Access the Vulnerability Entities

---
title: Access the Vulnerability Entities
description: The TISC uses the following entities to store and organize vulnerability, product, and vendor intelligence data.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/access-the-vulnerability-entities.html
release: brazil
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 9
keywords: [vulnerability entities, product entity, remediation entity, vendor entity, CWE weakness, vulnerability class]
breadcrumb: [Vulnerability Artifacts, TISC Library Repository, Threat Intel Library, Use, Threat Intelligence Security Center, Security Operations]
---

# Access the Vulnerability Entities

The TISC uses the following entities to store and organize vulnerability, product, and vendor intelligence data.

## Product

The Product entity stores information about software and hardware products that may be affected by vulnerabilities from the table `sn_sec_tisc_intel_product`.

<table id="table_org_vgc_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

ID

</td><td>

Indicates the Product ID, which must be unique.

</td></tr><tr><td>

Name

</td><td>

Indicates the name of the product. The value should be the product's full canonical name, including version number.

</td></tr><tr><td>

Vendor

</td><td>

Indicates the corresponding vendor for the product. References the Vendor table \(`sn_sec_tisc_vendor`\). Vendors can be created in the Threat Intelligence Library.

</td></tr><tr><td>

Product Family

</td><td>

Indicates the product family that the product falls into.

</td></tr><tr><td>

Architecture

</td><td>

Specifies the architecture for which the product is intended, such as x86, ARM, or x64.

</td></tr><tr><td>

Host Name

</td><td>

Specifies the host name or system name where the product is installed or running.

</td></tr><tr><td>

Language

</td><td>

Specifies the language or locale of the product.

</td></tr><tr><td>

Patch Level

</td><td>

Indicates the patch level or update level of the product.

</td></tr><tr><td>

Service Pack

</td><td>

Indicates the service pack level applied to the product.

</td></tr><tr><td>

Specification

</td><td>

Provides additional specification details about the product.

</td></tr><tr><td>

Product Group

</td><td>

Indicates the parent product group this product belongs to. References the product table itself, as product groups are also stored in the product table.

</td></tr><tr><td>

Last Modified in Source

</td><td>

Timestamp indicating when the product information was last modified in the source system.

</td></tr><tr><td>

Created in Source

</td><td>

Timestamp indicating when the product was first created in the source system.

</td></tr><tr><td>

Replaced By Product

</td><td>

Reference to a product that replaces this product. Used when a product has been superseded or replaced by a newer version or alternative.

</td></tr><tr><td>

Product Version\(s\)

</td><td>

Specifies the version or versions of the product as comma-separated values. Indicates specific version numbers for product identification.

</td></tr><tr><td>

Product Version Range

</td><td>

Specifies a range of product versions affected. Used in vulnerability contexts to indicate version ranges using operators or specific version bounds.

</td></tr><tr><td>

Is Product Group

</td><td>

Boolean flag indicating whether this entry represents a product group rather than an individual product.

</td></tr><tr><td>

CPE

</td><td>

The Common Platform Enumeration \(CPE\) attribute that provides standardized product identification using CPE 2.3 or CPE 2.2 format.

</td></tr><tr><td>

Status

</td><td>

Indicates the current lifecycle status of the product. Valid values:

 -   **Active**: Product is currently active and supported.
-   **Legacy \(End of Product\)**: Product has reached end-of-life but may still be in use.
-   **Deprecated By Vendor**: Product has been officially deprecated by the vendor and is no longer supported.

</td></tr></tbody>
</table>## Remediation

The Remediation entity stores information about available fixes, mitigations, and workarounds for vulnerabilities from the table `sn_sec_tisc_vulnerability_remediation`.

<table id="table_m5k_shc_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Remediation Id

</td><td>

Auto-generated unique identifier for the remediation record. Used for internal tracking and reference purposes.

</td></tr><tr><td>

Description

</td><td>

Contains a thorough human-readable discussion of the remediation, including detailed steps and guidance for addressing the vulnerability.

</td></tr><tr><td>

Prerequisites

</td><td>

Lists the conditions that must be met for the vulnerability remediation to apply. Contains any vendor-defined constraints or requirements for obtaining and applying the fix.

</td></tr><tr><td>

Action Link

</td><td>

Contains the URL where the remediation can be obtained.

</td></tr><tr><td>

Type

</td><td>

Specifies the category of the remediation.The following are the valid values for this type:

-   **Workaround**: A temporary solution that mitigates the vulnerability without fixing the root cause.
-   **Mitigation**: Actions that reduce the severity or impact of the vulnerability.
-   **Vendor fix**: An official patch or update provided by the vendor that resolves the vulnerability.
-   **First fixed**: The first version where the vulnerability has been fixed.
-   **None available**: No remediation is currently available.
-   **Will not fix**: The vendor has decided not to fix this vulnerability.
-   **No fix planned**: There are no plans to fix this vulnerability in the future.

</td></tr><tr><td>

Restart Category

</td><td>

Indicates whether a restart is necessary after remediation and, if so, this specifies the required type of restart.The following are the valid values for this category:

-   **Connected**: Restart of connected systems or services is required.
-   **Dependencies**: Restart of dependent components or services is required.
-   **Machine**: Full machine or system restart is required.
-   **Parent**: Restart of the parent process or service is required.
-   **Service**: Restart of the specific service is required.
-   **System**: System level restart is required.
-   **Vulnerable component**: Only the vulnerable component needs to be restarted.
-   **Zone**: Restart of the security zone or container is required.

</td></tr><tr><td>

Remediation Published Date

</td><td>

Contains the date from which the remediation is available.

</td></tr><tr><td>

Vulnerability

</td><td>

Reference to the vulnerability being remediated.

</td></tr><tr><td>

Products

</td><td>

Specifies a list of products to give context to the remediation. Contains references to products affected by or related to this remediation.

</td></tr></tbody>
</table>## Vendor

The Vendor entity stores information about organizations that develop or distribute products from the table `sn_sec_tisc_intel_vendor`.

|Label|Description|
|-----|-----------|
|Name|Indicates the name of the vendor.|
|Contact Details|Provides contact information for the vendor, such as email addresses and phone numbers.|
|Organization|Specifies organizational context for the vendor, such as department, division, or organizational unit.|
|Description|Provides a detailed description of the vendor's role, scope, and relevant background information.|
|Website URL|Contains the vendor's official website URL.|

## CWE Weakness

The CWE Weakness entity stores Common Weakness Enumeration records that describe categories of software weaknesses from the table `sn_sec_tisc_cwe_weakness`.

<table id="table_bhf_vhc_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

ID

</td><td>

Indicates the unique CWE identifier, such as CWE-79 or CWE-89, that standardizes the identification of software weaknesses.

</td></tr><tr><td>

Name

</td><td>

Indicates the name of the CWE weakness as defined in the CWE catalog.

</td></tr><tr><td>

Description

</td><td>

Provides a detailed description of the weakness, its characteristics, and potential security implications.

</td></tr><tr><td>

Type

</td><td>

Specifies the type classification of the CWE weakness. The following are the valid values for this type:

-   **Primary**: The initial, underlying weakness that directly enables a subsequent weakness to occur.
-   **Secondary**: The weakness that is triggered or made possible by the occurrence of the primary weakness.

</td></tr></tbody>
</table>## Vulnerability Product Mapping

The Vulnerability Product Mapping entity defines the relationship between vulnerabilities and affected products from the table `sn_sec_tisc_m2m_vulnerability_product`.

<table id="table_efl_whc_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Vulnerability

</td><td>

Reference to the vulnerability record that affects the associated product.

</td></tr><tr><td>

Product

</td><td>

Reference to the product record that is affected by the associated vulnerability.

</td></tr><tr><td>

Status

</td><td>

Indicates the relationship status between the vulnerability and product. Valid values:

 -   **Known affected**: Product version is confirmed to be affected by the vulnerability.
-   **Known not affected**: Product version is confirmed to not be affected by the vulnerability.
-   **First affected**: First version of the product affected by the vulnerability.
-   **First fixed**: First version where the vulnerability has been fixed.
-   **Fixed**: Product version has been fixed and is no longer vulnerable.
-   **Last affected**: Last version of the product affected by the vulnerability.
-   **Recommended**: Recommended version to use to avoid the vulnerability.
-   **Under investigation**: Product version is currently being investigated by the vendor; it is not yet known whether this version is affected.

</td></tr></tbody>
</table>## Related Vulnerability CWE

The Related Vulnerability CWE entity maps vulnerabilities to their associated CWE weaknesses from the table `sn_sec_tisc_m2m_vulnerability_cwe`.

|Label|Description|
|-----|-----------|
|Vulnerability|Reference to the vulnerability record associated with the CWE weakness.|
|CWE|Reference to the CWE weakness record.|

## CWE Weakness Relationship

The CWE Weakness Relationship entity defines hierarchical and associative relationships between CWE weakness records from the table `sn_sec_tisc_m2m_cwe`.

<table id="table_hzn_yhc_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Source CWE

</td><td>

Reference to the source CWE weakness record in the relationship.

</td></tr><tr><td>

Target CWE

</td><td>

Reference to the target CWE weakness record in the relationship.

</td></tr><tr><td>

Relationship Type

</td><td>

Specifies the type of relationship between the source and target CWE weaknesses. Valid values:-   **Parent/Child**: Hierarchical relationship where one CWE is a parent or child of another.
-   **Peer**: Peer relationship where CWEs are at the same level or category.
-   **Requires/Can Precede**: One CWE requires or can precede another in an attack chain.
-   **Can Also Be**: One CWE can also be classified or manifested as another.

</td></tr></tbody>
</table>## Attribute

The Attribute entity defines metadata attributes that can be assigned to vulnerabilities from the table `sn_sec_tisc_intel_attribute`.

<table id="table_tv2_13c_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Indicates the name used to identify the attribute in the system.

</td></tr><tr><td>

Description

</td><td>

Provides a detailed description of the attribute's purpose, usage, and meaning.

</td></tr><tr><td>

Active

</td><td>

Boolean flag indicating whether the attribute is currently active and available for use.

</td></tr><tr><td>

Internal Identifier

</td><td>

Contains the internal system identifier for the attribute. Used for programmatic reference and integration purposes.

</td></tr><tr><td>

Attribute Type

</td><td>

Specifies the category or type of the attribute.The following are the valid values for this type:

-   **Score attribute**: Attribute related to scoring metrics.
-   **Threat attribute**: Attribute related to threat characteristics or properties.
-   **Other attribute**: General purpose attribute not fitting other categories.
-   **Score value**: Attribute representing a specific score or numerical value.

</td></tr></tbody>
</table>## Vulnerability Attribute Value

The Vulnerability Attribute Value entity stores attribute values assigned to specific vulnerabilities from the table `sn_sec_tisc_m2m_vulnerability_attribute_value`.

|Label|Description|
|-----|-----------|
|Vulnerability|Reference to the vulnerability record that has this attribute value assigned.|
|Attribute|Reference to the attribute definition being assigned to the vulnerability.|
|Qualitative Value|Contains the qualitative or text-based value for the attribute, such as "High" or "Critical". Used when the attribute value is descriptive rather than numeric.|
|Quantitative Value|Contains the quantitative or numeric value for the attribute, such as CVSS scores or probability values. Used when the attribute value is a number or decimal.|

## Vulnerability Identifier

The Vulnerability Identifier entity stores alternative or supplementary identifiers for vulnerabilities from the table `sn_sec_tisc_vulnerability_identifier`.

|Label|Description|
|-----|-----------|
|Vulnerability|Reference to the vulnerability record that this identifier represents.|
|Identifier|Contains the unique identifier value for the vulnerability. This can be a vendor-specific ID or standardized identifier such as GHSA-xxxx-xxxx-xxxx or OSV-xxxx-xxxx.|
|Identifier Assigned By|Indicates the organization or authority that assigned the identifier, such as MITRE, NVD, or GitHub.|

## Vulnerability Vendor Comment

The Vulnerability Vendor Comment entity stores vendor-provided statements and comments about specific vulnerabilities from the table `sn_sec_tisc_m2m_vulnerability_vendor_comment`.

|Label|Description|
|-----|-----------|
|Vulnerability|Reference to the vulnerability record that the vendor is commenting on.|
|Vendor|Reference to the vendor providing the comment.|
|Comment|Contains the vendor's comment or statement about the vulnerability, including vendor-specific clarifications or additional context.|
|Comment Date|Timestamp indicating when the vendor comment was published or last updated.|

## Product Identifier

The Product Identifier entity stores alternative identifiers associated with products from the table `sn_sec_tisc_intel_product_identifier`.

<table id="table_r4g_f3c_j3c"><thead><tr><th>

Label

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Product

</td><td>

Reference to the product record that this identifier belongs to.

</td></tr><tr><td>

Identifier Type

</td><td>

Specifies the type of identifier used for product identification.The following are the valid values for this category:

-   **Hashes**: Cryptographic hash values for verifying product integrity, such as SHA-256 or MD5.
-   **Model Numbers**: Manufacturer's model numbers or part numbers.
-   **PURL**: Package URL, a standardized way to identify software packages.
-   **SBOM URLs**: URLs pointing to Software Bill of Materials documents.
-   **Serial Numbers**: Unique serial numbers assigned to product instances.
-   **SKUs**: Stock Keeping Units for product identification.
-   **Generic URIs**: Generic Uniform Resource Identifiers for product references.

</td></tr><tr><td>

Identifier

</td><td>

Contains the actual identifier value, such as a hash value, model number, PURL string, or serial number.

</td></tr><tr><td>

Additional Information

</td><td>

Provides supplementary information about the identifier, including additional context or notes that clarify or qualify it.

</td></tr></tbody>
</table>## Related Product

The Related Product entity defines relationships between products from the table `sn_sec_tisc_m2m_product`.

|Label|Description|
|-----|-----------|
|Source Product|Reference to the source product in the relationship.|
|Target Product|Reference to the target product in the relationship.|

## Vulnerability Class

The vulnerability class options are configured in the `sn_sec_tisc_vulnerability_class` table, enabling you to define and manage vulnerability class selections on the **Vulnerabilities** page.

|Field|Description|
|-----|-----------|
|Name|Name of the vulnerability class.|
|Description|A brief description of the vulnerability class.|

**Parent Topic:**[Vulnerability Artifacts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/threat-intelligence-security-center/vulnerability.md)