---
title: Components installed with Application Vulnerability Response
description: Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/installed-with-avm.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: reference
last_updated: "2026-03-12"
reading_time_minutes: 5
breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Components installed with Application Vulnerability Response

Several types of components are installed with activation of the Application Vulnerability Response feature, including tables, user roles, and scheduled jobs.

Starting with v24.0.6 of Application Vulnerability Response, the most frequently used system properties are now accessible within the Application Vulnerability Response application. To view these system properties, navigate to **All**Application Vulnerability Response**Properties**.

**Note:** The Application Files table lists the components that are installed with this application. For instructions on how to access this table, see [Find components installed with an application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/find-components.md).

Demo data is available for this feature.

## Roles installed

Granular roles in Application Vulnerability Response are assigned to specific User Groups, by default.

**Note:** Using granular roles outside these user groups requires coding and advanced Application Vulnerability Response or ServiceNow expertise.

<table id="table_u1t_gb1_wdb"><thead><tr><th>

Role title \[name\]

</th><th>

Description

</th><th>

Contains roles

</th></tr></thead><tbody><tr><td>

V20.0: sn\_vul.app\_manage\_auto\_exception\_rule

</td><td>

Create, update, delete, and cancel \(deactivate\) exception rules.

</td><td>

sn\_vul.app\_read\_auto\_exception\_rule

</td></tr><tr><td>

sn\_vul.app\_manage\_group\_rules

</td><td>

Read, write, delete, and all operations on application remediation task rules.

</td><td>

-   sn\_vul.app\_read\_all
-   sn\_vul.app\_read\_group\_rules

</td></tr><tr><td>

V20.0: sn\_vul.app\_exception\_approver

</td><td>

Approves exception rules and exception rule extension requests.Starting from v20.0, the granular role, sn\_vul.app\_read\_all, has been removed for this role so that you can access the application vulnerable items and remediation tasks assigned to you and your group instead of all the application vulnerable items and remediation tasks.

</td><td>

-   sn\_vul.app\_read\_auto\_exception\_rule
-   sn\_vul.view\_manager\_workspace

</td></tr><tr><td>

sn\_vul.app\_false\_positive\_approver

</td><td>

Approves or rejects false positive requests.

</td><td>

sn\_vul.view\_manager\_workspace

</td></tr><tr><td>

sn\_vul.app\_read\_assigned

</td><td>

View application vulnerable items \(AVIs\) assigned to you either in both the Classic UI and IT Remediation Workspace.**Important:** Starting with v24.0 of Vulnerability Response, the sn\_vul.app\_read\_assigned role has the privilege to access the IT Remediation Workspace.

</td><td>

sn\_vul.view\_rem\_workspace

</td></tr><tr><td>

sn\_vul.app\_read\_all

</td><td>

View all AVIs and related information either in the Classic UI or Vulnerability Manager Workspace.**Important:** Starting with v24.0 of Vulnerability Response, the sn\_vul.app\_read\_all role has the privilege to access the Vulnerability Manager Workspace.

</td><td>

sn\_vul.view\_manager\_workspace

</td></tr><tr><td>

sn\_vul.app\_write\_assigned

</td><td>

Update AVIs assigned to you.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_write\_all

</td><td>

Update all AVIs and related information.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_update\_assignment\_group

</td><td>

Update AVI Assignment group.

</td><td>

**Note:** When used outside of the default user group requires sn\_vul.app\_write\_all or sn\_vul.app\_write\_assigned.

</td></tr><tr><td>

sn\_vul.app\_update\_assigned\_to

</td><td>

Update AVI assignee.

</td><td>

**Note:** When used outside of the default user group requires sn\_vul.app\_write\_all or sn\_vul.app\_write\_assigned.

</td></tr><tr><td>

sn\_vul.app\_configure\_integrations

</td><td>

Configure third-party integrations.

</td><td>

sn\_vul.app\_read\_all

 sn\_vul.app\_read\_integrations

 sn\_sec\_int.admin

 sn\_vul\_veracode.configure\_integration

 sn\_vul.configure\_nvd\_administration

 **Note:** To define or edit an App-Sec Manager user group by single or specific integrations, see [Vulnerability Response personas and granular roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-persona-overview.md).

</td></tr><tr><td>

sn\_vul.app\_read\_integrations

</td><td>

View all third-party integrations.

</td><td>

 

</td></tr><tr><td>

sn\_vul\_veracode.configure\_integration

</td><td>

Define, update, and delete Veracode integrations.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_assignment\_rules

</td><td>

Define, update, and delete AVI assignment rules.

</td><td>

sn\_vul.app\_read\_all

 sn\_vul.app\_read\_assignment\_rules

</td></tr><tr><td>

sn\_vul.app\_read\_assignment\_rules

</td><td>

View assignment rules.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_remediation\_target\_rules

</td><td>

Define, update, and delete AVI remediation target rules.

</td><td>

sn\_vul.app\_read\_all

 sn\_vul.app\_read\_remediation\_target\_rules

</td></tr><tr><td>

sn\_vul.app\_manage\_risk\_score\_configurations

</td><td>

Define, update, and delete AVR calculators and risk rules.

</td><td>

sn\_vul.app\_read\_all

 sn\_vul.app\_read\_risk\_score\_configuration

 sn\_sec\_cmn.calc.write

</td></tr><tr><td>

sn\_vul.app\_read\_risk\_score\_configuration

</td><td>

View AVR calculators and risk rules.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_applications

</td><td>

View, update, and delete application records.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_app\_sc

</td><td>

Gives a Security Champion the ability to add or remove themselves from the Scanned Application related list.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_pa\_sc\_view

</td><td>

Provides relevant view to the specific Security Champion.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_app\_vul\_permissions

</td><td>

\[internal\] Used by sn\_vul.app\_manage\_applications.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_manage\_normalized\_severity

</td><td>

Update mapping to normalized severity.

</td><td>

sn\_vul.app\_read\_normalized\_severity

</td></tr><tr><td>

sn\_vul.app\_read\_normalized\_severity

 \[Removed in v12.1. Don’t use.\]

</td><td>

View normalized severity records.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_read\_application\_release

</td><td>

View application release records.

</td><td>

 

</td></tr><tr><td>

sn\_sec\_int.admin

</td><td>

Provides access to integrations.

</td><td>

 

</td></tr><tr><td>

pa\_power\_user

</td><td>

Provides access to reports

</td><td>

pa\_viewer

</td></tr><tr><td>

sn\_vul.app\_sec\_manager

</td><td>

Prioritizes and manages application vulnerable items.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_developer

</td><td>

Developer responsible for fixing the application vulnerabilities.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_create\_watch\_topic

</td><td>

Create Watch Topics for application vulnerabilities.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_read\_watch\_topic

</td><td>

Read Watch Topics for application vulnerabilities.

</td><td>

 

</td></tr><tr><td>

sn\_vul.app\_edit\_watch\_topic

</td><td>

Edit Watch Topics for application vulnerabilities.

</td><td>

 

</td></tr><tr><td>

sn\_vul\_blackduck.configure\_integration

</td><td>

Configure third-party integrations.

</td><td>

sn\_vul\_blackduck.configure\_integration

</td></tr></tbody>
</table>## Scheduled jobs installed

For Vulnerability Response shared scheduled jobs see, [Components installed with Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/installed-with-vr.md).

<table id="table_dx3_gb1_wdb"><thead><tr><th>

Scheduled job

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Associate existing AVIs with Auto Exception Rule

</td><td>

Evaluates application vulnerable items for matches to exception rules.

</td></tr><tr><td>

Populate Entry and CVE M2M

</td><td>

Makes existing records consistent with multiple CWE records. Run once after upgrade to populate then disable.

</td></tr><tr><td>

Resync primary CWE

</td><td>

For customized primary CWE calculations. Run once after upgrade to resync then disable.

</td></tr><tr><td>

Rollup application vulnerable item values to vulnerability and group

</td><td>

Calculates vulnerabilities and group roll ups for application vulnerable items.**Note:** Starting with v23.0 of Application Vulnerability Response, the scheduled job is enhanced to create background jobs with multithreading capabilities. This upgrade involves segmenting the job into several smaller child jobs, which are executed either in parallel or concurrently. This modification enables processing of multiple records simultaneously, thus significantly speeding up the overall task.

</td></tr><tr><td>

Black Duck Project List Integration

</td><td>

Pulls and ingests data into the Black Duck projects table.

</td></tr><tr><td>

Black Duck Application List Integration

</td><td>

Imports applications into discovered applications table for all the project versions available with Black Duck Integration in projects table.

</td></tr><tr><td>

Black Duck Application Vulnerable Item Integration

</td><td>

Ingests vulnerable items into ServiceNow application based on the vulnerabilities detected by scanners for every discovered application in the system.

</td></tr></tbody>
</table>## Tables installed

<table id="table_fbz_45z_vdb"><thead><tr><th>

Table

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Application Release\[sn\_vul\_app\_release\]

</td><td>

Contains application version information.

</td></tr><tr><td>

Version 13.0: Application Security Champions

 \[sn\_vul\_app\_m2m\_app\_sc\]

</td><td>

Contains the Application Vulnerability Response Security Champion group records.

</td></tr><tr><td>

Application Vulnerability Entry\[sn\_vul\_app\_vul\_entry\]

</td><td>

Contains application vulnerability entries.

</td></tr><tr><td>

Application Vulnerability Integration \[sn\_vul\_app\_integration\]

</td><td>

Contains Application Vulnerability Response integration records.

</td></tr><tr><td>

Application Vulnerability Scan Location\[sn\_vul\_app\_vul\_scan\_location\]

</td><td>

Contains third-party scan location information.

</td></tr><tr><td>

Application Vulnerability Scan Summary\[sn\_vul\_app\_vul\_scan\_summary\]

</td><td>

Contains third-party scan summary information.

</td></tr><tr><td>

Application Vulnerable Item\[sn\_vul\_app\_vulnerable\_item\]

</td><td>

Contains AVI records.

 Starting with v19.0, the following columns are added for Software Bill of Materials:

-   sn\_sbm\_config\_rule
-   sn\_sbom\_component
-   vex\_justification
-   vex\_detail
-   vex\_response
-   vex\_state
-   sca\_type \(SBOM-SCA\)

</td></tr><tr><td>

Scanned Application\[sn\_vul\_app\_scanned\_application\]

</td><td>

Contains application information.

</td></tr><tr><td>

State Map\[sn\_vul\_app\_state\_map\]

</td><td>

Contains state mapping from third-party integrations to application vulnerable item \(AVI\) states.

</td></tr><tr><td>

Vulnerability CWEs\[sn\_vul\_m2m\_entry\_cwe\]

</td><td>

Links CVE data to application vulnerable entries.

</td></tr><tr><td>

Application Remediation Task Manifestsn\_vul\_app\_rt\_manifest

</td><td>

Any updates on remediation task are done by using this manifest table by scheduled jobs.

</td></tr><tr><td>

Application Remediation Task sn\_vul\_app\_vulnerability

</td><td>

Contains application remediation tasks.

</td></tr><tr><td>

Application Remediation Task Itemsn\_vul\_app\_m2m\_vul\_group\_item

</td><td>

M2M table between AVI and application remediation tasks.

</td></tr><tr><td>

Version 21.0:Application Vulnerable Items

sn\_vul\_app\_vulnerable\_item

</td><td>

Contains AVI records.

</td></tr><tr><td>

Version 21.0: Package

\[sn\_vul\_app\_package\]

</td><td>

Contains application package details.

</td></tr><tr><td>

Version 21.0:Licenses

sn\_vul\_app\_license

</td><td>

Contains application licenses.

</td></tr><tr><td>

Version 21.0:Application Remediation Tasks

sn\_vul\_app\_vulnerability

</td><td>

Contains application remediation tasks.

</td></tr><tr><td>

sn\_vul\_blackduck\_config

</td><td>

Contains Black Duck integration configuration details.

</td></tr><tr><td>

sn\_vul\_blackduck\_project

</td><td>

Contains details of the projects coming from Black Duck.

</td></tr><tr><td>

sn\_vul\_blackduck\_project\_import

</td><td>

Import set table for the Black Duck project ingestion.

</td></tr><tr><td>

sn\_vul\_blackduck\_app\_import

</td><td>

Import set table for the Black Duck application ingestion.

</td></tr><tr><td>

sn\_vul\_blackduck\_avit\_import

</td><td>

Import set table for the Black Duck AVIT ingestion.

</td></tr></tbody>
</table>