Container Vulnerability Response

reference australia Updated Sep 10, 2026 4 min read cvr-landing.md
Raw file servicenow.com

The ServiceNow® Container Vulnerability Response application imports container vulnerable items (CVITs) and according to the rules enables you to remediate container vulnerabilities. Vulnerability data is pulled from internal and external sources, such as the National Vulnerability Database (NVD) or third-party integrations.

Request apps on the Store

Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

## Benefits

The Container Vulnerability Response application provides the following benefits:

  • Integrates with third-party container security products, like Prisma Cloud Compute from Palo Alto Networks.
  • Imports vulnerability data for the images that are deployed to runtime, and enriches the vulnerability data with runtime contextual information (hosts, Kubernetes clusters, services, and namespaces).
  • Provides a list of the references created from vulnerabilities to the relevant Kubernetes entities in the Configuration Management Database (CMDB) using ServiceNow Kubernetes Discovery.
  • Offers a comprehensive reporting dashboard, providing insights into the vulnerability and remediation trends.

Key features

The Container Vulnerability Response application manages vulnerabilities detected in the containers. It provides the following features:

  • Point to source Docker Image from CVITs instead of running containers.
  • Configure granularity of CVITs to track at image, Kubernetes cluster, namespace, or service level.
  • Track new image versions to identify fixed vulnerabilities. Any vulnerabilities reported in older versions are automatically resolved in ServiceNow when new image versions are deployed at runtime.
  • Track CVITs in Base images separately from Application images to enable independent remediation.
  • Raise exception requests or false positive requests, which can be reviewed through a multi-level approver process.
  • Define exception rules to defer CVITs automatically.

What's new

To learn more about what's new and what's changed in Brazil, see the Brazil release notes.

Get started

Search documentation
Search document titles and file paths on the australia branch