---
title: Managing state mapping for deferrals and false positives in Application Vulnerability Response
description: You can manage how the Source states on application vulnerable items \(AVIs\) imported by the Veracode Vulnerability Integration and Fortify Vulnerability Integration are mapped in your instance after import.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/avm-excep-fp-triage-mapping-example.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Managing state mapping for deferrals and false positives in Application Vulnerability Response

You can manage how the **Source** states on application vulnerable items \(AVIs\) imported by the Veracode Vulnerability Integration and Fortify Vulnerability Integration are mapped in your instance after import.

Starting with v20.0 of Vulnerability Response, you have more options for triaging your imported AVIs with ServiceNow workflows.

When you [Configure the Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/configure-fortify.md) or the [Configure the Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/configure-veracode.md), the integration configuration pages provide you with two options to help you manage exceptions and false positives in your instance.

-   Manage exceptions in ServiceNow
-   Manage false positives in ServiceNow

Role required: App-Sec Manager.

## Use case for Exception management

AVIs are imported from these integrations with **Source** states. Upon import, these state are mapped to **Target** and **Target reason** states in your instance, because in some cases there are no exact matches between the source states of your scanner and the states used by your instance.

For example, source states such as **Will Not Fix**, **Remediation Deferred**, **Risk Accepted**, and **Risk Mitigated** from the [Fortify Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/fortify-vuln-integration.md) are mapped to the **Deferred** state with a substate of **Risk Accepted** or **Mitigating Control in Place** in your instance.

You have the following options on the configuration pages for these integrations:

<table id="table_wsc_4pt_dzb"><thead><tr><th>

Option

</th><th>

Check box selected

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Manage exceptions in ServiceNow

</td><td>

Y \(by default\)

</td><td>

If you leave this option selected, you must request exceptions from AVI records.

 Imported AVIs marked for the **Deferred** state are triaged with the ServiceNow Exception Management workflow.

 AVIs with **Source** states that normally are mapped to a **Deferred** state are mapped to the **Target triage state** in the **Open** state.

</td></tr><tr><td>

 

</td><td>

N

</td><td>

If you deactivate the check box, you preserve the **Source** states imported from your scanner.

 These AVIs are mapped to the **Target state** as **Deferred**, and to a **Target reason** state in your instance. They are not triaged by the exception workflow, because they are not mapped to the **Target triage** state and **Target triage reason** states.

 The **Request Exception** UI action is not available on the AVI record, because the record already in the **Deferred** Target state.

</td></tr></tbody>
</table>## Use case for False positive

For false positives from the [Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-vuln-integration.md) as an aexample, source states such as **False Positive** or **Potential False Positive** are mapped to the **Closed** **Target state** with a substate of **False Positive**.

<table id="table_tpd_jst_dzb"><thead><tr><th>

Option

</th><th>

Check box selected

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Manage false positives in ServiceNow

</td><td>

Y \(by default\)

</td><td>

If you leave this option selected, you must request a **False Positive** from AVI records.

 Imported AVIs marked for the **False Positive** or **Potential False Positive** states are triaged with the ServiceNow Exception Management workflow.

 AVIs with **Source** states that normally are mapped to a **Closed** **Target state** are mapped to a **Target triage** state in **Open**.

 The **False Positive** UI action is available on the AVI record.

</td></tr><tr><td>

 

</td><td>

N

</td><td>

If you deactivate the check box, you preserve the **Source** states imported from your scanner.

 These AVIs are mapped to the **Target state** as **Closed** and a **Target reason** state in **False Positive** in your instance. They are not triaged by the false positive workflow.

 The **False Positive** UI action is not available on the AVI record, because the record is already in the **Closed** Target state.

</td></tr></tbody>
</table>