---
title: Configure the Invicti Vulnerability Integration
description: Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/invicti-configure.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-07-01"
reading_time_minutes: 6
breadcrumb: [Invicti Vulnerability Integration, Integrate with other applications, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure the Invicti Vulnerability Integration

Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.

## Before you begin

Roles required:

-   admin to install and activate applications
-   App-Sec Manager user group to configure the integration

Complete the following setup checklist prior to installation. These setup tasks are required for a smooth installation and configuration.

<table id="table_bjb_rrb_vzb"><thead><tr><th>

 

</th><th>

 

</th></tr></thead><tbody><tr><td>

Verify that the Vulnerability Response application is installed and activated.

</td><td>

To verify that this application is activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions your organization has purchased.

 If the application is not installed and activated see, [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr.md).

</td></tr><tr><td>

Verify that the Invicti Vulnerability Integration is installed and activated.

</td><td>

To verify that this application is activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions your organization has purchased.

 If the application is not installed and activated see, [Install the ServiceNow Vulnerability Response Integration with Invicti](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/invicti-install.md).

</td></tr><tr><td>

Verify that you have the required ServiceNow roles for your instance.

</td><td>

The following roles are required for installation, configuration, and verification of expected results:-   If not already assigned, the System Administrator \[admin\] installs the app and assigns users to the App-Sec Manager group.
-   The App-Sec Manager oversees configuration and verifies expected results.

</td></tr><tr><td>

For the Inviciti Vulnerability Integration, have your **User ID** and **API token** ready.

</td><td>

Contact your Invicti administrator to obtain the **User ID** and **API token** if you don't know them.

 For more information, see the Invicti product website at [API Overview](https://www.invicti.com/support/api-overview/).

</td></tr></tbody>
</table>## Procedure

1.  Navigate to **All** &gt; **Invicti** &gt; **Invicti Configuration**.

2.  Fill out the fields.

<table id="table_gwr_nsb_vzb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

System Type

</td><td>

Choose one:-   Enterprise for legacy integrations
-   Platform for enhanced integrations
 Based on your choice, only the names of the integration instances that you have configured and saved for either Enterprise or Platform are displayed in the Integration Instance field.

By default, a configuration record for each type is provided, one for Enterprise and one Platform. Your input for the other fields is required before you can save and test credentials for these configurations.

**Note:** You can activate and schedule configured integrations for both system types. Enterprise and Platform integrations can work together to provide you with a wide range of vulnerability data.

</td></tr><tr><td>

Integration Instance

</td><td>

All existing integration instances for either Enterprise or Platform are displayed based on your choice for System Type.

</td></tr><tr><td>

API URL

</td><td>

Displayed only for Platform integration instances. User's Invicti's instance URL. This is the information you obtained from [Prepare for the Invicti Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/invicti-prerequisites.md).

</td></tr><tr><td>

User ID

</td><td>

Unique user ID.

</td></tr><tr><td>

API token

</td><td>

Displayed only for Platform integration instances. API token you generated from your Invicti console. This is the information you obtained from [Prepare for the Invicti Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/invicti-prerequisites.md).

</td></tr><tr><td colspan="2">

Choose the scan type. You must select at least one.

</td></tr><tr><td>

Include DAST

</td><td>

Option to include vulnerabilities from DAST scans. DAST scans find vulnerabilities for an application dynamically while it is running. This approach might imitate an outside attack.

</td></tr><tr><td>

Include IAST

</td><td>

Option to include vulnerabilities from IAST scans. IAST scans detect software vulnerabilities by interacting with the program while it is running. Human observation, automated tests, and sensors are used in combination to interact with the application to locate vulnerabilities.

</td></tr><tr><td>

Date format

</td><td>

Parameter that converts the start time to the format supported by the Invicti API used by the Invicti Application Vulnerable Item Integration.This parameter should match the format you've defined or selected in your Invicti account, for example, **dd/MM/yyyy**. Verify the date and time formats in your Invicti console match those you enter for the Date format in your ServiceNow AI Platform instance.

To change this format in your Invicti console:

1.  Log in at [Invicti Sign In](https://www.netsparkercloud.com/account/signin?ReturnUrl=%2f).
2.  Select **User name** in the top right.
3.  Navigate to **User settings** &gt; **Date and time format**.
**Note:** Failed imports might occur if you enter an invalid date format in your ServiceNow AI Platform instance.

If you enter a valid format in your instance that differs from the date format in your Invicti console, Invicti will return an empty payload.

</td></tr><tr><td>

Manage exceptions in ServiceNow

</td><td>

Displayed only for Platform integration instances. Choose one:-   **Activated \(selected\)**

Application vulnerable items \(AVIT\) from Invicti with states such as **Present** and **AcceptedRisk** that might be deferred in your instance are instead mapped to **Open** automatically.

-   **Deactivated \(not selected\)**

Source states for Application vulnerable items \(AVITs\) imported from Invicti are preserved. You must manage exceptions for these AVITs \(defer them\) from AVIT records.

For more information about Invicti source states and target fields, see [Invicti Vulnerability Integration state mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/invicti-mapping.md).

</td></tr><tr><td>

Manage false positives in ServiceNow

</td><td>

Displayed only for Platform integration instances. Choose one:-   **Activated \(selected\)**

AVITs with states from Invicti such as **Present** and **False Positive** that might transition to **Closed** in your instance are instead mapped to **Open** automatically.

-   **Deactivated \(not selected\)**

AVIT states imported from Invicti are preserved. You must manage false positives or potential false positives for these AVITs from AVIT records.

</td></tr></tbody>
</table>3.  Select **Save and Test Credentials**.

4.  Modify your lookup rules so they are based on configuration items.

    By default, the **sn\_vul.use\_product\_model** system property is activated \(set to `true`\) for your Lookup rules listed on the \[sn\_sec\_cmn\_ci\_lookup\_rule\] table based on the product model. When this rule is activated:

    -   This rule identifies matches between imported data and the data in your Configuration Management Database \(CMDB\) based on the product model.
    -   Records are created or updated on the Discovered Applications \[sn\_vul\_app\_release\] table.
    -   When you create or edit your lookup rules for Invicti, **Product Model** is displayed in the **Lookup target** field on the rule form.
    To modify your rules so they are based on configuration items, you must manually deactivate \(set to `false`\) the **sn\_vul.use\_product\_model** system property.

    1.  Navigate to **All** &gt; **System Properties** and locate the **sn\_vul.use\_product\_model** record and set the Value to `false`.

    2.  Select **Update**.

    3.  Navigate to **All** &gt; **Security Operations** &gt; **CMDB** &gt; **Lookup Rules**.

    4.  Locate the Application name and Source Application ID rules that have the Lookup target as **Configuration item**.

    5.  Select the Active check box for these rules.

    6.  Select **Update**.

        When you create or edit your lookup rules for Invicti, note that **Configuration item** is displayed in the **Lookup target** field on the rule form. Records are created or updated on the Scanned Applications \[sn\_vul\_app\_scanned\_application\] table.