Data mapping for the AWS Inspector integration

---
title: Data mapping for the AWS Inspector integration
description: AWS Inspector data mapping tables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/aws-inspector-mapping.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Reference, AWS Integration for Security Exposure Management, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Data mapping for the AWS Inspector integration

AWS Inspector data mapping tables.

## AWS Inspector Host Vulnerabilities import

Data is loaded into \[sn\_vul\_aws\_inspector\_host\_vuln\_import\] table.

|Column|Type|Description|
|------|----|-----------|
|account\_id|string|AWS account ID|
|description|string|Finding description|
|exploit\_available|string|Exploit availability flag|
|finding\_arn|string|Finding ARN \(unique identifier\)|
|first\_observed\_at|string|First observed timestamp|
|fix\_available|string|Fix availability flag|
|inspector\_score|float|AWS Inspector risk score|
|inspector\_score\_details|string|JSON with CVSS details and adjustments|
|last\_observed\_at|string|Last observed timestamp|
|network\_reachability\_details|string|Network reachability information|
|package\_vulnerability\_details|string|JSON with CVE, CVSS, packages|
|remediation|string|Remediation recommendation|
|resources|string|JSON with resource details \(EC2, Lambda\)|
|severity|string|Finding severity|
|status|string|Finding status \(ACTIVE, SUPPRESSED, CLOSED\)|
|title|string|Finding title|
|type|string|Finding type|
|updated\_at|string|Last updated timestamp|
|epss|string|EPSS score data|

|AWS Inspector severity|ServiceNow severity value|
|----------------------|-------------------------|
|CRITICAL|1|
|HIGH|2|
|MEDIUM|3|
|LOW|4|
|INFORMATIONAL|4|
|UNTRIAGED|5|

|AWS Inspector resource type|ServiceNow cloud resource type|
|---------------------------|------------------------------|
|AWS\_EC2\_INSTANCE|AWS::EC2::Instance|
|AWS\_LAMBDA\_FUNCTION|AWS::Lambda::Function|

| | | |
|---|---|---|
|exploitAvailable|exploit|YES=1, NO=2|
|packageVulnerabilityDetails. severity|source\_severity|Via SOURCE\_SEVERITY\_MAP|
|sourceUrl|summary|Source URL for the vulnerability|
|cvss\[\].scoringVector|v2\_vector\_string|When version 2.x and source is NVD|
|cvss\[\].baseScore|score|When version 2.x|
|cvss\[\].baseScore|v3\_base\_score|When version 3.x and source is NVD|
|cvss\[\].scoringVector|v3\_vector\_string|When version 3.x and source is NVD|
|cvss\[\].baseScore|v4\_base\_score|When version 4.x and source is NVD|
|cvss\[\].scoringVector|v4\_vector\_string|When version 4.x and source is NVD|
|epss.score|epss\_score|EPSS probability score|
|fixAvailable|fix\_available|Fix availability|
|exploitabilityDetails.lastKnownExploitAt|last\_known\_exploit\_at|Last known exploit date|
|inspectorScoreDetails.adjustedCvss.adjustments\[\]|adjustment|CVSS score adjustments|
|inspectorScoreDetails.adjustedCvss.cvssSource|cvss\_source|CVSS source|
|inspectorScoreDetails.adjustedCvss.score|inspector\_score|Adjusted inspector score|
|inspectorScoreDetails.adjustedCvss.scoreSource|score\_source|Score source|
|inspectorScoreDetails.adjustedCvss.scoringVector|scoring\_vector|Adjusted scoring vector|
|inspectorScoreDetails.adjustedCvss.version|version|CVSS version|

|AWS Inspector field|ServiceNow field|Description|
|-------------------|----------------|-----------|
|status|source\_status|Raw status from AWS Inspector|
|status|status|active→open; suppressed→open with is\_ignored=true; closed→closed|
|firstObservedAt|first\_found|First observed timestamp|
|lastObservedAt|last\_found|Last observed timestamp|
|packageVulnerabilityDetails.vulnerablePackages|proof|Vulnerable package details|
|packageVulnerabilityDetails.vulnerabilityId|vulnerability|Reference to vulnerability entry|
|remediation.recommendation.text|solution\_summary|Remediation recommendation text|
|findingArn|detection\_key|Unique detection key for split detection|
|severity|source\_severity|Severity of the finding from AWS|

|AWS Inspector field|ServiceNow field|Description|
|-------------------|----------------|-----------|
|resources\[0\].id|source\_id|Source identifier|
|resources\[0\].id|resource\_id|Resource identifier|
|lastObservedAt|last\_scan\_date|Last scan date|
|resources\[0\].details.awsEc2Instance.imageId|image\_id|EC2 instance image ID|
|resources\[0\].details.awsEc2Instance.platform|os|Operating system platform|
|\(mapped from resources\[0\].type\)|cloud\_resource\_type|AWS\_EC2\_INSTANCE→AWS::EC2::Instance; AWS\_LAMBDA\_FUNCTION→AWS::Lambda::Function|
|accountId|cloud\_account|AWS account ID|
|resources\[0\].region|cloud\_region|AWS region|
|"AWS"|cloud\_service\_provider|Static value: AWS|
|"Cloud"|asset\_category|Static value: Cloud|
|resources.details|source\_data|Raw source data|

|AWS Inspector field|ServiceNow field|Description|
|-------------------|----------------|-----------|
|firstObservedAt|first\_found\_dt\_tm|First found date/time|
|lastObservedAt|last\_found\_dt\_tm|Last found date/time|
|vulnerablePackages|description|Vulnerable package description|
|packageVulnerabilityDetails.vulnerabilityId|vulnerability|Reference to vulnerability|

|AWS Inspector field|ServiceNow field|Description|
|-------------------|----------------|-----------|
|`packageVulnerabilityDetails.vulnerabilityId`|id|Vulnerability identifier|
|`"AWS"`|source|Static source value|
|`sourceUrl`|summary|Source URL|
|`exploitAvailable`|exploit|Exploit availability|
|`packageVulnerabilityDetails.source`|category|Vulnerability source category|
|`packageVulnerabilityDetails.severity`|source\_severity|critical→critical, high→high, medium→medium, low/informational→low, untriaged→none|
|`packageVulnerabilityDetails.vendorCreatedAt`|date\_published|Date vulnerability was published|
|`packageVulnerabilityDetails.vendorUpdatedAt`|last\_modified|Date vulnerability was last modified|
|`inspectorScore`|source\_risk\_score|Inspector risk score|
|`cvss[].baseScore`|v3\_base\_score|When version 3.x|
|`cvss[].scoringVector`|v3\_vector\_string|When version 3.x|
|`cvss[].baseScore`|v2\_base\_score|When version 2.x|
|`cvss[].scoringVector`|v2\_vector\_string|When version 2.x|
|`cvss[].baseScore`|v4\_base\_score|When version 4.x|
|`cvss[].scoringVector`|v4\_vector\_string|When version 4.x|
|`fixAvailable`|patch\_available|Patch availability|
|`epss.score`|epss\_score|EPSS probability score|
|`exploitabilityDetails.lastKnownExploitAt`|last\_known\_exploit\_date|Custom field in AWS scope|