_application_release |
View application release records. |
|
|
sn_sec_int.admin |
Provides access to integrations. |
|
|
pa_power_user |
Provides access to reports |
pa_viewer |
|
sn_vul.app_sec_manager |
Prioritizes and manages application vulnerable items. |
|
|
sn_vul.app_developer |
Developer responsible for fixing the application vulnerabilities. |
|
|
sn_vul.app_create_watch_topic |
Create Watch Topics for application vulnerabilities. |
|
|
sn_vul.app_read_watch_topic |
Read Watch Topics for application vulnerabilities. |
|
|
sn_vul.app_edit_watch_topic |
Edit Watch Topics for application vulnerabilities. |
|
|
sn_vul_blackduck.configure_integration |
Configure third-party integrations. |
sn_vul_blackduck.configure_integration |
For Vulnerability Response shared scheduled jobs see, Components installed with Vulnerability Response.
|
Scheduled job |
Description |
|---|---|
|
Associate existing AVIs with Auto Exception Rule |
Evaluates application vulnerable items for matches to exception rules. |
|
Populate Entry and CVE M2M |
Makes existing records consistent with multiple CWE records. Run once after upgrade to populate then disable. |
|
Resync primary CWE |
For customized primary CWE calculations. Run once after upgrade to resync then disable. |
|
Rollup application vulnerable item values to vulnerability and group |
Calculates vulnerabilities and group roll ups for application vulnerable items.Note: Starting with v23.0 of Application Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task. |
|
Black Duck Project List Integration |
Pulls and ingests data into the Black Duck projects table. |
|
Black Duck Application List Integration |
Imports applications into discovered applications table for all the project versions available with Black Duck Integration in projects table. |
|
Black Duck Application Vulnerable Item Integration |
Ingests vulnerable items into ServiceNow application based on the vulnerabilities detected by scanners for every discovered application in the system. |
|
Table |
Description |
|---|---|
|
Application Release[sn_vul_app_release] |
Contains application version information. |
|
Version 13.0: Application Security Champions [sn_vul_app_m2m_app_sc] |
Contains the Application Vulnerability Response Security Champion group records. |
|
Application Vulnerability Entry[sn_vul_app_vul_entry] |
Contains application vulnerability entries. |
|
Application Vulnerability Integration [sn_vul_app_integration] |
Contains Application Vulnerability Response integration records. |
|
Application Vulnerability Scan Location[sn_vul_app_vul_scan_location] |
Contains third-party scan location information. |
|
Application Vulnerability Scan Summary[sn_vul_app_vul_scan_summary] |
Contains third-party scan summary information. |
|
Application Vulnerable Item[sn_vul_app_vulnerable_item] |
Contains AVI records. Starting with v19.0, the following columns are added for Software Bill of Materials:
|
|
Scanned Application[sn_vul_app_scanned_application] |
Contains application information. |
|
State Map[sn_vul_app_state_map] |
Contains state mapping from third-party integrations to application vulnerable item (AVI) states. |
|
Vulnerability CWEs[sn_vul_m2m_entry_cwe] |
Links CVE data to application vulnerable entries. |
|
Application Remediation Task Manifestsn_vul_app_rt_manifest |
Any updates on remediation task are done by using this manifest table by scheduled jobs. |
|
Application Remediation Task sn_vul_app_vulnerability |
Contains application remediation tasks. |
|
Application Remediation Task Itemsn_vul_app_m2m_vul_group_item |
M2M table between AVI and application remediation tasks. |
|
Version 21.0:Application Vulnerable Items sn_vul_app_vulnerable_item |
Contains AVI records. |
|
Version 21.0: Package [sn_vul_app_package] |
Contains application package details. |
|
Version 21.0:Licenses sn_vul_app_license |
Contains application licenses. |
|
Version 21.0:Application Remediation Tasks sn_vul_app_vulnerability |
Contains application remediation tasks. |
|
sn_vul_blackduck_config |
Contains Black Duck integration configuration details. |
|
sn_vul_blackduck_project |
Contains details of the projects coming from Black Duck. |
|
sn_vul_blackduck_project_import |
Import set table for the Black Duck project ingestion. |
|
sn_vul_blackduck_app_import |
Import set table for the Black Duck application ingestion. |
|
sn_vul_blackduck_avit_import |
Import set table for the Black Duck AVIT ingestion. |
--- title: Components installed with Application Vulnerability Response description: Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/installed-with-avm.html release: australia product: Application Vulnerability Response classification: application-vulnerability-response topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 5 breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Components installed with Application Vulnerability Response Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs. Starting with v24.0.6 of Application Vulnerability Response, the most frequently used system properties are now accessible within the Application Vulnerability Response application. To view these system properties, navigate to **All**Application Vulnerability Response**Properties**. **Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md). Demo data is available for this feature. ## Roles installed Granular roles in Application Vulnerability Response are assigned to specific User Groups, by default. **Note:** Using granular roles outside these user groups requires coding and advanced Application Vulnerability Response or ServiceNow expertise. <table id="table_u1t_gb1_wdb"><thead><tr><th> Role title \[name\] </th><th> Description </th><th> Contains roles </th></tr></thead><tbody><tr><td> V20.0: sn\_vul.app\_manage\_auto\_exception\_rule </td><td> Create, update, delete, and cancel \(deactivate\) exception rules. </td><td> sn\_vul.app\_read\_auto\_exception\_rule </td></tr><tr><td> sn\_vul.app\_manage\_group\_rules </td><td> Read, write, delete, and all operations on application remediation task rules. </td><td> - sn\_vul.app\_read\_all - sn\_vul.app\_read\_group\_rules </td></tr><tr><td> V20.0: sn\_vul.app\_exception\_approver </td><td> Approves exception rules and exception rule extension requests.Starting from v20.0, the granular role, sn\_vul.app\_read\_all, has been removed for this role so that you can access the application vulnerable items and remediation tasks assigned to you and your group instead of all the application vulnerable items and remediation tasks. </td><td> - sn\_vul.app\_read\_auto\_exception\_rule - sn\_vul.view\_manager\_workspace </td></tr><tr><td> sn\_vul.app\_false\_positive\_approver </td><td> Approves or rejects false positive requests. </td><td> sn\_vul.view\_manager\_workspace </td></tr><tr><td> sn\_vul.app\_read\_assigned </td><td> View application vulnerable items \(AVIs\) assigned to you either in both the Classic UI and IT Remediation Workspace.**Important:** Starting with v24.0 of Vulnerability Response, the sn\_vul.app\_read\_assigned role has the privilege to access the IT Remediation Workspace. </td><td> sn\_vul.view\_rem\_workspace </td></tr><tr><td> sn\_vul.app\_read\_all </td><td> View all AVIs and related information either in the Classic UI or Vulnerability Manager Workspace.**Important:** Starting with v24.0 of Vulnerability Response, the sn\_vul.app\_read\_all role has the privilege to access the Vulnerability Manager Workspace. </td><td> sn\_vul.view\_manager\_workspace </td></tr><tr><td> sn\_vul.app\_write\_assigned </td><td> Update AVIs assigned to you. </td><td> </td></tr><tr><td> sn\_vul.app\_write\_all </td><td> Update all AVIs and related information. </td><td> </td></tr><tr><td> sn\_vul.app\_update\_assignment\_group </td><td> Update AVI Assignment group. </td><td> **Note:** When used outside of the default user group requires sn\_vul.app\_write\_all or sn\_vul.app\_write\_assigned. </td></tr><tr><td> sn\_vul.app\_update\_assigned\_to </td><td> Update AVI assignee. </td><td> **Note:** When used outside of the default user group requires sn\_vul.app\_write\_all or sn\_vul.app\_write\_assigned. </td></tr><tr><td> sn\_vul.app\_configure\_integrations </td><td> Configure third-party integrations. </td><td> sn\_vul.app\_read\_all sn\_vul.app\_read\_integrations sn\_sec\_int.admin sn\_vul\_veracode.configure\_integration sn\_vul.configure\_nvd\_administration **Note:** To define or edit an App-Sec Manager user group by single or specific integrations, see [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-persona-overview.md). </td></tr><tr><td> sn\_vul.app\_read\_integrations </td><td> View all third-party integrations. </td><td> </td></tr><tr><td> sn\_vul\_veracode.configure\_integration </td><td> Define, update, and delete Veracode integrations. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_assignment\_rules </td><td> Define, update, and delete AVI assignment rules. </td><td> sn\_vul.app\_read\_all sn\_vul.app\_read\_assignment\_rules </td></tr><tr><td> sn\_vul.app\_read\_assignment\_rules </td><td> View assignment rules. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_remediation\_target\_rules </td><td> Define, update, and delete AVI remediation target rules. </td><td> sn\_vul.app\_read\_all sn\_vul.app\_read\_remediation\_target\_rules </td></tr><tr><td> sn\_vul.app\_manage\_risk\_score\_configurations </td><td> Define, update, and delete AVR calculators and risk rules. </td><td> sn\_vul.app\_read\_all sn\_vul.app\_read\_risk\_score\_configuration sn\_sec\_cmn.calc.write </td></tr><tr><td> sn\_vul.app\_read\_risk\_score\_configuration </td><td> View AVR calculators and risk rules. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_applications </td><td> View, update, and delete application records. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_app\_sc </td><td> Gives a Security Champion the ability to add or remove themselves from the Scanned Application related list. </td><td> </td></tr><tr><td> sn\_vul.app\_pa\_sc\_view </td><td> Provides relevant view to the specific Security Champion. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_app\_vul\_permissions </td><td> \[internal\] Used by sn\_vul.app\_manage\_applications. </td><td> </td></tr><tr><td> sn\_vul.app\_manage\_normalized\_severity </td><td> Update mapping to normalized severity. </td><td> sn\_vul.app\_read\_normalized\_severity </td></tr><tr><td> sn\_vul.app\_read\_normalized\_severity \[Removed in v12.1. Don’t use.\] </td><td> View normalized severity records. </td><td> </td></tr><tr><td> sn\_vul.app\_read\_application\_release </td><td> View application release records. </td><td> </td></tr><tr><td> sn\_sec\_int.admin </td><td> Provides access to integrations. </td><td> </td></tr><tr><td> pa\_power\_user </td><td> Provides access to reports </td><td> pa\_viewer </td></tr><tr><td> sn\_vul.app\_sec\_manager </td><td> Prioritizes and manages application vulnerable items. </td><td> </td></tr><tr><td> sn\_vul.app\_developer </td><td> Developer responsible for fixing the application vulnerabilities. </td><td> </td></tr><tr><td> sn\_vul.app\_create\_watch\_topic </td><td> Create Watch Topics for application vulnerabilities. </td><td> </td></tr><tr><td> sn\_vul.app\_read\_watch\_topic </td><td> Read Watch Topics for application vulnerabilities. </td><td> </td></tr><tr><td> sn\_vul.app\_edit\_watch\_topic </td><td> Edit Watch Topics for application vulnerabilities. </td><td> </td></tr><tr><td> sn\_vul\_blackduck.configure\_integration </td><td> Configure third-party integrations. </td><td> sn\_vul\_blackduck.configure\_integration </td></tr></tbody> </table>## Scheduled jobs installed For Vulnerability Response shared scheduled jobs see, [Components installed with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/installed-with-vr.md). <table id="table_dx3_gb1_wdb"><thead><tr><th> Scheduled job </th><th> Description </th></tr></thead><tbody><tr><td> Associate existing AVIs with Auto Exception Rule </td><td> Evaluates application vulnerable items for matches to exception rules. </td></tr><tr><td> Populate Entry and CVE M2M </td><td> Makes existing records consistent with multiple CWE records. Run once after upgrade to populate then disable. </td></tr><tr><td> Resync primary CWE </td><td> For customized primary CWE calculations. Run once after upgrade to resync then disable. </td></tr><tr><td> Rollup application vulnerable item values to vulnerability and group </td><td> Calculates vulnerabilities and group roll ups for application vulnerable items.**Note:** Starting with v23.0 of Application Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task. </td></tr><tr><td> Black Duck Project List Integration </td><td> Pulls and ingests data into the Black Duck projects table. </td></tr><tr><td> Black Duck Application List Integration </td><td> Imports applications into discovered applications table for all the project versions available with Black Duck Integration in projects table. </td></tr><tr><td> Black Duck Application Vulnerable Item Integration </td><td> Ingests vulnerable items into ServiceNow application based on the vulnerabilities detected by scanners for every discovered application in the system. </td></tr></tbody> </table>## Tables installed <table id="table_fbz_45z_vdb"><thead><tr><th> Table </th><th> Description </th></tr></thead><tbody><tr><td> Application Release\[sn\_vul\_app\_release\] </td><td> Contains application version information. </td></tr><tr><td> Version 13.0: Application Security Champions \[sn\_vul\_app\_m2m\_app\_sc\] </td><td> Contains the Application Vulnerability Response Security Champion group records. </td></tr><tr><td> Application Vulnerability Entry\[sn\_vul\_app\_vul\_entry\] </td><td> Contains application vulnerability entries. </td></tr><tr><td> Application Vulnerability Integration \[sn\_vul\_app\_integration\] </td><td> Contains Application Vulnerability Response integration records. </td></tr><tr><td> Application Vulnerability Scan Location\[sn\_vul\_app\_vul\_scan\_location\] </td><td> Contains third-party scan location information. </td></tr><tr><td> Application Vulnerability Scan Summary\[sn\_vul\_app\_vul\_scan\_summary\] </td><td> Contains third-party scan summary information. </td></tr><tr><td> Application Vulnerable Item\[sn\_vul\_app\_vulnerable\_item\] </td><td> Contains AVI records. Starting with v19.0, the following columns are added for Software Bill of Materials: - sn\_sbm\_config\_rule - sn\_sbom\_component - vex\_justification - vex\_detail - vex\_response - vex\_state - sca\_type \(SBOM-SCA\) </td></tr><tr><td> Scanned Application\[sn\_vul\_app\_scanned\_application\] </td><td> Contains application information. </td></tr><tr><td> State Map\[sn\_vul\_app\_state\_map\] </td><td> Contains state mapping from third-party integrations to application vulnerable item \(AVI\) states. </td></tr><tr><td> Vulnerability CWEs\[sn\_vul\_m2m\_entry\_cwe\] </td><td> Links CVE data to application vulnerable entries. </td></tr><tr><td> Application Remediation Task Manifestsn\_vul\_app\_rt\_manifest </td><td> Any updates on remediation task are done by using this manifest table by scheduled jobs. </td></tr><tr><td> Application Remediation Task sn\_vul\_app\_vulnerability </td><td> Contains application remediation tasks. </td></tr><tr><td> Application Remediation Task Itemsn\_vul\_app\_m2m\_vul\_group\_item </td><td> M2M table between AVI and application remediation tasks. </td></tr><tr><td> Version 21.0:Application Vulnerable Items sn\_vul\_app\_vulnerable\_item </td><td> Contains AVI records. </td></tr><tr><td> Version 21.0: Package \[sn\_vul\_app\_package\] </td><td> Contains application package details. </td></tr><tr><td> Version 21.0:Licenses sn\_vul\_app\_license </td><td> Contains application licenses. </td></tr><tr><td> Version 21.0:Application Remediation Tasks sn\_vul\_app\_vulnerability </td><td> Contains application remediation tasks. </td></tr><tr><td> sn\_vul\_blackduck\_config </td><td> Contains Black Duck integration configuration details. </td></tr><tr><td> sn\_vul\_blackduck\_project </td><td> Contains details of the projects coming from Black Duck. </td></tr><tr><td> sn\_vul\_blackduck\_project\_import </td><td> Import set table for the Black Duck project ingestion. </td></tr><tr><td> sn\_vul\_blackduck\_app\_import </td><td> Import set table for the Black Duck application ingestion. </td></tr><tr><td> sn\_vul\_blackduck\_avit\_import </td><td> Import set table for the Black Duck AVIT ingestion. </td></tr></tbody> </table>
| title | Components installed with Application Vulnerability Response |
| description | Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/installed-with-avm.html |
| release | australia |
| product | Application Vulnerability Response |
| classification | application-vulnerability-response |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 5 |
| breadcrumb | ReferenceApplication Vulnerability ResponseUnified Security Exposure ManagementSecurity Operations |