---
title: AWS Security Hub import mapping
description: AWS Security Hub data mapping tables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/aws-security-hub-mapping.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: reference
last_updated: "2026-04-02"
reading_time_minutes: 6
breadcrumb: [Reference, AWS Integration for Security Exposure Management, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# AWS Security Hub import mapping

AWS Security Hub data mapping tables.

## AWS Security Hub Host Vulnerabilities import

Data is loaded into the `sn_vul_aws_security_hub_host_vuln_import` table.

|Column|Type|Description|
|------|----|-----------|
|activity\_id|integer|Activity identifier|
|activity\_name|string|Activity name|
|category\_name|string|Category name|
|category\_uid|integer|Category unique identifier|
|class\_name|string|Class name|
|class\_uid|integer|Class unique identifier|
|cloud|string|Cloud provider information \(JSON\)|
|finding\_info|string|Finding information \(JSON\)|
|metadata|string|Metadata \(JSON\)|
|remediation|object|Remediation information|
|resources|string|Resource details \(JSON\)|
|severity|string|Severity level|
|severity\_id|integer|Severity identifier|
|status|string|Finding status|
|status\_id|integer|Status identifier|
|time|integer|Timestamp \(epoch\)|
|time\_dt|string|Timestamp \(datetime string\)|
|type\_name|string|Type name|
|type\_uid|integer|Type unique identifier|
|unmapped|string|Unmapped fields|
|vulnerabilities|string|Vulnerabilities data \(JSON\)|
|sys\_domain|Domain|Domain for domain separation|

## Severity and status mappings

|AWS Security Hub severity|ServiceNow severity value|ServiceNow severity label|
|-------------------------|-------------------------|-------------------------|
|CRITICAL|1|Critical|
|HIGH|2|High|
|MEDIUM|3|Medium|
|LOW|4|Low|
|INFORMATIONAL|4|Low|
|UNKNOWN|5|None|
|FATAL|1|Critical|
|OTHER|5|None|

|AWS Security Hub status|ServiceNow detection status value|ServiceNow detection status label|Notes|
|-----------------------|---------------------------------|---------------------------------|-----|
|New|0|Open| |
|In Progress|0|Open| |
|Resolved|1|Fixed| |
|Suppressed|0|Open|Sets `is_ignored=true`|
|Archived|1|Fixed| |
|Unknown|0|Open| |
|Other|0|Open| |

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`vulnerabilities.cve.uid`|id|CVE identifier|
|`"AWS"`|source|Static value indicating AWS source|
|\(ref\)|aws\_cvd\_details|Custom column referencing `sn_vul_aws_cvd_attributes`|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`cvss[].scoringVector`|v2\_vector\_string|When version 2.x and source matches root level|
|`cvss[].baseScore`|score|When version 2.x|
|`cvss[].baseScore`|v3\_base\_score|When version 3.x|
|`cvss[].scoringVector`|v3\_vector\_string|When version 3.x|
|`cvss[].baseScore`|v4\_base\_score|When version 4.x|
|`cvss[].scoringVector`|v4\_vector\_string|When version 4.x|
|`vulnerabilities.is_exploit_available`|exploit|Exploit availability|
|`vulnerabilities.cve.epss.score`|epss\_score|EPSS probability score|
|`vulnerabilities.is_fix_available`|fix\_available|Fix availability|
|`vulnerabilities.severity`|source\_severity|fatal/critical→critical, high→high, medium→medium, low/informational→low, unknown/other→none|
|`vulnerabilities.exploit_last_seen_time_dt`|last\_known\_exploit\_at|Last known exploit date|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`vulnerabilities.cve.uid`|id|CVE identifier|
|`cvss severity`|severity|CVSS severity|
|`cvss base_score`|score / v2\_base\_score / v3\_base\_score / v4\_base\_score|Version-dependent base score|
|`cvss vector_string`|v2\_vector\_string / v3\_vector\_string / v4\_vector\_string|Version-dependent vector string|
|`vulnerabilities.cve.desc`|summary|Vulnerability description|
|`vulnerabilities.cve.modified_time_dt`|last\_modified|Last modified date|
|`vulnerabilities.cve.created_time_dt`|date\_published|Date published|
|`vulnerabilities.is_exploit_available`|exploit|Exploit availability|
|`vulnerabilities.severity`|source\_severity|Source severity|
|`vulnerabilities.cve.epss.score`|epss\_score|EPSS probability score|
|`vulnerabilities.is_fix_available`|patch\_available|Patch availability|
|`vulnerabilities.exploit_last_seen_time_dt`|last\_known\_exploit\_at|Last known exploit date|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`vulnerabilities[0].cve.uid`|vulnerability|Reference to vulnerability entry|
|`finding_info.title`|short\_description|Finding title|
|`finding_info.desc`|description|Finding description|
|`finding_info.desc`|proof|Finding description as proof|
|`finding_info.first_seen_time_dt`|first\_found|First seen timestamp|
|`finding_info.last_seen_time_dt`|last\_found|Last seen timestamp|
|`status`|source\_status|New/In Progress/Unknown/Other→open, Resolved→closed, Suppressed→open with `is_ignored=true`, Archived→closed|
|`severity`|source\_severity|Source severity level|
|`affected_packages[].fixed_in_version`|fixed\_version|Fixed version of affected package|
|`finding_info.uid`|detection\_key|Unique detection key|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`resources.uid`|source\_id|Source identifier|
|`resources.uid`|resource\_id|Resource identifier|
|`resources.region`|cloud\_region|AWS region|
|`resources.owner.account.uid`|cloud\_account|AWS account ID|
|`resources.type`|cloud\_resource\_type|Cloud resource type|
|`"AWS"`|cloud\_service\_provider|Static value: AWS|
|`"Cloud"`|asset\_category|Static value: Cloud|
|`resources`|source\_data|Raw source data|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`status_id`|state|State from status ID|
|`status`|status|Status value|
|`severity`|source\_severity|Source severity|
|\(ref\)|vulnerability|Reference to `sn_vul_entry`|
|\(ref\)|src\_ci|Reference to `sn_sec_cmn_src_ci`|

|Script timing|Script name|Description|
|-------------|-----------|-----------|
|onStart|`AWSSecurityHubHostVulnerabilitiesProcessor.onStart`|Initializes the processor for Security Hub host findings.|
|onBefore|`AWSSecurityHubHostVulnerabilitiesProcessor.onBefore`|Processes each imported record. Creates or updates VITs, detections, and discovered items.|
|onComplete|`AWSSecurityHubHostVulnerabilitiesProcessor.onComplete`|Finalizes the import and logs summary statistics.|

## AWS Security Hub Container Vulnerabilities import

Data is loaded into the `sn_vul_aws_security_hub_container_vuln_import` table.

|Column|Type|Description|
|------|----|-----------|
|activity\_id|integer|Activity identifier|
|activity\_name|string|Activity name|
|category\_name|string|Category name|
|category\_uid|integer|Category unique identifier|
|class\_name|string|Class name|
|class\_uid|integer|Class unique identifier|
|cloud|string|Cloud provider information \(JSON\)|
|finding\_info|string|Finding information \(JSON\)|
|metadata|string|Metadata \(JSON\)|
|remediation|object|Remediation information|
|resources|string|Resource details \(JSON\)|
|severity|string|Severity level|
|severity\_id|integer|Severity identifier|
|status|string|Finding status|
|status\_id|integer|Status identifier|
|time|integer|Timestamp \(epoch\)|
|time\_dt|string|Timestamp \(datetime string\)|
|type\_name|string|Type name|
|type\_uid|integer|Type unique identifier|
|unmapped|string|Unmapped fields|
|vulnerabilities|string|Vulnerabilities data \(JSON\)|
|sys\_domain|Domain|Domain for domain separation|

## Container vulnerability field mappings

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`resources[0].name`|image\_name|Container image name|
|`resources[0].image.hash.value`|image\_digest|Image digest hash|
|`resources[0].image.uid`|image\_id|Image unique identifier|
|`resources[0].image.tag`|repository\_entry|Image tag|
|`resources[0].registry_uid`|registry|Container registry UID|
|`cloud.provider`|cloud\_provider|Cloud provider|
|`cloud.region`|cloud\_region|AWS region|
|`cloud.account.uid`|cloud\_account|AWS account ID|
|`resources[0].repository_name`|repository|Repository name|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`status`|state|Finding state|
|`severity`|severity|Finding severity|
|`finding_info.desc`|proof|Finding description as proof|
|`finding_info.first_seen_time_dt`|first\_found|First seen timestamp|
|`finding_info.last_seen_time_dt`|last\_found|Last seen timestamp|
|`status`|status|Finding status|
|`vulnerabilities.affected_packages[].path`|path|Package file path|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`vulnerabilities.affected_packages[].name`|name|Package name|
|`vulnerabilities.affected_packages[].version`|version|Package version|
|`vulnerabilities.affected_packages[].path`|path|Package file path|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`firstObservedAt`|first\_found\_dt\_tm|First found date and time|
|`lastObservedAt`|last\_found\_dt\_tm|Last found date and time|
|`status`|state|State|
|`title`|short\_description|Short description|
|`description`|description|Description|
|`vulnerabilities[0].cve.uid`|vulnerability|Reference to vulnerability|

|Script timing|Script name|Description|
|-------------|-----------|-----------|
|onStart|`AWSSecurityHubContainerVulnerabilitiesProcessor.onStart`|Initializes the processor for Security Hub container findings.|
|onBefore|`AWSSecurityHubContainerVulnerabilitiesProcessor.onBefore`|Processes each imported container finding. Creates or updates CVITs, container images, and findings.|
|onComplete|`AWSSecurityHubContainerVulnerabilitiesProcessor.onComplete`|Finalizes the container import and logs summary statistics.|

## AWS Security Hub Test Results import

Data is loaded into the `sn_vul_aws_security_hub_test_results_import` table.

|Column|Type|Description|
|------|----|-----------|
|activity\_id|integer|Activity identifier|
|activity\_name|string|Activity name|
|category\_name|string|Category name|
|category\_uid|integer|Category unique identifier|
|class\_name|string|Class name|
|class\_uid|integer|Class unique identifier|
|cloud|string|Cloud provider information \(JSON\)|
|compliance|string|Compliance information \(JSON\)|
|finding\_info|string|Finding information \(JSON\)|
|metadata|string|Metadata \(JSON\)|
|remediation|object|Remediation information|
|resources|string|Resource details \(JSON\)|
|severity|string|Severity level|
|severity\_id|integer|Severity identifier|
|status|string|Finding status|
|status\_id|integer|Status identifier|
|time|integer|Timestamp \(epoch\)|
|time\_dt|string|Timestamp \(datetime string\)|
|type\_name|string|Type name|
|type\_uid|integer|Type unique identifier|
|vendor\_attributes|string|Vendor-specific attributes \(JSON\)|
|sys\_domain|Domain|Domain for domain separation|

## Test Results field mappings

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`"AWS"`|source|Static source value|
|`compliance.standards`|source\_id|Compliance standard identifier|
|`compliance.standards`|short\_description|Used for display|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|\(ref\)|control|Reference to `sn_vulc_test`|
|`"AWS"`|source|Static source value|
|`compliance.control`|section\_name|Control section name|
|`compliance.control`|section|Control section|
|\(ref\)|auth\_src|Reference to `sn_vulc_auth_src`|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`"AWS"`|source|Static source value|
|`finding_info.title`|short\_description|Test short description|
|`finding_info.desc`|description|Test description|
|`finding_info.uid`|source\_id|Source identifier|
|`finding_info.types`|source\_category|Source category|
|`finding_info.created_time_dt`|source\_created|Source creation date|
|`finding_info.modified_time_dt`|source\_updated|Source update date|
|`severity`|source\_criticality|Source criticality|
|`remediation.desc`|remediation|Remediation description|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`finding_info.first_seen_time_dt`|first\_seen|First seen date|
|`finding_info.last_seen_time_dt`|last\_seen|Last seen date|
|`compliance.status`|result|Compliance result: PASS, FAIL, WARNING, or UNKNOWN|
|`vendor_attributes.severity`|risk\_score|Risk score from vendor|
|`time_dt`|last\_found\_dt\_time|Last found date and time|
|`finding_info.desc`|description|Result description|
|\(ref\)|control|Reference to `sn_vulc_test`|

|AWS Security Hub field|ServiceNow field|Description|
|----------------------|----------------|-----------|
|`resources.uid`|source\_id|Source identifier|
|`resources.uid`|resource\_id|Resource identifier|
|`resources.region`|cloud\_region|AWS region|
|`resources.owner.account.uid`|cloud\_account|AWS account ID|
|`resources.type`|cloud\_resource\_type|Cloud resource type|
|`cloud.provider`|cloud\_service\_provider|Cloud service provider|
|`"Cloud"`|asset\_category|Static value: Cloud|
|`resources`|source\_data|Raw source data|

|Script timing|Script name|Description|
|-------------|-----------|-----------|
|onStart|`AWSSecurityHubTestResultsProcessor.onStart`|Initializes the processor for test results.|
|onBefore|`AWSSecurityHubTestResultsProcessor.onBefore`|Processes each imported configuration finding. Creates or updates tests, test results, and CIs.|
|onComplete|`AWSSecurityHubTestResultsProcessor.onComplete`|Finalizes the test results import and logs summary statistics.|