---
title: Configure Application Vulnerability Response
description: Do the following setup steps prior to configuration so that you can ensure that your configuration is complete.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/configure-avm.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 7
breadcrumb: [Configure, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure Application Vulnerability Response

Do the following setup steps prior to configuration so that you can ensure that your configuration is complete.

## Before you begin

<table id="table_rv4_tpl_mcb"><thead><tr><th>

Setup tasks

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Verify that the Vulnerability Response application is installed and activated.

</td><td>

To verify that it’s activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions that your organization has purchased.

 If the application isn’t installed and activated, see [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr.md).

</td></tr><tr><td>

Verify that the Performance Analytics for Vulnerability Response is installed and activated to see Application Vulnerability Response reports.

</td><td>

To verify that it’s activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions that your organization has purchased.

 If the application isn’t installed and activated, see [Install and configure the Performance Analytics for Vulnerability Response \[PA\] application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr-analytics.md).

</td></tr><tr><td>

Verify that the Veracode Vulnerability Integration is installed, activated, and configured. \(Do not run the integrations at this point.\)

</td><td>

To verify that it’s activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions that your organization has purchased.

 If the application isn’t installed and activated, see [Install the ServiceNow Vulnerability Response Integration with Veracode](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/install-veracode.md).

</td></tr><tr><td>

Verify that the CWE 2000 integration is running in Vulnerability Response.

</td><td>

To verify the integration, see [Verify that the scheduled job for updating NVD records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-verify-NVD-sched-job.md).

</td></tr><tr><td>

\[Optional\] Verify that the NVD integration is running in Vulnerability Response.

</td><td>

To verify, see [Verify that the scheduled job for updating CWE records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-verify-CWE-sched-job.md).

</td></tr><tr><td>

Verify that you have the required ServiceNow roles for your instance.

</td><td>

The following roles are required for installation, configuration, and verification of expected results:-   If not already assigned, the user with the admin role installs the application and assigns users to the following user groups: App-Sec Manager, Security Champion, and Developer. For information on Group roles, see [Application Vulnerability Response user groups and roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-manage-roles.md).
-   The App-Sec Manager group oversees configuration and verifies expected results.

**Note:** Application Vulnerability Response configuration isn’t available from the Setup Assistant feature in Vulnerability Response.


</td></tr></tbody>
</table>Role required: App-Sec Manager user group

## Procedure

1.  Navigate to **Security Operations** &gt; **CMDB** &gt; **Lookup Rules**.

    See [Create a CI lookup rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-ci-lookup-rules.md) to create or modify CI Lookup Rules for your environment.

2.  Navigate to **Application Vulnerability Response** &gt; **Administration**.

3.  Select **Assignment Rules**.

    See [Create or edit Application Vulnerability Response assignment rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-assign-rules.md) to create or modify application assignment rules for your environment.

4.  Select **Vulnerability Calculators**.

    See [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-calculators-rules.md) to create or modify application vulnerability calculators for your environment.

5.  Select **Remediation Target Rules**.

    See [Create or edit application remediation target rules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-time-to-rem-rule.md) to create or modify application remediation targets for your environment.

6.  Select **Normalized Severity Maps**.

    See [Map the severity of an application vulnerable item automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-severity-map.md) to create or modify severity maps for your environment.

7.  Navigate to either **Veracode Vulnerability Integration** &gt; **Integrations** or **Fortify Vulnerability Integration** &gt; **Integrations**.

8.  Open the Veracode Application List Integration or the Fortify On Demand Application List Integration.

9.  If it has not already run, select **Execute Now**.

    **Note:** The other Veracode or Fortify integrations are inactive by default.

    For integration run statuses, see [View the Veracode Application Vulnerability Integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-check-imports.md) or [View the Fortify Vulnerability Integration import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/fortify-check-imports.md).

10. After the Veracode or Fortify on Demand Application List Integration has completed its run, navigate to **Application Vulnerability Response** &gt; **Administration** &gt; **Applications**.

11. For each application, enter a value for **Support Group** \(used by assignment rules\) and for **Department** \(used in reporting\).

    To update multiple entries, see [Edit multiple records in a list using the list editor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-user-interface/t_EditMultRecUsingListEditor.md) to complete the task in bulk.

    **Note:** To see the auto-updated **Business Unit**, refresh the page. For information on Scanned Application form fields, see [Scanned application fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-scanned-app-fields.md).

12. Return to the Integrations list, and activate the other Veracode or Fortify integrations.

    See [Install Application Vulnerability Response Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-activate-integrations.md) to set your delta data integration imports.

    The Veracode and Fortify integrations are chained and will run consecutively when activated.

13. Navigate to **Application Vulnerability Response** &gt; **Administration** &gt; **Assignment Rules**.

    1.  If you chose **Configuration Item: Support group** for **User group field** when creating or editing your assignment rules earlier, the values you added to the Scanned Applications list view are available to use now.

        Your assignment rules are edited.

    2.  Select **Update**.

    3.  From the Vulnerability Assignment Rules list view, select **Apply Changes** to reapply the assignment rules to your AVIs.


## Result

Your Application Vulnerability Response configuration is now complete.

## What to do next

Navigate to **Application Vulnerability Response** &gt; **Overview** and see [Application Vulnerability Management \[PA\] dashboard](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/app-vuln-mgmnt-dashboard.md) for information on your overall security posture.

-   **[Verify that the scheduled job for updating CWE records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-verify-CWE-sched-job.md)**  
Use Common Weakness Enumeration \(CWE\) records downloaded from the CWE database for reference when deciding whether a vulnerability must be escalated. Update common weakness records from the Common Weakness Enumeration database on a regularly scheduled basis. You can also update the default script or write your own scripts, as needed.
-   **[Verify that the scheduled job for updating NVD records is running](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-verify-NVD-sched-job.md)**  
Identify the repositories that you want updated regularly. You can execute a scheduled job to update National Vulnerability Database \(NVD\) records on a nightly or weekly basis. If it is not already running, you can enable the job
-   **[Install Application Vulnerability Response Integrations](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-activate-integrations.md)**  
Enable Application Vulnerability Response integrations to perform regular updates.
-   **[Define Application Vulnerability Response email notifications](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avr-define-email-notifications.md)**  
Set up email notifications to share useful information about important updates and activities such as approval and rejection of false-positive requests. Creating an email notification involves specifying when to send it, who receives it, and what it contains.
-   **[Exception Management in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avr-exception-management.md)**  
When your organization can't comply with a published vulnerability management or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to an application vulnerable item \(AVIT\) that cannot be remediated according to the policy.
-   **[Application Vulnerability Response remediation tasks and task rules overview](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-rt-rt-rules-overview.md)**  
Configure remediation tasks \(AVULs\) to help analysts and remediation specialists organize application vulnerable items \(AVI\) and analyze them in bulk. The criteria by which remediation tasks are formed is configured so that AVIs are automatically assigned into remediation tasks. Using remediation tasks, you can monitor progress and drive the remediation process more efficiently.

**Parent Topic:**[Configuring Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-configuring.md)