Field mapping for the Prisma AIRS integration

reference brazil Updated Sep 15, 2026 3 min read palo-alto-prisma-airs-mapping.md
Raw file servicenow.com

These tables map Prisma AIRS payload fields to target tables and columns in your ServiceNow ServiceNow AI Platform instance.

Field mapping for scan findings

The following tables show how Prisma AIRS payload fields map to ServiceNow AI Platform target tables and columns for scan finding data.

Input field (payload key) Target table Target column
asset.asset_type sn_sec_ai_src_ci asset_type
asset.asset_id sn_sec_ai_src_ci source_asset_id
asset.asset_name sn_sec_ai_src_ci asset_name
asset.version sn_sec_ai_src_ci version
asset.asset_name cmdb_ai_model_product_model name
asset.version cmdb_ai_model_product_model version
vulnerability.source_vul_id sn_sec_ai_vul_entry id
vulnerability.description sn_sec_ai_vul_entry description
scan.scan_id sn_sec_ai_scan_summary scan_id
scan.scan_name sn_sec_ai_scan_summary scan_name
scan.start_time sn_sec_ai_scan_summary start_time
scan.end_time sn_sec_ai_scan_summary end_time
scan.scan_status sn_sec_ai_scan_summary scan_status
file.file_id sn_sec_ai_file id
file.file_path sn_sec_ai_file path
file.file_size sn_sec_ai_file size
file.file_name sn_sec_ai_file name
file.format sn_sec_ai_file format
file.last_scanned sn_sec_ai_file last_scanned
scan_finding.short_description sn_sec_ai_scan_finding short_description
scan_finding.detection_category sn_sec_ai_scan_finding detection_category
scan_finding.source_severity sn_sec_ai_scan_finding source_severity
Field Target table Target column Source
source sn_sec_ai_src_ci source metadata (integration source)
is_model_scanned sn_sec_ai_src_ci is_model_scanned Set to true (reporting_type=SCAN)
product_model sn_sec_ai_src_ci product_model chain output (AISecModelCIHandler)
cmdb_ci sn_sec_ai_src_ci cmdb_ci chain output (AISecModelCIHandler)
source sn_sec_ai_vul_entry source metadata
source sn_sec_ai_scan_summary source metadata
src_ci sn_sec_ai_scan_summary src_ci chain output (discovered_ai_asset)
source sn_sec_ai_file source metadata
model sn_sec_ai_file model chain output (discovered_ai_asset)
source sn_sec_ai_scan_finding source metadata
src_ci sn_sec_ai_scan_finding src_ci chain output (discovered_ai_asset)
vulnerability sn_sec_ai_scan_finding vulnerability chain output (AISecVulEntryHandler)
scan_summary sn_sec_ai_scan_finding scan_summary chain output (AISecScanSummaryHandler)
file sn_sec_ai_scan_finding file chain output (AISecFileHandler)

Tables populated by scan findings:

  • AI Scan Findings [sn_sec_ai_scan_finding]
  • AI Scan Summaries [sn_sec_ai_scan_summary]
  • Discovered AI Assets [sn_sec_ai_src_ci]
  • AI Vulnerability Entries [sn_sec_ai_vul_entry]
  • Model Files [sn_sec_ai_file]

Field mapping for posture findings

Input field (payload key) Target table Target column
asset.asset_type sn_sec_ai_src_ci asset_type
asset.asset_id sn_sec_ai_src_ci source_asset_id
asset.asset_name sn_sec_ai_src_ci asset_name
asset.version sn_sec_ai_src_ci version
asset.asset_name cmdb_ai_model_product_model name
asset.version cmdb_ai_model_product_model version
posture_rule.rule_id sn_sec_ai_posture_rule id
posture_rule.short_description sn_sec_ai_posture_rule short_description
finding_evidence.category sn_sec_ai_finding_evidence category
finding_evidence.details sn_sec_ai_finding_evidence details
Field Target table Target column Source
source sn_sec_ai_src_ci source metadata (integration source)
product_model sn_sec_ai_src_ci product_model chain output (AISecModelCIHandler)
cmdb_ci sn_sec_ai_src_ci cmdb_ci chain output (AISecModelCIHandler)
source sn_sec_ai_posture_rule source metadata
source sn_sec_ai_posture_finding source metadata
ai_posture_rule sn_sec_ai_posture_finding ai_posture_rule chain output (AISecPostureRuleHandler)
src_ci sn_sec_ai_posture_finding src_ci chain output (discovered_ai_asset)
source sn_sec_ai_finding_evidence source metadata
finding sn_sec_ai_finding_evidence finding chain output (AISecPostureFindingHandler)

Tables populated by posture findings:

  • AI Posture Finding [sn_sec_ai_posture_finding]
  • AI Posture Rule [sn_sec_ai_posture_rule]
  • Discovered AI Assets [sn_sec_ai_src_ci]
  • Finding Evidence [sn_sec_ai_finding_evidence]
  • AI Model Product Model [cmdb_ai_model_product_model]

Field mapping for validation findings

Input field (payload key) Target table Target column
asset.asset_type sn_sec_ai_src_ci asset_type
asset.asset_id sn_sec_ai_src_ci source_asset_id
asset.asset_name sn_sec_ai_src_ci asset_name
asset.version sn_sec_ai_src_ci version
asset.asset_name cmdb_ai_model_product_model name
asset.version cmdb_ai_model_product_model version
threat_signature.threat_category sn_sec_ai_threat_signature threat_category
threat_signature.threat_sub_category sn_sec_ai_threat_signature threat_sub_category
threat_signature.attack_technique sn_sec_ai_threat_signature attack_technique
threat_signature.attack_threat sn_sec_ai_threat_signature attack_threat
threat_signature.mitre_technique[].technique_id sn_sec_cmn_mitre_technique technique_id
threat_signature.mitre_technique[].technique_name sn_sec_cmn_mitre_technique technique_name
threat_signature.mitre_technique (resolved) sn_sec_ai_threat_signature mitre_technique_list
validation_finding.prompt sn_sec_ai_validation_finding prompt
validation_finding.short_description sn_sec_ai_validation_finding short_description
threat.prompt sn_sec_ai_validation_threat prompt
threat.response sn_sec_ai_validation_threat response
threat.source_severity sn_sec_ai_validation_threat source_severity
threat.status sn_sec_ai_validation_threat status
threat.last_seen sn_sec_ai_validation_threat last_seen
Field Target table Target column Source
source sn_sec_ai_src_ci source metadata (integration source)
is_model_validated sn_sec_ai_src_ci is_model_validated Set to true (reporting_type=VALIDATION)
product_model sn_sec_ai_src_ci product_model chain output (AISecModelCIHandler)
cmdb_ci sn_sec_ai_src_ci cmdb_ci chain output (AISecModelCIHandler)
source sn_sec_ai_threat_signature source metadata
prompt_hash sn_sec_ai_validation_finding prompt_hash auto-generated (SHA256 of prompt)
response_hash sn_sec_ai_validation_finding response_hash auto-generated (SHA256 of response)
ai_threat_signature sn_sec_ai_validation_finding ai_threat_signature chain output (AISecThreatSignatureHandler)
src_ci sn_sec_ai_validation_finding src_ci chain output (discovered_ai_asset)
source sn_sec_ai_validation_finding source metadata
prompt_hash sn_sec_ai_validation_threat prompt_hash auto-generated (SHA256 of prompt)
response_hash sn_sec_ai_validation_threat response_hash auto-generated (SHA256 of response)
ai_validation_finding sn_sec_ai_validation_threat ai_validation_finding chain output (AISecValidationFindingHandler)
source sn_sec_ai_validation_threat source metadata

Tables populated by validation findings:

  • AI Threat Signatures [sn_sec_ai_threat_signature]
  • AI Validation Threats [sn_sec_ai_validation_threat]
  • AI Validation Findings [sn_sec_ai_validation_finding]

Field mapping for Red Team scan guardrails

Input field (payload key) Target table Target column
job_uuid sn_vul_prisma_airs_red_team_scan_guardrails job_uuid
policy_id sn_vul_prisma_airs_red_team_scan_guardrails policy_id
display_name sn_vul_prisma_airs_red_team_scan_guardrails policy_name
config sn_vul_prisma_airs_red_team_scan_guardrails policy_config

Tables populated by Red Team scan guardrails: Prisma AIRS Red Team Scan Guardrails [sn_vul_prisma_airs_red_team_scan_guardrails].

Keywords Prisma AIRS field mapping
Search documentation
Search document titles and file paths on the brazil branch