Set filtering for the Wiz Host Vulnerabilities Integration

---
title: Set filtering for the Wiz Host Vulnerabilities Integration
description: Set the filtering values to import the host vulnerability data that you want.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/wiz-host-tab-filters.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 3
breadcrumb: [Configure, Vulnerability Response Integration with Wiz, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Set filtering for the Wiz Host Vulnerabilities Integration

Set the filtering values to import the host vulnerability data that you want.

## Before you begin

<table id="table_fz1_zsl_hkc"><thead><tr><th>

Supporting core application

</th><th>

Benefit

</th><th>

Wiz Integration

</th><th>

Users

</th></tr></thead><tbody><tr><td>

Vulnerability Response

</td><td>

Import and evaluate early detections vulnerabilities on running hosts.The host vulnerability integration imports findings related to virtual machines and serverless assets in your cloud environment. These findings are mapped to Host Vulnerable Items \(VITs\) within the Vulnerability Response application to support remediation workflows.

</td><td>

Wiz Host Vulnerability Integration.

</td><td>

Vulnerability managers, analysts, and Cloud security teams

</td></tr></tbody>
</table>Role required: sn\_vul\_wiz.configure\_integration

## Procedure

1.  Navigate to **All** &gt; **Wiz Vulnerability Integration** &gt; **Administration** &gt; **Configuration**.

2.  If not already selected, select the **Host Vulnerabilities Configuration** tab.

3.  Fill in the fields.

    These fields that are displayed provide you with filters to import basic host vulnerability data. Refer to the following tables for more information.

<table id="table_x52_pjn_bgc"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

First

</td><td>

Pagination. Enter a value. You might prefer to start with 1000.

</td></tr><tr><td>

Severity

</td><td>

Finding severity. None is the default. If selected, this indicates you don’t want to import any data for this field. You can specify multiple values:-   NONE - Return assets with no available severity values.
-   LOW
-   MEDIUM
-   HIGH
-   CRITICAL


</td></tr><tr><td>

Resource Status

</td><td>

Return only vulnerability findings for assets with these statuses. You can specify multiple values:-   None \(default\) - If selected, this indicates you do not want to import any data for this field.
-   Active
-   Error
-   Inactive


</td></tr></tbody>
</table>    To view more filtering options, select the **Advanced** check box.

4.  Select the Advanced check box to view more filtering options.

    For most fields, you can specify multiple values. `--None--` is the \(default\). If `--None--` remains selected for a field, no data is imported for this field.

    If displayed select the lock icons \(\[Omitted image "dlp-lock-icon.png"\] Alt text: An closed padlock icon that indicates the field is locked and not editable.\) and \(\[Omitted image "dlp-unlock-icon.png"\] Alt text: An opened padlock icon that indicates the field is unlocked and editable.\) to edit and lock your edits.

<table id="table_wdj_klr_qfc"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Detection Method

</td><td>

Filter on vulnerability findings found by these detection methods:-   --None--
-   DEFAULT\_PACKAGE
-   FILE\_PATH
-   INSTALLED\_PROGRAM
-   INSTALLED\_PROGRAM\_BY\_SERVICE
-   LIBRARY
-   OS
-   PACKAGE


</td></tr><tr><td>

Vulnerability

</td><td>

Filter on vulnerability findings with matching external ID\(s\) that you enter, for example, CVE-1234-5678,CVE-9110-26117.

</td></tr><tr><td>

Status

</td><td>

Filter by finding status:-   --None--
-   OPEN
-   REJECTED
-   RESOLVED


</td></tr><tr><td>

Related Issue Severity

</td><td>

-   --None--
-   CRITICAL
-   HIGH
-   INFORMATIONAL
-   LOW
-   MEDIUM


</td></tr><tr><td>

Has Public Exploit

</td><td>

Filter on vulnerability findings for vulnerabilities with an available exploit: \(true/false\).

</td></tr><tr><td>

Project ID

</td><td>

Filter for vulnerability findings with strings that you enter for the given projects.

</td></tr><tr><td>

Has Fix

</td><td>

Filter on vulnerability findings for vulnerabilities with an available fix \(true/false\).

</td></tr><tr><td>

Resource

</td><td>

Filter on a resource you enter.

</td></tr><tr><td>

Resource Has Admin Privileges

</td><td>

Filter for vulnerability findings for assets that have admin privileges \(true/false\).

</td></tr><tr><td>

Subscription

</td><td>

Import findings from the following strings for external subscriptions: \(AWS Account, Azure Subscription, GCP Project, and OCI Compartment\). You can specify multiple values in an array. If you do not provide a value, all subscriptions are returned.

</td></tr><tr><td>

Has CISA KEV Exploit

</td><td>

Filter for vulnerability findings for vulnerabilities with an available CISA KEV exploit \(true/false\).

</td></tr><tr><td>

Resource Has High Privileges

</td><td>

Filter for vulnerability findings for assets that have high privileges \(true/false\).

</td></tr><tr><td>

Validated In Runtime

</td><td>

-   --None--
-   Yes- Select **Yes** to pull in data for resources that have this flag set to `Yes` in the Runtime field. In Wiz console, the 'Validated in Runtime' status for a finding typically persists for a 48-hour period from the last time the vulnerable package was detected in memory.
-   No. Do not pull data for these resources.


</td></tr><tr><td>

Resource Has Wide Internet Exposure

</td><td>

Filter for vulnerability findings for assets that have high internet exposure \(true/false\).

</td></tr><tr><td>

Resource Has Limited Internet Exposure

</td><td>

Filter for vulnerability findings for assets that have low internet exposure \(true/false\).

</td></tr><tr><td>

First Seen At \(After\)

</td><td>

Filter by assets seen starting with a date you select.

</td></tr><tr><td>

Resolved At \(After\)

</td><td>

Filter by assets with vulnerabilities that have been resolved starting with a date you select.

</td></tr><tr><td>

Updated At \(After\)

</td><td>

Filter by assets that have been updated starting with a date you select.

</td></tr></tbody>
</table>5.  **Select Save and test**.

    If the credentials have been saved and validated successfully a message is displayed. You can select filtering for another integration import.