---
title: Data mapping for the Vulnerability Response Integration with Claroty CTD
description: This section specifies how fields from the Claroty CTD API are mapped to fields in the ServiceNow tables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/operational-technology/operational-technology-vulnerability-response/data-mapping-otvr-integration-claroty-ctd.html
release: australia
product: Operational Technology Vulnerability Response
classification: operational-technology-vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Vulnerability Response Integration with Claroty CTD, Integrate, Operational Technology Vulnerability Response, Operational Technology]
---

# Data mapping for the Vulnerability Response Integration with Claroty CTD

This section specifies how fields from the Claroty CTD API are mapped to fields in the ServiceNow tables.

## Vulnerability detection data mapping

<table id="table_o5w_bmk_wxb"><thead><tr><th>

Claroty CTD field

</th><th>

ServiceNow field

</th><th>

Notes

</th></tr></thead><tbody><tr><td>

 

</td><td>

Source

</td><td>

Always set to **Claroty CTD**.

</td></tr><tr><td>

Identified\_on

</td><td>

First Found

</td><td>

 

</td></tr><tr><td>

Last\_updated

</td><td>

Last Found

</td><td>

 

</td></tr><tr><td>

Status

</td><td>

Status

</td><td>

A status of **0** means **Open**. A status of **2** means **Closed/Fixed**.

</td></tr><tr><td>

Resource\_id

</td><td>

Configuration item

</td><td>

The configuration item \(CI\) is set through a CI lookup rule that searches the sys\_object\_source table for the Resource ID. For example, 33.1.

</td></tr></tbody>
</table>## Vulnerability entry data mapping

Vulnerability entries are only created if an existing Common Vulnerabilities and Exposures \(CVE\) record is not found in the National Vulnerability Database Entry \[sn\_vul\_nvd\_entry\] table. If the Claroty CTD Integration must create a CVE, it maps the following source fields listed in the table.

|Claroty CTD field|ServiceNow field|Notes|
|-----------------|----------------|-----|
|Cve\_id|ID|Example: CVW-2017-17562|
|Title|Summary|The integration adds \[Claroty\] to the Summary so that the NVD CVEs, backfilled by Claroty, are visible. For example, the \[Claroty\] Authentication Bypass Vulnerability in SIPROTEC.|
|Cvss|V3\_base\_score| |
|Published|Date\_published| |
|Modified|Last\_modified| |

**Parent Topic:**[Vulnerability Response Integration with Claroty CTD](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/operational-technology/operational-technology-vulnerability-response/vulnerability-response-integration-with-claroty-ctd.md)