Application Vulnerable Item fields
Application vulnerable items (AVITs) are automatically created during third-part vulnerability integration imports.
Application vulnerable item fields
Except for the Assignment group, Assigned to fields and Notes, all other fields in the AVIT are read-only.
|
Field |
Description |
|---|---|
|
Number |
Automatically generated AVIT identifier for this record. |
|
Scan type |
Type of scanner that found this AVIT. Choices are:
|
|
Risk rating |
Quantified Risk Score separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see, Calculate risk in Application Vulnerability Response automatically. |
|
Risk score |
Calculated amount of risk the AVI poses to your environment. For more information, see Calculate risk in Application Vulnerability Response automatically. |
|
Remediation commitment date |
The date AVITs should be remediated after it is moved into Under Investigation. This field only appears if the AVIT is in Under Investigation. |
|
Remediation target |
Date by which the AVITs should be remediated, since first identified. Only appears when applicable.For more information on remediation targets, see Automate remediation target tracking in Application Vulnerability Response. |
|
Remediation status |
Status of the remediation for the AVIT. It is determined by the AVIT with the nearest due date, when applicable. States include:
|
|
Category Name |
Name of the category of the vulnerability. |
|
Vulnerability |
ID of the vulnerability associated with this application vulnerable item. |
|
Application release |
Version of the application. |
|
Application module |
Affected application in DAST scan. Hidden for SAST scans. |
|
LocationVersion 14.0: SAST |
DAST: URL location of the vulnerability within the application. SAST: File path and line number of the vulnerability within the application. |
|
State |
This field defaults to Open when created. See Application Vulnerable Item (AVI) states for more information on how states are mapped. |
|
Reason |
[Only visible when the AIV is in the Closed state.] Explanation of the State. |
|
Assignment group |
Group selected to work on this AVIT. Can be manually added or edited by an App-Sec Manager. |
|
Assigned to |
Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager |
|
First found |
Date the third-party source first found the application vulnerable item. |
|
Last found |
Date the third-party source last found the application vulnerable item. |
|
Closed |
[Only visible when the AVIT is in the Closed state.] Date the AVI was closed. |
|
Closed by |
[Only visible when the AVIT is in the Closed state.] Entity that closed the AVIT. |
|
Summary |
Imported description of the vulnerability. |
|
Findings Read-only data imported from third-party integration. | |
|
Source AVIT ID |
Imported identifier for the source AVIT. |
|
Source severity |
Imported severity from the source application. |
|
Source target fix date |
Imported date by which the source expects the AVIT to be remediated. |
|
Source mitigation status |
Imported mitigation status from the source application. |
|
Source remediation status |
Imported remediation status from the source application. |
|
Source finding status |
[Only visible when populated] Imported issue status from the source application. |
|
SDLC status |
Imported Software Development Life Cycle status. |
|
Complies with Policy |
Imported compliance status. If not status is provided, this field is set to Not Applicable. |
|
Source link |
URL to the source AVIT. |
|
Source notes |
Imported notes from the source. |
|
Vulnerability summary |
Imported summary from the source. |
|
Vulnerability explanation |
Imported explanation from the source. |
|
Recommendation |
Imported recommendation from the source. |
|
References |
Imported references from the source. |
|
HTTP Request/Response (only visible for DAST scans) | |
|
Source request |
HTTP request |
|
Source response |
HTTP response |
|
Notes | |
|
Remediation Plan |
Details for how the AVITs will be remediated. The plan should be implemented by the Remediation commitment date. This field only appears if the AVIT is in Under Investigation. |
|
Additional comments/Work notes |
Any relevant information. Select the text box for Work notes to add information.Starting with Vulnerability Response v20.0, you can add work notes in the Notes section for a deferred application vulnerable item. |
- The Age column in the AVIT list displays the duration (format: Days HH:MM:SS) for which an AVIT is active. The Age value is zero for a closed AVIT.
- The Age closed column in the AVIT list displays the duration (format: Days HH:MM:SS) for which an AVI is active before it is closed. For a AVITs, other than in the Closed state, the Age closed value is zero.
For more information on how to customize the calculation of Age and Age closed durations, see the KB1703270 article.
--- title: Application Vulnerable Item fields description: Application vulnerable items \(AVITs\) are automatically created during third-part vulnerability integration imports. locale: en-US canonical_url: https://www.servicenow.com/docs/r/security-management/application-vulnerability-response/avm-vul-items-fields.html release: brazil product: Application Vulnerability Response classification: application-vulnerability-response topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 4 breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Application Vulnerable Item fields Application vulnerable items \(AVITs\) are automatically created during third-part vulnerability integration imports. ## Application vulnerable item fields Except for the **Assignment group**, **Assigned to** fields and **Notes**, all other fields in the AVIT are read-only. <table id="table_t4d_4bd_5s"><thead><tr><th> Field </th><th> Description </th></tr></thead><tbody><tr><td> Number </td><td> Automatically generated AVIT identifier for this record. </td></tr><tr><td> Scan type </td><td> Type of scanner that found this AVIT. Choices are: - Dynamic - Static - SCA </td></tr><tr><td> Risk rating </td><td> Quantified **Risk Score** separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see, [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/application-vulnerability-response/avm-calculators-rules.md). </td></tr><tr><td> Risk score </td><td> Calculated amount of risk the AVI poses to your environment. For more information, see [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/application-vulnerability-response/avm-calculators-rules.md). </td></tr><tr><td> Remediation commitment date </td><td> The date AVITs should be remediated after it is moved into **Under Investigation**. This field only appears if the AVIT is in **Under Investigation**. </td></tr><tr><td> Remediation target </td><td> Date by which the AVITs should be remediated, since first identified. Only appears when applicable.For more information on remediation targets, see [Automate remediation target tracking in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/application-vulnerability-response/avm-time-to-remediate-rules.md). </td></tr><tr><td> Remediation status </td><td> Status of the remediation for the AVIT. It is determined by the AVIT with the nearest due date, when applicable. States include: - In-flight - Approaching Target - Past Target </td></tr><tr><td> Category Name </td><td> Name of the category of the vulnerability. </td></tr><tr><td> Vulnerability </td><td> ID of the vulnerability associated with this application vulnerable item. </td></tr><tr><td> Application release </td><td> Version of the application. </td></tr><tr><td> Application module </td><td> Affected application in DAST scan. Hidden for SAST scans. </td></tr><tr><td> LocationVersion 14.0: SAST </td><td> DAST: URL location of the vulnerability within the application. SAST: File path and line number of the vulnerability within the application. </td></tr><tr><td> State </td><td> This field defaults to **Open** when created. See [Application Vulnerable Item \(AVI\) states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/application-vulnerability-response/avm-states.md) for more information on how states are mapped. </td></tr><tr><td> Reason </td><td> \[Only visible when the AIV is in the **Closed** state.\] Explanation of the State. </td></tr><tr><td> Assignment group </td><td> Group selected to work on this AVIT. Can be manually added or edited by an App-Sec Manager. </td></tr><tr><td> Assigned to </td><td> Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager </td></tr><tr><td> First found </td><td> Date the third-party source first found the application vulnerable item. </td></tr><tr><td> Last found </td><td> Date the third-party source last found the application vulnerable item. </td></tr><tr><td> Closed </td><td> \[Only visible when the AVIT is in the **Closed** state.\] Date the AVI was closed. </td></tr><tr><td> Closed by </td><td> \[Only visible when the AVIT is in the **Closed** state.\] Entity that closed the AVIT. </td></tr><tr><td> Summary </td><td> Imported description of the vulnerability. </td></tr><tr><td colspan="2"> **Findings** Read-only data imported from third-party integration. </td></tr><tr><td> Source AVIT ID </td><td> Imported identifier for the source AVIT. </td></tr><tr><td> Source severity </td><td> Imported severity from the source application. </td></tr><tr><td> Source target fix date </td><td> Imported date by which the source expects the AVIT to be remediated. </td></tr><tr><td> Source mitigation status </td><td> Imported mitigation status from the source application. </td></tr><tr><td> Source remediation status </td><td> Imported remediation status from the source application. </td></tr><tr><td> Source finding status </td><td> \[Only visible when populated\] Imported issue status from the source application. </td></tr><tr><td> SDLC status </td><td> Imported Software Development Life Cycle status. </td></tr><tr><td> Complies with Policy </td><td> Imported compliance status. If not status is provided, this field is set to **Not Applicable**. </td></tr><tr><td> Source link </td><td> URL to the source AVIT. </td></tr><tr><td> Source notes </td><td> Imported notes from the source. </td></tr><tr><td> Vulnerability summary </td><td> Imported summary from the source. </td></tr><tr><td> Vulnerability explanation </td><td> Imported explanation from the source. </td></tr><tr><td> Recommendation </td><td> Imported recommendation from the source. </td></tr><tr><td> References </td><td> Imported references from the source. </td></tr><tr><td colspan="2"> **HTTP Request/Response \(only visible for DAST scans\)** </td></tr><tr><td> Source request </td><td> HTTP request </td></tr><tr><td> Source response </td><td> HTTP response </td></tr><tr><td colspan="2"> **Notes** </td></tr><tr><td> Remediation Plan </td><td> Details for how the AVITs will be remediated. The plan should be implemented by the **Remediation commitment date**. This field only appears if the AVIT is in **Under Investigation**. </td></tr><tr><td> Additional comments/Work notes </td><td> Any relevant information. Select the text box for Work notes to add information.Starting with Vulnerability Response v20.0, you can add work notes in the Notes section for a deferred application vulnerable item. </td></tr></tbody> </table>Age calculations for an AVIT: - The Age column in the AVIT list displays the duration \(format: Days HH:MM:SS\) for which an AVIT is active. The Age value is zero for a closed AVIT. - The Age closed column in the AVIT list displays the duration \(format: Days HH:MM:SS\) for which an AVI is active before it is closed. For a AVITs, other than in the Closed state, the Age closed value is zero. For more information on how to customize the calculation of Age and Age closed durations, see the [KB1703270](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1703270) article.
| title | Application Vulnerable Item fields |
| description | Application vulnerable items \(AVITs\) are automatically created during third-part vulnerability integration imports. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/application-vulnerability-response/avm-vul-items-fields.html |
| release | brazil |
| product | Application Vulnerability Response |
| classification | application-vulnerability-response |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 4 |
| breadcrumb | ReferenceApplication Vulnerability ResponseUnified Security Exposure ManagementSecurity Operations |