---
title: Support for the Vulnerability Response Integration with Microsoft Defender for IoT \(Azure\)
description: You can refer to this section for questions regarding data mapping and error handling.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/operational-technology/operational-technology-vulnerability-response/support-for-msft-defender-iot-azure.html
release: australia
product: Operational Technology Vulnerability Response
classification: operational-technology-vulnerability-response
topic_type: reference
last_updated: "2026-03-12"
reading_time_minutes: 4
breadcrumb: [Vulnerability Response Integration with Microsoft Defender for IoT \(Azure\), Integrate, Operational Technology Vulnerability Response, Operational Technology]
---

# Support for the Vulnerability Response Integration with Microsoft Defender for IoT \(Azure\)

You can refer to this section for questions regarding data mapping and error handling.

## Data mapping

The following tables describe the data mapping fields used for vulnerability detection and National Vulnerability Database \(NVD\) entries in the Microsoft Defender for IoT \(Azure\) application and if there's an equivalent entry used after the data is imported into the ServiceNow CMDB.

<table id="table_zzb_4g5_5bc"><thead><tr><th>

Microsoft Defender for IoT \(Azure\) field

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

N/A

</td><td>

source**Note:** Always set this field to **Microsoft Azure Defender for IoT**.

</td></tr><tr><td>

name

</td><td>

detection\_key

</td></tr><tr><td>

N/A

</td><td>

status**Note:** This field is set to **0**, meaning open, by default.

</td></tr></tbody>
</table><table id="table_mn4_qg5_5bc"><thead><tr><th>

Microsoft Defender for IoT \(Azure\) field

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

properties/vulnerabilityid

</td><td>

id

</td></tr><tr><td>

 

</td><td>

source**Note:** This field is set to **NVD** by default.

</td></tr><tr><td>

properties/description

</td><td>

summary

</td></tr><tr><td>

properties/score

</td><td>

score

</td></tr><tr><td>

properties/exploittype

</td><td>

Exploit existsIf the API data indicates an exploit exists, the integration sets this field to **Yes**.

</td></tr><tr><td>

properties/exploittype

</td><td>

public\_exploitIf the API data indicates an exploit exists, the integration sets this field to **Yes**.

</td></tr></tbody>
</table>**Configuration item \(CI\) lookup**

The CI Lookup is performed using the **deviceid** from Microsoft Defender for IoT \(Azure\). The sys\_object\_source table, populated by the Service Graph Connector, is searches for the the matching deviceid. If a match is found, the detection and vulnerable item are linked to that CI.

**Note:** By default, a CI match is required to insert vulnerability detections. This helps minimize unclassed hardware CIs in your CMDB. To change this behavior, you can set the **sn\_msftd4iotazvr.require\_ci\_matchsystem** property to **false**. Setting the property to false allows the creation of unclassed hardware CIs if a CI match isn't found.

## Error handling

The integration is designed to be mostly pre-configured, so you only need to enter your Azure Tenant ID, Client ID, and Client Secret. Log messages from the application are viewable in the System Logs from the **sn\_msftd4iotazvr** source. Additional relevant log message can also appear from the **sn\_vul** source.

If the integration run fails, the error is shown in the **Notes** field on the integration run. The state is set to **Complete** with a substate of **Failed**.

The Import Queue \(sn\_vul\_ds\_import\_q\_entry\) table contains all the pending transformation requests. You can filter this table to only show items that have a **status** of **Processing** to view what is currently under transformation.

The following tables describes the error messages and possible causes during data retrieval and data processing.

<table id="table_rt1_535_5bc"><thead><tr><th>

Error message

</th><th>

Possible cause

</th></tr></thead><tbody><tr><td>

Cannot run integration without a REST message and REST method specified

</td><td>

On the Detection Integration job record, the **REST message** or **REST method** fields are not populated.

</td></tr><tr><td>

Cannot run integration without Microsoft Defender for IoT \(Azure\) oauth\_client\_id specified

</td><td>

On the Integration Instance, the **OAuth Client ID** is not populated.

</td></tr><tr><td>

Cannot run integration without Microsoft Defender for IoT \(Azure\) oauth\_client\_secret specified

</td><td>

On the Integration Instance, the **OAuth Client Secret** is not populated.

</td></tr><tr><td>

Cannot run integration without the detection API resource path specified

</td><td>

On the Integration Instance, the detection API resource path is not populated.

 The default is `https://management.azure.com/providers/Microsoft.ResourceGraph/resources`

</td></tr><tr><td>

Cannot run integration with API version specified

</td><td>

On the Integration Instance, the API version is not populated.

 The default is 2021-03-01.

</td></tr><tr><td>

Invalid response code \{response code\} received from Microsoft Defender for IoT \(Azure\)

</td><td>

The response from the Microsoft API is invalid.

 For example, the invalid response code 401 received from Microsoft Defender for IoT \(Azure\) means **Unauthorized**. The credentials or OAuth Token are likely invalid.

</td></tr><tr><td>

Failed to parse the JSON response body

</td><td>

The JSON response received is invalid if it isn't able to be parsed. This means that no data was received. Ensure that the credentials are correct and no other errors occur.

</td></tr><tr><td>

Error writing attachment

</td><td>

The system couldn't attach the response data to the data source. You likely need to contact your system administrator for further troubleshooting. A common cause for this error is that the MID Server or **Run as** user is missing the sn\_vul.vr\_import\_admin role.

</td></tr><tr><td>

Attachment content is null: attachment sys\_id = \{sys\_id\}

</td><td>

The Data Source attachment content is null. This could indicate an issue with the Microsoft API itself, or an issue in ServiceNow. Contact your system administrator for further troubleshooting.

</td></tr><tr><td>

Could not find attachment with sys\_id \{sys\_id\}

</td><td>

Data source attachment was not found. This could indicate an issue with the Microsoft API itself, or an issue in ServiceNow. Contact your system administrator for further troubleshooting.

</td></tr></tbody>
</table><table id="table_u42_tj5_5bc"><thead><tr><th>

Error message

</th><th>

Possible cause

</th></tr></thead><tbody><tr><td>

Cannot create a Detection without a vulnerability ID

</td><td>

A vulnerability ID was not present for the record. This is most likely caused by an issue with the Microsoft API.

</td></tr></tbody>
</table>**Parent Topic:**[Vulnerability Response Integration with Microsoft Defender for IoT \(Azure\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/operational-technology/operational-technology-vulnerability-response/vulnerability-response-integration-with-microsoft-defender-for-iot-azure.md)