Manual ingestion of vulnerabilities for Application Vulnerability Response
Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace.
The Penetration testing forms are available in the Penetration Testing Workspace to document the vulnerabilities identified in the core business applications.
The security professionals and application testers can manually import findings from external sources and platforms using the provided templates in Excel or CSV format. All the vulnerability findings are made available in the Penetration Testing Workspace.
To access and download the template for uploading to Penetration testing workspace, navigate to All > Manual AVIT Ingestion > Upload File UI.
A new penetration test form is created for every file upload for the respective application. All the vulnerability findings within that upload are associated to the same penetration test form. The Application Name must match with the records in of the tables:
- Application Table
- Business Application Table
- Scanned Application Table
The Application Name is a mandatory field present in the template for identifying the vulnerabilities present within an application, associated to a penetration test form. Any record missing the Application Name will not be processed and skipped during vulnerability creation.
Note: Mandatory fields in the template are necessary for processing the penetration test findings. It is necessary to ensure all the fields in the template are intact to prevent any issues during the processing of penetration test findings.
|
Column Name |
Mandatory |
Description |
Available Options/ Max characters in strings |
|---|---|---|---|
|
Risk rating |
Mandatory |
Severity of the application vulnerable item |
Critical High Medium Low None (Default) |
|
Requested by |
Mandatory |
Requested by |
151 |
|
CWE category |
Mandatory(Fill only one column) |
CWE ID |
255 |
|
Vulnerability ID |
Mandatory(Fill only one column) |
Vulnerability ID |
255 |
|
Application |
Mandatory |
Application Name |
255 |
|
Purpose of application |
Mandatory |
Purpose of application |
4000 |
|
Types of sensitive data |
Mandatory |
List types of sensitive data accessible from applications |
40 |
|
List of compliance programs |
Mandatory |
List of compliance programs |
4000 |
|
Technology stack details |
Mandatory |
Technology stack details |
4000 |
|
Application team |
Mandatory |
Application team Name; group responsible for developing and maintaining software applications |
100 |
|
URLs to test |
Mandatory |
URLs to test |
4000 |
|
Steps to reproduce |
Mandatory |
Steps to reproduce |
1000 |
|
Technical details |
Mandatory |
Technical details |
1000 |
|
Assigned to |
Mandatory |
Assigned to (individual responsible for conducting penetration tests and generating security findings) |
151 |
|
Assignment group |
Mandatory |
Assignment group (group responsible for conducting penetration tests and generating security findings) |
151 |
--- title: Manual ingestion of vulnerabilities for Application Vulnerability Response description: Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/manual-ingestion-of-vulnerabilities-for-application-vulnerability-response.html release: australia product: Application Vulnerability Response classification: application-vulnerability-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 2 breadcrumb: [Integrate, Application Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Manual ingestion of vulnerabilities for Application Vulnerability Response Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace. The Penetration testing forms are available in the Penetration Testing Workspace to document the vulnerabilities identified in the core business applications. The security professionals and application testers can manually import findings from external sources and platforms using the provided templates in Excel or CSV format. All the vulnerability findings are made available in the Penetration Testing Workspace. To access and download the template for uploading to Penetration testing workspace, navigate to **All** > **Manual AVIT Ingestion** > **Upload File UI**. A new penetration test form is created for every file upload for the respective application. All the vulnerability findings within that upload are associated to the same penetration test form. The Application Name must match with the records in of the tables: - Application Table - Business Application Table - Scanned Application Table The Application Name is a mandatory field present in the template for identifying the vulnerabilities present within an application, associated to a penetration test form. Any record missing the Application Name will not be processed and skipped during vulnerability creation. **Note:** Mandatory fields in the template are necessary for processing the penetration test findings. It is necessary to ensure all the fields in the template are intact to prevent any issues during the processing of penetration test findings. <table id="table_pbp_yvt_2fc"><thead><tr><th> Column Name </th><th> Mandatory </th><th> Description </th><th> Available Options/ Max characters in strings </th></tr></thead><tbody><tr><td> Risk rating </td><td> Mandatory </td><td> Severity of the application vulnerable item </td><td> Critical High Medium Low None \(Default\) </td></tr><tr><td> Requested by </td><td> Mandatory </td><td> Requested by </td><td> 151 </td></tr><tr><td> CWE category </td><td> Mandatory\(Fill only one column\) </td><td> CWE ID </td><td> 255 </td></tr><tr><td> Vulnerability ID </td><td> Mandatory\(Fill only one column\) </td><td> Vulnerability ID </td><td> 255 </td></tr><tr><td> Application </td><td> Mandatory </td><td> Application Name </td><td> 255 </td></tr><tr><td> Purpose of application </td><td> Mandatory </td><td> Purpose of application </td><td> 4000 </td></tr><tr><td> Types of sensitive data </td><td> Mandatory </td><td> List types of sensitive data accessible from applications </td><td> 40 </td></tr><tr><td> List of compliance programs </td><td> Mandatory </td><td> List of compliance programs </td><td> 4000 </td></tr><tr><td> Technology stack details </td><td> Mandatory </td><td> Technology stack details </td><td> 4000 </td></tr><tr><td> Application team </td><td> Mandatory </td><td> Application team Name; group responsible for developing and maintaining software applications </td><td> 100 </td></tr><tr><td> URLs to test </td><td> Mandatory </td><td> URLs to test </td><td> 4000 </td></tr><tr><td> Steps to reproduce </td><td> Mandatory </td><td> Steps to reproduce </td><td> 1000 </td></tr><tr><td> Technical details </td><td> Mandatory </td><td> Technical details </td><td> 1000 </td></tr><tr><td> Assigned to </td><td> Mandatory </td><td> Assigned to \(individual responsible for conducting penetration tests and generating security findings\) </td><td> 151 </td></tr><tr><td> Assignment group </td><td> Mandatory </td><td> Assignment group \(group responsible for conducting penetration tests and generating security findings\) </td><td> 151 </td></tr></tbody> </table>
| title | Manual ingestion of vulnerabilities for Application Vulnerability Response |
| description | Security professionals and application testers can create and manage the application penetration test findings within the Penetration Testing Workspace. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/manual-ingestion-of-vulnerabilities-for-application-vulnerability-response.html |
| release | australia |
| product | Application Vulnerability Response |
| classification | application-vulnerability-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | IntegrateApplication Vulnerability ResponseUnified Security Exposure ManagementSecurity Operations |