Wiz Vulnerability Response Integration › Vulnerability Response integrations › Vulnerability Response › Unified Security Exposure Management › Security Operations
Field mapping for the Wiz Vulnerability Response Integrations
Review source and target fields and view imported data on tables and records in your ServiceNow Now Platform AI instance.
Asset Integration field mapping
| Wiz field | ServiceNow table | ServiceNow field |
|---|
| id | sn\_sec\_cmn\_src\_ci | source\_id |
| nativeType | sn\_sec\_cmn\_src\_ci | cloud\_resource\_typeAlso, stored in source\_data as wiz\_native\_type |
| type | sn\_sec\_cmn\_src\_ci | source\_datastored in source\_data as ciType |
| name | sn\_sec\_cmn\_src\_ci | name |
| name | sn\_sec\_cmn\_src\_ci | resource\_name |
| graphEntity.providerUniqueId | sn\_sec\_cmn\_src\_ci | source\_dataIf exist, stored in source\_data as provider\_unique\_id |
| graphEntity.properties.externalId | sn\_sec\_cmn\_src\_ci | source\_dataIf exist and graphEntity.providerUniqueId does not exist, then it gets stored in source\_data as provider\_unique\_id |
| lastSeen | sn\_sec\_cmn\_src\_ci | non\_infra\_last\_scan\_dateAlso stored as last\_scan\_time in source\_data field in Discovered item table |
| firstSeen | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as first\_seen |
| isOpenToAllInternet | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as is\_open\_to\_all\_internet |
| isAccessibleFromInternet | sn\_sec\_cmn\_src\_ci | cmdb\_ci\_internet\_facingStored in source\_data as is\_accessible\_from\_internet |
| hasAccessToSensitiveData | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as has\_access\_to\_sensitive\_data |
| hasAdminPrivileges | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as has\_admin\_privileges |
| hasHighPrivileges | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as has\_high\_privileges |
| hasSensitiveData | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as has\_sensitive\_data |
| typeFields.operatingSystem | sn\_sec\_cmn\_src\_ci | os |
| typeFields.instanceType | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as instance\_type |
| resourceGroup.id | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as resource\_group\_id |
| resourceGroup.name | sn\_sec\_cmn\_src\_ci | source\_dataStored in source\_data as resource\_group\_name |
| tags | sn\_sec\_cmn\_src\_ci | host\_tag |
| cloudPlatform | sn\_sec\_cmn\_src\_ci | cloud\_service\_provider |
| region | sn\_sec\_cmn\_src\_ci | cloud\_region |
| cloudAccount.externalId | sn\_sec\_cmn\_src\_ci | cloud\_account |
| projects | sn\_sec\_cmn\_src\_ci | projects |
| cloudProviderURL | sn\_sec\_cmn\_src\_ci | resource\_idThis is used to retrieve project id in case of GCP cloud platform Serverless resource type. |
| externalId | sn\_sec\_cmn\_src\_ci | resource\_idThis is used as resource\_id in case of Azure cloud platform Virtual machine resource type. |
Host vulnerability Integration field mapping
| Wiz field | ServiceNow table | ServiceNow field |
|---|
| description | sn\_vul\_detection | proof |
| status | sn\_vul\_detection | source\_status |
| lastDetectedAt | sn\_vul\_detection | last\_found |
| firstDetectedAt | sn\_vul\_detection | first\_found |
| vulnerableAsset.name | sn\_vul\_detection | dns |
| remediation | sn\_vul\_detection | solution\_summary |
| vulnerableAsset.ipAddresses\[0\] | sn\_vul\_detection | ip\_address |
| vendorSeverity | sn\_vul\_detection | source\_severity |
| fixedVersion | sn\_vul\_detection | fixed\_version |
| status | sn\_vul\_detection | is\_ignored |
| status | sn\_vul\_detection | status |
| name | sn\_vul\_entry | id |
| score | sn\_vul\_third\_party\_entry | v3\_base\_score |
| CVEDescription | sn\_vul\_third\_party\_entry | summary |
| vendorSeverity | sn\_vul\_third\_party\_entry | source\_severity |
| cvssv3.attackVector | sn\_vul\_third\_party\_entry | v3\_attack\_vector |
| cvssv3.attackComplexity | sn\_vul\_third\_party\_entry | v3\_attack\_complexity |
| cvssv3.confidentialityImpact | sn\_vul\_third\_party\_entry | v3\_confidentiality\_impact |
| cvssv3.privilegesRequired | sn\_vul\_third\_party\_entry | v3\_privileges\_required |
| cvssv3.integrityImpact | sn\_vul\_third\_party\_entry | v3\_integrity\_impact |
| cvssv3.userInteractionRequired | sn\_vul\_third\_party\_entry | v3\_user\_interaction |
| hasExploit | sn\_vul\_third\_party\_entry | exploit |
| hasCisaKevExploit | sn\_vul\_third\_party\_entry | cisa\_exists |
| vulnerableAsset.tags | sn\_sec\_cmn\_src\_ci | host\_tag |
| vulnerableAsset.id | sn\_sec\_cmn\_src\_ci | source\_id |
| vulnerableAsset.name | sn\_sec\_cmn\_src\_ci | name |
| vulnerableAsset.region | sn\_sec\_cmn\_src\_ci | cloud\_region |
| vulnerableAsset.providerUniqueId | sn\_sec\_cmn\_src\_ci | resource\_id |
| vulnerableAsset.cloudPlatform | sn\_sec\_cmn\_src\_ci | cloud\_service\_provider |
| vulnerableAsset.type | sn\_sec\_cmn\_src\_ci | assetType |
| relatedIssueAnalytics | sn\_sec\_cmn\_src\_ci | source\_data |
| vulnerableAsset.nativeType | sn\_sec\_cmn\_src\_ci | cloud\_resource\_type |
| vulnerableAsset.subscriptionExternalId | sn\_sec\_cmn\_src\_ci | cloud\_account |
| vulnerableAsset.name | sn\_sec\_cmn\_src\_ci | resource\_name |
| vulnerableAsset.imageName | sn\_sec\_cmn\_src\_ci | image\_id |
| vulnerableAsset.\* | sn\_sec\_cmn\_src\_ci | source\_dataAll the details inside vulnerableAsset are added in source\_data field. |
| lastDetectedAt | sn\_sec\_cmn\_src\_ci | source\_data |
Container vulnerability Integration field mapping
| Wiz field | ServiceNow table | ServiceNow field |
|---|
| imageId | sn_vul_container_image | image_id |
| vulnerableAsset.name | sn_vul_container_image | image_name |
| vulnerableAsset.repository.externalId after ## | sn_vul_container_image | registry |
| vulnerableAsset.repository.externalId before ## | sn_vul_container_image | repo |
| vulnerableAsset.tags | sn_vul_container_image | image_labels |
| projects | sn_vul_container_image | image_projects |
| vulnerableAsset.region | sn_vul_container_image | cloud_regions |
| vulnerableAsset.cloudPlatform | sn_vul_container_image | cloud_providers |
| vulnerableAsset.subscriptionExternalId | sn_vul_container_image | cloud_account_ids |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image | image_namespace |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image | image_clusters |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image_vulnerable_item | image_clusters |
| vulnerableAsset.executionControllers.ancestors.name | sn_vul_container_image_vulnerable_item | image_namespace |
| vulnerableAsset.repository.externalId before ## | sn_vul_container_image_vulnerable_item | image_repository |
| layerMetadata.isBaseLayer | sn_vul_container_image_findings | is_base_image |
| firstDetectedAt | sn_vul_container_image_findings | first_found |
| lastDetectedAt | sn_vul_container_image_findings | last_found |
| detailedName | sn_vul_container_image_package | name |
| version | sn_vul_container_image_package | version |
| locationPath | sn_vul_container_image_package | path |
| name | sn_vul_entry | id |
| score | sn_vul_third_party_entry | v3_base_score |
| CVEDescription | sn_vul_third_party_entry | summary |
| vendorseverity | sn_vul_third_party_entry | source_severity |
| cvssv3.attackVector | sn_vul_third_party_entry | v3_attack_vector |
| cvssv3.attackComplexity | sn_vul_third_party_entry | v3_attack_complexity |
| cvssv3.confidentialityImpact | sn_vul_third_party_entry | v3_confidentiality_impact |
| cvssv3.privilegesRequired | sn_vul_third_party_entry | v3_privileges_required |
| cvssv3.integrityImpact | sn_vul_third_party_entry | v3_integrity_impact |
| cvssv3.userInteractionRequired | sn_vul_third_party_entry | v3_user_interaction |
| hasExploit | sn_vul_third_party_entry | hasExploit |
| layerMetadata.isBaseLayer | sn_vul_container_image_layer | Base layer |
| layerMetadata.details | sn_vul_container_image_layer | instruction |
| layerMetadata.id | sn_vul_container_image_layer | id |
| status | sn_vul_container_image_findings | is_ignored |
| validate_at_runtime | sn_vul_container_image_findings | validate_at_runtime |
| id | sn_vul_container_image_findings | unique_key |
| fixed_version | sn_vul_container_image_findings | fix_status |
Configuration Compliance Test Results Integration field mapping
| Wiz field | ServiceNow table | ServiceNow field |
|---|
| rule.id | sn\_vulc\_test | source\_id |
| rule.name | sn\_vulc\_test | short\_description |
| rule.remediationInstructions | sn\_vulc\_test | remediation |
| rule.description | sn\_vulc\_test | description |
| severity | sn\_vulc\_test | source\_criticality |
| status | sn\_vulc\_result | result |
| id | sn\_vulc\_result | source\_id |
| analyzedAt | sn\_vulc\_result | last\_seen |
| firstSeenAt | sn\_vulc\_result | first\_seen |
| rule.remediationInstructions | sn\_vulc\_result | remediation |
| resource.nativeType | sn\_sec\_cmn\_src\_ci | source\_data |
| resource.type | sn\_sec\_cmn\_src\_ci | source\_data |
| id | sn\_vulc\_result | description |
| id | sn\_vulc\_result | source\_id |
| securitySubCategories.category.framework.id | sn\_vulc\_auth\_src | source\_id |
| securitySubCategories.category.framework.name | sn\_vulc\_auth\_src | short\_description |
| securitySubCategories.category.framework.description | sn\_vulc\_auth\_src | description |
| securitySubCategories.id | sn\_vulc\_citation | section |
| securitySubCategories.title | sn\_vulc\_citation | section\_name |
| resource.projects | sn\_sec\_cmn\_src\_ci | projects |
| status | sn\_vulc\_result | is\_ignoredif status is Rejected, is\_ignored is set to true, else false. |
Issues Integration field mapping
Note: Data mapped for the Issues Integration to cloud test results (CTRs) are labeled with Wiz Issues as the source to help you differentiate these CTRs from the test results integration CTRs.
| Wiz field | ServiceNow table | ServiceNow field |
|---|
| sourceRule.id | sn\_vulc\_test | source\_id |
| sourceRule.name | sn\_vulc\_test | short\_description |
| sourceRule.resolutionRecommendation/sourceRule.remediationInstructions | sn\_vulc\_test | remediation |
| sourceRule.description | sn\_vulc\_test | description |
| severity | sn\_vulc\_test | source\_criticality |
| createdAt | sn\_vulc\_result | first\_seen |
| updatedAt | sn\_vulc\_result | last\_seen |
| status | sn\_vulc\_result | result |
| id | sn\_vulc\_result | source\_id |
| sourceRule.resolutionRecommendation/sourceRule.remediationInstructions | sn\_vulc\_result | remediation |
| sourceRule.controlDescription | sn\_vulc\_result | description |
| entitySnapshot.nativeType | sn\_sec\_cmn\_src\_ci | source\_data |
| entitySnapshot.type | sn\_sec\_cmn\_src\_ci | source\_data |
| Wiz issue | sn\_vulc\_result | result\_type |
| id | sn\_vulc\_result | description |
| severity | sn\_vulc\_test | source\_criticality |
| id | sn\_vulc\_result | source\_id |
| sourcerule.securitySubCategories.category.framework.id | sn\_vulc\_auth\_src | source\_id |
| sourcerule.securitySubCategories.category.framework.name | sn\_vulc\_auth\_src | short\_description |
| sourcerule.securitySubCategories.category.framework.description | sn\_vulc\_auth\_src | description |
| sourcerule.securitySubCategories.id | sn\_vulc\_citation | section |
| sourcerule.securitySubCategories.title | sn\_vulc\_citation | section\_name |
| projects | sn\_sec\_cmn\_src\_ci | projects |
| status | sn\_vulc\_result | is\_ignoredif status is Rejected, is\_ignored is set to true, else false. |
Mapping to vulnerable item and test result records
- The Asset Integration imports data about your cloud assets reported by the Wiz scanner.
- Host vulnerability findings are mapped to host vulnerable items (VITs).
- Host test results that are associated with the resource type, VIRTUAL MACHINE are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- Container vulnerability findings are mapped to container vulnerable items (CVITs).
- Configuration test results findings are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- Issues findings are mapped to cloud test results records (CTRs) in the Configuration Compliance application.
- The Backfill Integrations import and process any Asset IDs that are reported as missing by the primary vulnerability and compliance integrations.