Field mapping for the Vulnerability Response Integration with Wiz
reference brazil Updated Oct 26, 2026 5 min read wiz-vul-resp-integration-view-findings.md
Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform® instance.
Asset Integration field mapping
|
Wiz field |
ServiceNow table |
ServiceNow field |
|---|---|---|
|
id |
sn_sec_cmn_src_ci |
source_id |
|
nativeType |
sn_sec_cmn_src_ci |
cloud_resource_typeAlso, stored in source_data as wiz_native_type |
|
type |
sn_sec_cmn_src_ci |
source_datastored in source_data as ciType |
|
name |
sn_sec_cmn_src_ci |
name |
|
name |
sn_sec_cmn_src_ci |
resource_name |
|
graphEntity.providerUniqueId |
sn_sec_cmn_src_ci |
source_dataIf exist, stored in source_data as provider_unique_id |
|
graphEntity.properties.externalId |
sn_sec_cmn_src_ci |
source_dataIf exist and graphEntity.providerUniqueId does not exist, then it gets stored in source_data as provider_unique_id |
|
lastSeen |
sn_sec_cmn_src_ci |
non_infra_last_scan_dateAlso stored as last_scan_time in source_data field in Discovered item table |
|
firstSeen |
sn_sec_cmn_src_ci |
source_dataStored in source_data as first_seen |
|
isOpenToAllInternet |
sn_sec_cmn_src_ci |
source_dataStored in source_data as is_open_to_all_internet |
|
isAccessibleFromInternet |
sn_sec_cmn_src_ci |
cmdb_ci_internet_facingStored in source_data as is_accessible_from_internet |
|
hasAccessToSensitiveData |
sn_sec_cmn_src_ci |
source_dataStored in source_data as has_access_to_sensitive_data |
|
hasAdminPrivileges |
sn_sec_cmn_src_ci |
source_dataStored in source_data as has_admin_privileges |
|
hasHighPrivileges |
sn_sec_cmn_src_ci |
source_dataStored in source_data as has_high_privileges |
|
hasSensitiveData |
sn_sec_cmn_src_ci |
source_dataStored in source_data as has_sensitive_data |
|
typeFields.operatingSystem |
sn_sec_cmn_src_ci |
os |
|
typeFields.instanceType |
sn_sec_cmn_src_ci |
source_dataStored in source_data as instance_type |
|
resourceGroup.id |
sn_sec_cmn_src_ci |
source_dataStored in source_data as resource_group_id |
|
resourceGroup.name |
sn_sec_cmn_src_ci |
source_dataStored in source_data as resource_group_name |
|
tags |
sn_sec_cmn_src_ci |
host_tag |
|
cloudPlatform |
sn_sec_cmn_src_ci |
cloud_service_provider |
|
region |
sn_sec_cmn_src_ci |
cloud_region |
|
cloudAccount.externalId |
sn_sec_cmn_src_ci |
cloud_account |
|
projects |
sn_sec_cmn_src_ci |
projects |
|
cloudProviderURL |
sn_sec_cmn_src_ci |
resource_idThis is used to retrieve project id in case of GCP cloud platform Serverless resource type. |
|
externalId |
sn_sec_cmn_src_ci |
resource_idThis is used as resource_id in case of Azure cloud platform Virtual machine resource type. |
|
Wiz field |
ServiceNow table |
ServiceNow field |
|---|---|---|
|
description |
sn_vul_detection |
proof |
|
status |
sn_vul_detection |
source_status |
|
lastDetectedAt |
sn_vul_detection |
last_found |
|
firstDetectedAt |
sn_vul_detection |
first_found |
|
vulnerableAsset.name |
sn_vul_detection |
dns |
|
remediation |
sn_vul_detection |
solution_summary |
|
vulnerableAsset.ipAddresses[0] |
sn_vul_detection |
ip_address |
|
vendorSeverity |
sn_vul_detection |
source_severity |
|
fixedVersion |
sn_vul_detection |
fixed_version |
|
status |
sn_vul_detection |
is_ignored |
|
status |
sn_vul_detection |
status |
|
name |
sn_vul_entry |
id |
|
score |
sn_vul_third_party_entry |
v3_base_score |
|
CVEDescription |
sn_vul_third_party_entry |
summary |
|
vendorSeverity |
sn_vul_third_party_entry |
source_severity |
|
cvssv3.attackVector |
sn_vul_third_party_entry |
v3_attack_vector |
|
cvssv3.attackComplexity |
sn_vul_third_party_entry |
v3_attack_complexity |
|
cvssv3.confidentialityImpact |
sn_vul_third_party_entry |
v3_confidentiality_impact |
|
cvssv3.privilegesRequired |
sn_vul_third_party_entry |
v3_privileges_required |
|
cvssv3.integrityImpact |
sn_vul_third_party_entry |
v3_integrity_impact |
|
cvssv3.userInteractionRequired |
sn_vul_third_party_entry |
v3_user_interaction |
|
hasExploit |
sn_vul_third_party_entry |
exploit |
|
hasCisaKevExploit |
sn_vul_third_party_entry |
cisa_exists |
|
vulnerableAsset.tags |
sn_sec_cmn_src_ci |
host_tag |
|
vulnerableAsset.id |
sn_sec_cmn_src_ci |
source_id |
|
vulnerableAsset.name |
sn_sec_cmn_src_ci |
name |
|
vulnerableAsset.region |
sn_sec_cmn_src_ci |
cloud_region |
|
vulnerableAsset.providerUniqueId |
sn_sec_cmn_src_ci |
resource_id |
|
vulnerableAsset.cloudPlatform |
sn_sec_cmn_src_ci |
cloud_service_provider |
|
vulnerableAsset.type |
sn_sec_cmn_src_ci |
assetType |
|
relatedIssueAnalytics |
sn_sec_cmn_src_ci |
source_data |
|
vulnerableAsset.nativeType |
sn_sec_cmn_src_ci |
cloud_resource_type |
|
vulnerableAsset.subscriptionExternalId |
sn_sec_cmn_src_ci |
cloud_account |
|
vulnerableAsset.name |
sn_sec_cmn_src_ci |
resource_name |
|
vulnerableAsset.imageName |
sn_sec_cmn_src_ci |
image_id |
|
vulnerableAsset.* |
sn_sec_cmn_src_ci |
source_dataAll the details inside vulnerableAsset are added in source_data field. |
|
lastDetectedAt |
sn_sec_cmn_src_ci |
source_data |
| Wiz field | ServiceNow table | ServiceNow field |
|---|---|---|
| imageId | sn_vul_container_image | image_id |
| vulnerableAsset.name | sn_vul_container_image | image_name |
| vulnerableAsset.repository.externalId after ## | sn_vul_container_image | registry |
| vulnerableAsset.repository.externalId before ## | sn_vul_container_image | repo |
| vulnerableAsset.tags | sn_vul_container_image | image_labels |
| projects | sn_vul_container_image | image_projects |
| vulnerableAsset.region | sn_vul_container_image | cloud_regions |
| vulnerableAsset.cloudPlatform | sn_vul_container_image | cloud_providers |
| vulnerableAsset.subscriptionExternalId | sn_vul_container_image | cloud_account_ids |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image | image_namespace |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image | image_clusters |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image_vulnerable_item | image_clusters |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image_vulnerable_item | image_namespace |
| vulnerableAsset.repository.externalId before ## | sn_vul_container_image_vulnerable_item | image_repository |
| layerMetadata.isBaseLayer | sn_vul_container_image_findings | is_base_image |
| firstDetectedAt | sn_vul_container_image_findings | first_found |
| lastDetectedAt | sn_vul_container_image_findings | last_found |
| detailedName | sn_vul_container_image_package | name |
| version | sn_vul_container_image_package | version |
| locationPath | sn_vul_container_image_package | path |
| name | sn_vul_entry | id |
| score | sn_vul_third_party_entry | v3_base_score |
| CVEDescription | sn_vul_third_party_entry | summary |
| vendorseverity | sn_vul_third_party_entry | source_severity |
| cvssv3.attackVector | sn_vul_third_party_entry | v3_attack_vector |
| cvssv3.attackComplexity | sn_vul_third_party_entry | v3_attack_complexity |
| cvssv3.confidentialityImpact | sn_vul_third_party_entry | v3_confidentiality_impact |
| cvssv3.privilegesRequired | sn_vul_third_party_entry | v3_privileges_required |
| cvssv3.integrityImpact | sn_vul_third_party_entry | v3_integrity_impact |
| cvssv3.userInteractionRequired | sn_vul_third_party_entry | v3_user_interaction |
| hasExploit | sn_vul_third_party_entry | hasExploit |
| layerMetadata.isBaseLayer | sn_vul_container_image_layer | Base layer |
| layerMetadata.details | sn_vul_container_image_layer | instruction |
| layerMetadata.id | sn_vul_container_image_layer | id |
| status | sn_vul_container_image_findings | is_ignored |
| validate_at_runtime | sn_vul_container_image_findings | validate_at_runtime |
| id | sn_vul_container_image_findings | unique_key |
| fixed_version | sn_vul_container_image_findings | fix_status |
Configuration Compliance Test Results Integration field mapping
|
Wiz field |
ServiceNow table |
ServiceNow field |
|---|---|---|
|
rule.id |
sn_vulc_test |
source_id |
|
rule.name |
sn_vulc_test |
short_description |
|
rule.remediationInstructions |
sn_vulc_test |
remediation |
|
rule.description |
sn_vulc_test |
description |
|
severity |
sn_vulc_test |
source_criticality |
|
status |
sn_vulc_result |
result |
|
id |
sn_vulc_result |
source_id |
|
analyzedAt |
sn_vulc_result |
last_seen |
|
firstSeenAt |
sn_vulc_result |
first_seen |
|
rule.remediationInstructions |
sn_vulc_result |
remediation |
|
resource.nativeType |
sn_sec_cmn_src_ci |
source_data |
|
resource.type |
sn_sec_cmn_src_ci |
source_data |
|
id |
sn_vulc_result |
description |
|
id |
sn_vulc_result |
source_id |
|
securitySubCategories.category.framework.id |
sn_vulc_auth_src |
source_id |
|
securitySubCategories.category.framework.name |
sn_vulc_auth_src |
short_description |
|
securitySubCategories.category.framework.description |
sn_vulc_auth_src |
description |
|
securitySubCategories.id |
sn_vulc_citation |
section |
|
securitySubCategories.title |
sn_vulc_citation |
section_name |
|
resource.projects |
sn_sec_cmn_src_ci |
projects |
|
status |
sn_vulc_result |
is_ignoredif status is Rejected, is_ignored is set to true, else false. |
Note: Data mapped for the Issues Integration to cloud test results (CTRs) are labeled with Wiz Issues as the source to help you differentiate these CTRs from the test results integration CTRs.
|
Wiz field |
ServiceNow table |
ServiceNow field |
|---|---|---|
|
sourceRule.id |
sn_vulc_test |
source_id |
|
sourceRule.name |
sn_vulc_test |
short_description |
|
sourceRule.resolutionRecommendation/sourceRule.remediationInstructions |
sn_vulc_test |
remediation |
|
sourceRule.description |
sn_vulc_test |
description |
|
severity |
sn_vulc_test |
source_criticality |
|
createdAt |
sn_vulc_result |
first_seen |
|
updatedAt |
sn_vulc_result |
last_seen |
|
status |
sn_vulc_result |
result |
|
id |
sn_vulc_result |
source_id |
|
sourceRule.resolutionRecommendation/sourceRule.remediationInstructions |
sn_vulc_result |
remediation |
|
sourceRule.controlDescription |
sn_vulc_result |
description |
|
entitySnapshot.nativeType |
sn_sec_cmn_src_ci |
source_data |
|
entitySnapshot.type |
sn_sec_cmn_src_ci |
source_data |
|
Wiz issue |
sn_vulc_result |
result_type |
|
id |
sn_vulc_result |
description |
|
severity |
sn_vulc_test |
source_criticality |
|
id |
sn_vulc_result |
source_id |
|
sourcerule.securitySubCategories.category.framework.id |
sn_vulc_auth_src |
source_id |
|
sourcerule.securitySubCategories.category.framework.name |
sn_vulc_auth_src |
short_description |
|
sourcerule.securitySubCategories.category.framework.description |
sn_vulc_auth_src |
description |
|
sourcerule.securitySubCategories.id |
sn_vulc_citation |
section |
|
sourcerule.securitySubCategories.title |
sn_vulc_citation |
section_name |
|
projects |
sn_sec_cmn_src_ci |
projects |
|
status |
sn_vulc_result |
is_ignoredif status is Rejected, is_ignored is set to true, else false. |
| Wiz JSON Field | ServiceNow Table | ServiceNow Field |
|---|---|---|
| name | sn_vul_app_vul_entry | id |
| CVEDescription | sn_vul_app_vul_entry | threat, summary |
| CVSSSeverity | sn_vul_app_vul_entry | source_severity |
| cvssv3.attackVector | sn_vul_app_vul_entry | v3_attack_vector |
| cvssv3.attackComplexity | sn_vul_app_vul_entry | v3_attack_complexity |
| cvssv3.confidentialityImpact | sn_vul_app_vul_entry | v3_confidentiality_impact |
| cvssv3.privilegesRequired | sn_vul_app_vul_entry | v3_privileges_required |
| cvssv3.integrityImpact | sn_vul_app_vul_entry | v3_integrity_impact |
| cvssv3.userInteractionRequired | sn_vul_app_vul_entry | v3_user_interaction |
| hasExploit | sn_vul_app_vul_entry | exploit |
| hasCisaKevExploit | sn_vul_app_vul_entry | cisa_exists |
| id | sn_vul_app_vulnerable_item | source_avit_id |
| name | sn_vul_app_vulnerable_item | source_entry_id |
| vendorSeverity | sn_vul_app_vulnerable_item | source_severity |
| status | sn_vul_app_vulnerable_item | computed_status, source_remediation_status, source_finding_status |
| status == REJECTED | sn_vul_app_vulnerable_item | is_ignored = "true" |
| description | sn_vul_app_vulnerable_item | source_vulnerability_summary, description |
| remediation | sn_vul_app_vulnerable_item | source_recommendation |
| link | sn_vul_app_vulnerable_item | source_notes |
| portalUrl | sn_vul_app_vulnerable_item | source_link |
| locationPath | sn_vul_app_vulnerable_item | location (part of affected_url) |
| lastDetectedAt | sn_vul_app_vulnerable_item | last_found (date), last_found_dt_tm (datetime) |
| firstDetectedAt | sn_vul_app_vulnerable_item | first_found |
| resolvedAt | sn_vul_app_vulnerable_item | source_resolved_date |
| projects | sn_vul_app_vulnerable_item, sn_sec_cmn_projects | source_additional_info_string, projects |
| vulnerableAsset.repositoryId | sn_vul_app_vulnerable_item, sn_vul_app_release, sn_vul_app_vul_scan_summary | source_app_id |
| vulnerableAsset.repositoryName | sn_vul_app_vulnerable_item, sn_vul_app_release | app_name |
| vulnerableAsset.cloudProviderURL | sn_vul_app_vulnerable_item | affected_url (prepended to locationPath) |
| detailedName | sn_vul_app_vulnerable_item, sn_vul_app_package | package_unique_id, package_name |
| version | sn_vul_app_package | package_version |
| fixedVersion | sn_vul_app_package | fixed_package_version |
| lastDetectedAt | sn_vul_app_vul_scan_summary | last_scan_date |
Important: Fixed values for SCA Findings:
- sn_vul_app_vulnerable_item.scan_type = "sca"
- sn_vul_app_vul_scan_summary.source_scan_id = "Wiz_SCA_Scan"
- sn_vul_app_vul_scan_summary.scan_summary_name = "Wiz SCA Scan"
Wiz Secret Findings Integration
| Wiz JSON Field | ServiceNow Table | ServiceNow Field |
|---|---|---|
| rule.id | sn_vul_app_vul_entry | id (stored as "Wiz-" + rule.id) |
| rule.name | sn_vul_app_vul_entry | threat, summary |
| severity | sn_vul_app_vul_entry | source_severity |
| id | sn_vul_app_vulnerable_item | source_avit_id |
| rule.id | sn_vul_app_vulnerable_item | source_entry_id (as "Wiz-" + rule.id) |
| severity | sn_vul_app_vulnerable_item | source_severity |
| status | sn_vul_app_vulnerable_item | computed_status, source_remediation_status, source_finding_status |
| path | sn_vul_app_vulnerable_item | location (part of source_link and description) |
| lineNumber | sn_vul_app_vulnerable_item | line_number |
| firstSeenAt | sn_vul_app_vulnerable_item | first_found |
| lastSeenAt | sn_vul_app_vulnerable_item | last_found (date), last_found_dt_tm (datetime) |
| resolvedAt | sn_vul_app_vulnerable_item | source_resolved_date |
| externalId | sn_vul_app_vulnerable_item | source_notes |
| relatedIssueAnalytics | sn_vul_app_vulnerable_item | source_additional_info_string |
| resource.typedProperties.repository.id | sn_vul_app_vulnerable_item, sn_vul_app_release, sn_vul_app_vul_scan_summary | source_app_id |
| resource.typedProperties.repository.name | sn_vul_app_vulnerable_item, sn_vul_app_release | app_name (part of description) |
| resource.typedProperties.repository.url | sn_vul_app_vulnerable_item | source_link (base), part of description |
| resource.type + resource.externalId | sn_vul_app_vulnerable_item | source_link (branch suffix) |
| lastSeenAt | sn_vul_app_vul_scan_summary | last_scan_date |
Important: Fixed values for Secret Findings:
- sn_vul_app_vulnerable_item.scan_type = "secret"
- sn_vul_app_vul_scan_summary.source_scan_id = "Wiz_Secret_Scan"
- sn_vul_app_vul_scan_summary.scan_summary_name = "Wiz Secret Scan"
Wiz Application List Integration
| Wiz JSON Field | ServiceNow Table | ServiceNow Field |
|---|---|---|
| id | sn_vul_app_release | source_app_id |
| name | sn_vul_app_release | app_name |
| createdAt | sn_vul_app_release | app_creation_date |
| updatedAt | sn_vul_app_release | app_updation_date |
| lastSeen | sn_vul_app_release | last_seen_date |
| graphEntity.properties.description | sn_vul_app_release | description |
| All other graphEntity.properties.* + technology | sn_vul_app_release | source_additional_info |
Important: Fixed values for Application List: sn_vul_app_release.active = true
Mapping to vulnerable item and test result records
- The Asset Integration imports data about your cloud assets reported by the Wiz scanner.
- Host vulnerability findings are mapped to host vulnerable items (VITs).
- Host test results that are associated with the resource type, VIRTUAL MACHINE are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- Container vulnerability findings are mapped to container vulnerable items (CVITs).
- Configuration test results findings are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- Issues findings are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- The Backfill Integrations import and process any Asset IDs that are reported as missing by the primary vulnerability and compliance integrations.
1,517 lines · 22.3 KB
--- title: Field mapping for the Vulnerability Response Integration with Wiz description: Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance. locale: en-US canonical_url: https://www.servicenow.com/docs/r/security-management/vulnerability-response/wiz-vul-resp-integration-view-findings.html release: brazil product: Vulnerability Response classification: vulnerability-response topic_type: reference last_updated: "2026-10-26" reading_time_minutes: 5 breadcrumb: [Vulnerability Response Integration with Wiz, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Field mapping for the Vulnerability Response Integration with Wiz Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform® instance. ## Asset Integration field mapping <table id="table_wwz_tyc_sgc"><thead><tr><th> Wiz field </th><th> ServiceNow table </th><th> ServiceNow field </th></tr></thead><tbody><tr><td> id </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_id </td></tr><tr><td> nativeType </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_resource\_typeAlso, stored in source\_data as wiz\_native\_type </td></tr><tr><td> type </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_datastored in source\_data as ciType </td></tr><tr><td> name </td><td> sn\_sec\_cmn\_src\_ci </td><td> name </td></tr><tr><td> name </td><td> sn\_sec\_cmn\_src\_ci </td><td> resource\_name </td></tr><tr><td> graphEntity.providerUniqueId </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataIf exist, stored in source\_data as provider\_unique\_id </td></tr><tr><td> graphEntity.properties.externalId </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataIf exist and graphEntity.providerUniqueId does not exist, then it gets stored in source\_data as provider\_unique\_id </td></tr><tr><td> lastSeen </td><td> sn\_sec\_cmn\_src\_ci </td><td> non\_infra\_last\_scan\_dateAlso stored as last\_scan\_time in source\_data field in Discovered item table </td></tr><tr><td> firstSeen </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as first\_seen </td></tr><tr><td> isOpenToAllInternet </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as is\_open\_to\_all\_internet </td></tr><tr><td> isAccessibleFromInternet </td><td> sn\_sec\_cmn\_src\_ci </td><td> cmdb\_ci\_internet\_facingStored in source\_data as is\_accessible\_from\_internet </td></tr><tr><td> hasAccessToSensitiveData </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as has\_access\_to\_sensitive\_data </td></tr><tr><td> hasAdminPrivileges </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as has\_admin\_privileges </td></tr><tr><td> hasHighPrivileges </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as has\_high\_privileges </td></tr><tr><td> hasSensitiveData </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as has\_sensitive\_data </td></tr><tr><td> typeFields.operatingSystem </td><td> sn\_sec\_cmn\_src\_ci </td><td> os </td></tr><tr><td> typeFields.instanceType </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as instance\_type </td></tr><tr><td> resourceGroup.id </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as resource\_group\_id </td></tr><tr><td> resourceGroup.name </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataStored in source\_data as resource\_group\_name </td></tr><tr><td> tags </td><td> sn\_sec\_cmn\_src\_ci </td><td> host\_tag </td></tr><tr><td> cloudPlatform </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_service\_provider </td></tr><tr><td> region </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_region </td></tr><tr><td> cloudAccount.externalId </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_account </td></tr><tr><td> projects </td><td> sn\_sec\_cmn\_src\_ci </td><td> projects </td></tr><tr><td> cloudProviderURL </td><td> sn\_sec\_cmn\_src\_ci </td><td> resource\_idThis is used to retrieve project id in case of GCP cloud platform Serverless resource type. </td></tr><tr><td> externalId </td><td> sn\_sec\_cmn\_src\_ci </td><td> resource\_idThis is used as resource\_id in case of Azure cloud platform Virtual machine resource type. </td></tr></tbody> </table>## Host vulnerability Integration field mapping <table id="table_dty_z2c_cgc"><thead><tr><th> Wiz field </th><th> ServiceNow table </th><th> ServiceNow field </th></tr></thead><tbody><tr><td> description </td><td> sn\_vul\_detection </td><td> proof </td></tr><tr><td> status </td><td> sn\_vul\_detection </td><td> source\_status </td></tr><tr><td> lastDetectedAt </td><td> sn\_vul\_detection </td><td> last\_found </td></tr><tr><td> firstDetectedAt </td><td> sn\_vul\_detection </td><td> first\_found </td></tr><tr><td> vulnerableAsset.name </td><td> sn\_vul\_detection </td><td> dns </td></tr><tr><td> remediation </td><td> sn\_vul\_detection </td><td> solution\_summary </td></tr><tr><td> vulnerableAsset.ipAddresses\[0\] </td><td> sn\_vul\_detection </td><td> ip\_address </td></tr><tr><td> vendorSeverity </td><td> sn\_vul\_detection </td><td> source\_severity </td></tr><tr><td> fixedVersion </td><td> sn\_vul\_detection </td><td> fixed\_version </td></tr><tr><td> status </td><td> sn\_vul\_detection </td><td> is\_ignored </td></tr><tr><td> status </td><td> sn\_vul\_detection </td><td> status </td></tr><tr><td> name </td><td> sn\_vul\_entry </td><td> id </td></tr><tr><td> score </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_base\_score </td></tr><tr><td> CVEDescription </td><td> sn\_vul\_third\_party\_entry </td><td> summary </td></tr><tr><td> vendorSeverity </td><td> sn\_vul\_third\_party\_entry </td><td> source\_severity </td></tr><tr><td> cvssv3.attackVector </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_attack\_vector </td></tr><tr><td> cvssv3.attackComplexity </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_attack\_complexity </td></tr><tr><td> cvssv3.confidentialityImpact </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_confidentiality\_impact </td></tr><tr><td> cvssv3.privilegesRequired </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_privileges\_required </td></tr><tr><td> cvssv3.integrityImpact </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_integrity\_impact </td></tr><tr><td> cvssv3.userInteractionRequired </td><td> sn\_vul\_third\_party\_entry </td><td> v3\_user\_interaction </td></tr><tr><td> hasExploit </td><td> sn\_vul\_third\_party\_entry </td><td> exploit </td></tr><tr><td> hasCisaKevExploit </td><td> sn\_vul\_third\_party\_entry </td><td> cisa\_exists </td></tr><tr><td> vulnerableAsset.tags </td><td> sn\_sec\_cmn\_src\_ci </td><td> host\_tag </td></tr><tr><td> vulnerableAsset.id </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_id </td></tr><tr><td> vulnerableAsset.name </td><td> sn\_sec\_cmn\_src\_ci </td><td> name </td></tr><tr><td> vulnerableAsset.region </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_region </td></tr><tr><td> vulnerableAsset.providerUniqueId </td><td> sn\_sec\_cmn\_src\_ci </td><td> resource\_id </td></tr><tr><td> vulnerableAsset.cloudPlatform </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_service\_provider </td></tr><tr><td> vulnerableAsset.type </td><td> sn\_sec\_cmn\_src\_ci </td><td> assetType </td></tr><tr><td> relatedIssueAnalytics </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr><tr><td> vulnerableAsset.nativeType </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_resource\_type </td></tr><tr><td> vulnerableAsset.subscriptionExternalId </td><td> sn\_sec\_cmn\_src\_ci </td><td> cloud\_account </td></tr><tr><td> vulnerableAsset.name </td><td> sn\_sec\_cmn\_src\_ci </td><td> resource\_name </td></tr><tr><td> vulnerableAsset.imageName </td><td> sn\_sec\_cmn\_src\_ci </td><td> image\_id </td></tr><tr><td> vulnerableAsset.\* </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_dataAll the details inside vulnerableAsset are added in source\_data field. </td></tr><tr><td> lastDetectedAt </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr></tbody> </table>## Container vulnerability Integration field mapping |Wiz field|ServiceNow table|ServiceNow field| |---------|----------------|----------------| |imageId|sn\_vul\_container\_image|image\_id| |vulnerableAsset.name|sn\_vul\_container\_image|image\_name| |vulnerableAsset.repository.externalId after \#\#|sn\_vul\_container\_image|registry| |vulnerableAsset.repository.externalId before \#\#|sn\_vul\_container\_image|repo| |vulnerableAsset.tags|sn\_vul\_container\_image|image\_labels| |projects|sn\_vul\_container\_image|image\_projects| |vulnerableAsset.region|sn\_vul\_container\_image|cloud\_regions| |vulnerableAsset.cloudPlatform|sn\_vul\_container\_image|cloud\_providers| |vulnerableAsset.subscriptionExternalId|sn\_vul\_container\_image|cloud\_account\_ids| |vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image|image\_namespace| |vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image|image\_clusters| |vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image\_vulnerable\_item|image\_clusters| |vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image\_vulnerable\_item|image\_namespace| |vulnerableAsset.repository.externalId before \#\#|sn\_vul\_container\_image\_vulnerable\_item|image\_repository| |layerMetadata.isBaseLayer|sn\_vul\_container\_image\_findings|is\_base\_image| |firstDetectedAt|sn\_vul\_container\_image\_findings|first\_found| |lastDetectedAt|sn\_vul\_container\_image\_findings|last\_found| |detailedName|sn\_vul\_container\_image\_package|name| |version|sn\_vul\_container\_image\_package|version| |locationPath|sn\_vul\_container\_image\_package|path| |name|sn\_vul\_entry|id| |score|sn\_vul\_third\_party\_entry|v3\_base\_score| |CVEDescription|sn\_vul\_third\_party\_entry|summary| |vendorseverity|sn\_vul\_third\_party\_entry|source\_severity| |cvssv3.attackVector|sn\_vul\_third\_party\_entry|v3\_attack\_vector| |cvssv3.attackComplexity|sn\_vul\_third\_party\_entry|v3\_attack\_complexity| |cvssv3.confidentialityImpact|sn\_vul\_third\_party\_entry|v3\_confidentiality\_impact| |cvssv3.privilegesRequired|sn\_vul\_third\_party\_entry|v3\_privileges\_required| |cvssv3.integrityImpact|sn\_vul\_third\_party\_entry|v3\_integrity\_impact| |cvssv3.userInteractionRequired|sn\_vul\_third\_party\_entry|v3\_user\_interaction| |hasExploit|sn\_vul\_third\_party\_entry|hasExploit| |layerMetadata.isBaseLayer|sn\_vul\_container\_image\_layer|Base layer| |layerMetadata.details|sn\_vul\_container\_image\_layer|instruction| |layerMetadata.id|sn\_vul\_container\_image\_layer|id| |status|sn\_vul\_container\_image\_findings|is\_ignored| |validate\_at\_runtime|sn\_vul\_container\_image\_findings|validate\_at\_runtime| |id|sn\_vul\_container\_image\_findings|unique\_key| |fixed\_version|sn\_vul\_container\_image\_findings|fix\_status| ## Configuration Compliance Test Results Integration field mapping <table id="table_p5l_ngc_cgc"><thead><tr><th> Wiz field </th><th> ServiceNow table </th><th> ServiceNow field </th></tr></thead><tbody><tr><td> rule.id </td><td> sn\_vulc\_test </td><td> source\_id </td></tr><tr><td> rule.name </td><td> sn\_vulc\_test </td><td> short\_description </td></tr><tr><td> rule.remediationInstructions </td><td> sn\_vulc\_test </td><td> remediation </td></tr><tr><td> rule.description </td><td> sn\_vulc\_test </td><td> description </td></tr><tr><td> severity </td><td> sn\_vulc\_test </td><td> source\_criticality </td></tr><tr><td> status </td><td> sn\_vulc\_result </td><td> result </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> source\_id </td></tr><tr><td> analyzedAt </td><td> sn\_vulc\_result </td><td> last\_seen </td></tr><tr><td> firstSeenAt </td><td> sn\_vulc\_result </td><td> first\_seen </td></tr><tr><td> rule.remediationInstructions </td><td> sn\_vulc\_result </td><td> remediation </td></tr><tr><td> resource.nativeType </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr><tr><td> resource.type </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> description </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> source\_id </td></tr><tr><td> securitySubCategories.category.framework.id </td><td> sn\_vulc\_auth\_src </td><td> source\_id </td></tr><tr><td> securitySubCategories.category.framework.name </td><td> sn\_vulc\_auth\_src </td><td> short\_description </td></tr><tr><td> securitySubCategories.category.framework.description </td><td> sn\_vulc\_auth\_src </td><td> description </td></tr><tr><td> securitySubCategories.id </td><td> sn\_vulc\_citation </td><td> section </td></tr><tr><td> securitySubCategories.title </td><td> sn\_vulc\_citation </td><td> section\_name </td></tr><tr><td> resource.projects </td><td> sn\_sec\_cmn\_src\_ci </td><td> projects </td></tr><tr><td> status </td><td> sn\_vulc\_result </td><td> is\_ignoredif status is Rejected, is\_ignored is set to true, else false. </td></tr></tbody> </table>## Issues Integration field mapping **Note:** Data mapped for the Issues Integration to cloud test results \(CTRs\) are labeled with `Wiz Issues` as the source to help you differentiate these CTRs from the test results integration CTRs. <table id="table_tn5_hhc_cgc"><thead><tr><th> Wiz field </th><th> ServiceNow table </th><th> ServiceNow field </th></tr></thead><tbody><tr><td> sourceRule.id </td><td> sn\_vulc\_test </td><td> source\_id </td></tr><tr><td> sourceRule.name </td><td> sn\_vulc\_test </td><td> short\_description </td></tr><tr><td> sourceRule.resolutionRecommendation/sourceRule.remediationInstructions </td><td> sn\_vulc\_test </td><td> remediation </td></tr><tr><td> sourceRule.description </td><td> sn\_vulc\_test </td><td> description </td></tr><tr><td> severity </td><td> sn\_vulc\_test </td><td> source\_criticality </td></tr><tr><td> createdAt </td><td> sn\_vulc\_result </td><td> first\_seen </td></tr><tr><td> updatedAt </td><td> sn\_vulc\_result </td><td> last\_seen </td></tr><tr><td> status </td><td> sn\_vulc\_result </td><td> result </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> source\_id </td></tr><tr><td> sourceRule.resolutionRecommendation/sourceRule.remediationInstructions </td><td> sn\_vulc\_result </td><td> remediation </td></tr><tr><td> sourceRule.controlDescription </td><td> sn\_vulc\_result </td><td> description </td></tr><tr><td> entitySnapshot.nativeType </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr><tr><td> entitySnapshot.type </td><td> sn\_sec\_cmn\_src\_ci </td><td> source\_data </td></tr><tr><td> Wiz issue </td><td> sn\_vulc\_result </td><td> result\_type </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> description </td></tr><tr><td> severity </td><td> sn\_vulc\_test </td><td> source\_criticality </td></tr><tr><td> id </td><td> sn\_vulc\_result </td><td> source\_id </td></tr><tr><td> sourcerule.securitySubCategories.category.framework.id </td><td> sn\_vulc\_auth\_src </td><td> source\_id </td></tr><tr><td> sourcerule.securitySubCategories.category.framework.name </td><td> sn\_vulc\_auth\_src </td><td> short\_description </td></tr><tr><td> sourcerule.securitySubCategories.category.framework.description </td><td> sn\_vulc\_auth\_src </td><td> description </td></tr><tr><td> sourcerule.securitySubCategories.id </td><td> sn\_vulc\_citation </td><td> section </td></tr><tr><td> sourcerule.securitySubCategories.title </td><td> sn\_vulc\_citation </td><td> section\_name </td></tr><tr><td> projects </td><td> sn\_sec\_cmn\_src\_ci </td><td> projects </td></tr><tr><td> status </td><td> sn\_vulc\_result </td><td> is\_ignoredif status is Rejected, is\_ignored is set to true, else false. </td></tr></tbody> </table>## Wiz SCA Findings Integration |Wiz JSON Field|ServiceNow Table|ServiceNow Field| |--------------|----------------|----------------| |name|sn\_vul\_app\_vul\_entry|id| |CVEDescription|sn\_vul\_app\_vul\_entry|threat, summary| |CVSSSeverity|sn\_vul\_app\_vul\_entry|source\_severity| |cvssv3.attackVector|sn\_vul\_app\_vul\_entry|v3\_attack\_vector| |cvssv3.attackComplexity|sn\_vul\_app\_vul\_entry|v3\_attack\_complexity| |cvssv3.confidentialityImpact|sn\_vul\_app\_vul\_entry|v3\_confidentiality\_impact| |cvssv3.privilegesRequired|sn\_vul\_app\_vul\_entry|v3\_privileges\_required| |cvssv3.integrityImpact|sn\_vul\_app\_vul\_entry|v3\_integrity\_impact| |cvssv3.userInteractionRequired|sn\_vul\_app\_vul\_entry|v3\_user\_interaction| |hasExploit|sn\_vul\_app\_vul\_entry|exploit| |hasCisaKevExploit|sn\_vul\_app\_vul\_entry|cisa\_exists| |id|sn\_vul\_app\_vulnerable\_item|source\_avit\_id| |name|sn\_vul\_app\_vulnerable\_item|source\_entry\_id| |vendorSeverity|sn\_vul\_app\_vulnerable\_item|source\_severity| |status|sn\_vul\_app\_vulnerable\_item|computed\_status, source\_remediation\_status, source\_finding\_status| |status == REJECTED|sn\_vul\_app\_vulnerable\_item|is\_ignored = "true"| |description|sn\_vul\_app\_vulnerable\_item|source\_vulnerability\_summary, description| |remediation|sn\_vul\_app\_vulnerable\_item|source\_recommendation| |link|sn\_vul\_app\_vulnerable\_item|source\_notes| |portalUrl|sn\_vul\_app\_vulnerable\_item|source\_link| |locationPath|sn\_vul\_app\_vulnerable\_item|location \(part of affected\_url\)| |lastDetectedAt|sn\_vul\_app\_vulnerable\_item|last\_found \(date\), last\_found\_dt\_tm \(datetime\)| |firstDetectedAt|sn\_vul\_app\_vulnerable\_item|first\_found| |resolvedAt|sn\_vul\_app\_vulnerable\_item|source\_resolved\_date| |projects|sn\_vul\_app\_vulnerable\_item, sn\_sec\_cmn\_projects|source\_additional\_info\_string, projects| |vulnerableAsset.repositoryId|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release, sn\_vul\_app\_vul\_scan\_summary|source\_app\_id| |vulnerableAsset.repositoryName|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release|app\_name| |vulnerableAsset.cloudProviderURL|sn\_vul\_app\_vulnerable\_item|affected\_url \(prepended to locationPath\)| |detailedName|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_package|package\_unique\_id, package\_name| |version|sn\_vul\_app\_package|package\_version| |fixedVersion|sn\_vul\_app\_package|fixed\_package\_version| |lastDetectedAt|sn\_vul\_app\_vul\_scan\_summary|last\_scan\_date| **Important:** Fixed values for SCA Findings: - sn\_vul\_app\_vulnerable\_item.scan\_type = "sca" - sn\_vul\_app\_vul\_scan\_summary.source\_scan\_id = "Wiz\_SCA\_Scan" - sn\_vul\_app\_vul\_scan\_summary.scan\_summary\_name = "Wiz SCA Scan" ## Wiz Secret Findings Integration |Wiz JSON Field|ServiceNow Table|ServiceNow Field| |--------------|----------------|----------------| |rule.id|sn\_vul\_app\_vul\_entry|id \(stored as "Wiz-" + rule.id\)| |rule.name|sn\_vul\_app\_vul\_entry|threat, summary| |severity|sn\_vul\_app\_vul\_entry|source\_severity| |id|sn\_vul\_app\_vulnerable\_item|source\_avit\_id| |rule.id|sn\_vul\_app\_vulnerable\_item|source\_entry\_id \(as "Wiz-" + rule.id\)| |severity|sn\_vul\_app\_vulnerable\_item|source\_severity| |status|sn\_vul\_app\_vulnerable\_item|computed\_status, source\_remediation\_status, source\_finding\_status| |path|sn\_vul\_app\_vulnerable\_item|location \(part of source\_link and description\)| |lineNumber|sn\_vul\_app\_vulnerable\_item|line\_number| |firstSeenAt|sn\_vul\_app\_vulnerable\_item|first\_found| |lastSeenAt|sn\_vul\_app\_vulnerable\_item|last\_found \(date\), last\_found\_dt\_tm \(datetime\)| |resolvedAt|sn\_vul\_app\_vulnerable\_item|source\_resolved\_date| |externalId|sn\_vul\_app\_vulnerable\_item|source\_notes| |relatedIssueAnalytics|sn\_vul\_app\_vulnerable\_item|source\_additional\_info\_string| |resource.typedProperties.repository.id|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release, sn\_vul\_app\_vul\_scan\_summary|source\_app\_id| |resource.typedProperties.repository.name|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release|app\_name \(part of description\)| |resource.typedProperties.repository.url|sn\_vul\_app\_vulnerable\_item|source\_link \(base\), part of description| |resource.type + resource.externalId|sn\_vul\_app\_vulnerable\_item|source\_link \(branch suffix\)| |lastSeenAt|sn\_vul\_app\_vul\_scan\_summary|last\_scan\_date| **Important:** Fixed values for Secret Findings: - sn\_vul\_app\_vulnerable\_item.scan\_type = "secret" - sn\_vul\_app\_vul\_scan\_summary.source\_scan\_id = "Wiz\_Secret\_Scan" - sn\_vul\_app\_vul\_scan\_summary.scan\_summary\_name = "Wiz Secret Scan" ## Wiz Application List Integration |Wiz JSON Field|ServiceNow Table|ServiceNow Field| |--------------|----------------|----------------| |id|sn\_vul\_app\_release|source\_app\_id| |name|sn\_vul\_app\_release|app\_name| |createdAt|sn\_vul\_app\_release|app\_creation\_date| |updatedAt|sn\_vul\_app\_release|app\_updation\_date| |lastSeen|sn\_vul\_app\_release|last\_seen\_date| |graphEntity.properties.description|sn\_vul\_app\_release|description| |All other graphEntity.properties.\* + technology|sn\_vul\_app\_release|source\_additional\_info| **Important:** Fixed values for Application List: sn\_vul\_app\_release.active = true ## Mapping to vulnerable item and test result records - The Asset Integration imports data about your cloud assets reported by the Wiz scanner. - Host vulnerability findings are mapped to host vulnerable items \(VITs\). - Host test results that are associated with the resource type, VIRTUAL MACHINE are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application. - Container vulnerability findings are mapped to container vulnerable items \(CVITs\). - Configuration test results findings are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application. - Issues findings are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application. - The Backfill Integrations import and process any Asset IDs that are reported as missing by the primary vulnerability and compliance integrations.
| title | Field mapping for the Vulnerability Response Integration with Wiz |
| description | Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/security-management/vulnerability-response/wiz-vul-resp-integration-view-findings.html |
| release | brazil |
| product | Vulnerability Response |
| classification | vulnerability-response |
| topic_type | reference |
| last_updated | 2026-10-26 |
| reading_time_minutes | 5 |
| breadcrumb | Vulnerability Response Integration with WizVulnerability Response integrationsVulnerability ResponseUnified Security Exposure ManagementSecurity Operations |