---
title: Discovered Items form fields
description: Assets are automatically matched to configuration items \(CIs\) in the Configuration Management Database \(CMDB\) when they’re imported using the CI Lookup Rules. Records for unmatched CIs are automatically created during third-party vulnerability integration imports and included in Discovered Items. However, for cloud assets that aren’t present in CMDB Cl, the record is created in the cloud resource class.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/discovered-items-fields.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: reference
last_updated: "2026-03-12"
reading_time_minutes: 4
breadcrumb: [Vulnerability Response reference information, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Discovered Items form fields

Assets are automatically matched to configuration items \(CIs\) in the Configuration Management Database \(CMDB\) when they’re imported using the CI Lookup Rules. Records for unmatched CIs are automatically created during third-party vulnerability integration imports and included in Discovered Items. However, for cloud assets that aren’t present in CMDB Cl, the record is created in the cloud resource class.

## Discovered Items fields

The information in these records is ingested from the third-party records and classified during import.

These fields are found on records listed in the Discovered Items \[sn\_sec\_cmn\_src\_ci\] table.

To view imported data in the fields listed in the following tables, you must have, at a minimum, the sn\_vul.read\_all role.

<table id="table_zky_nbl_t2b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Number

</td><td>

Identifier assigned to the record.

</td></tr><tr><td>

Configuration Item

</td><td>

Configuration item that is imported from the third-party source integration.Starting from v12.0, Configuration Item is the latest CI from the list of CIs after filtering the decommissioned ones.

</td></tr><tr><td>

Class

</td><td>

Class assigned to the CI during import by Vulnerability Response.

</td></tr><tr><td>

Source

</td><td>

Source that is imported from the third-party source integration.

</td></tr><tr><td>

CI matching rule

</td><td>

The CI matching rule that was used to create the item.

</td></tr><tr><td>

V18.0: Matching type for the DI

</td><td>

Matching type used to create the discovered item. Options are:-   Created by VR
-   Created by IRE
-   Matched by CI lookup
-   Matched by IRE
-   Matched manually \(Starting with v24.0.6 of Vulnerability Response, you can view this additional option. This option is set automatically if you manually update a CI on the Discovered Item form.\)

This information is only available for data that is populated for Vulnerability Response v18.0 and later. On existing data, this column doesn’t contain any value. **Note:** If you reapply the CI lookup rules, some CIs on DIs might be updated, resulting in this column being populated.

</td></tr><tr><td>

Other matched CIs

</td><td>

List of the other configuration items matching the CI lookup rule.

</td></tr><tr><td>

State

</td><td>

State of the CI that is determined during import. Choices are:-   **Matched**: A matching configuration item was found in the CMDB.
-   **Unmatched**: No match was found in the CMDB. A placeholder record is created.

</td></tr><tr><td>

Created

</td><td>

Date when the Discovered Item record was created.

</td></tr><tr><td>

Updated

</td><td>

Date when the Discovered Item record was updated.

</td></tr><tr><td>

Updated by

</td><td>

User who updated the data.

</td></tr><tr><td>

Host tag

</td><td>

Host tags assigned to this discovered item during import. You can have up to 31 host tags per discovered item.

</td></tr><tr><td>

Fully qualified domain name

</td><td>

Data associated with this CI found in the CMDB.

</td></tr><tr><td>

MAC Address

</td><td>

Data associated with this CI found in the CMDB.

</td></tr><tr><td>

Operating System

</td><td>

Operating system associated with this CI.

</td></tr><tr><td>

NetBIOS

</td><td>

NetBIOS imported from the third-party source integration.

</td></tr><tr><td>

IP address

</td><td>

Data associated with this CI found in the CMDB.

</td></tr><tr><td>

Source data

</td><td>

Latest data associated with this CI from the source.

</td></tr><tr><td>

V16: Initial source data

</td><td>

Initial data associated with this CI from the source.

</td></tr><tr><td>

V16: Reevaluate CI

</td><td>

Receives data from the scanner. If there’s updated data, the value is set to true.**Note:** The source data values are recalculated according to the latest source data. When updated data is retrieved from the scanner, the source data is updated. The existing source data value is moved to the initial source data field. To reevaluate the discovered items, activate the `Re-apply CI Lookup Rules on the Changed Discovered items` scheduled job.

</td></tr><tr><td>

Agent exists

</td><td>

Indicates `true` if the agent is installed on the asset. If the `hostUID` and `UUID` values in the Source data column are empty, this value populates as `true`. **Note:** This field appears starting from v19.0 of Vulnerability Response.

</td></tr><tr><td>

Non-infra last scan date

</td><td>

Date and time of the most recent vulnerability scan for this discovered item when it's identified as a non-infrastructure \(cloud\) asset, for example an AWS, Microsoft Azure, or GCP resource.

</td></tr><tr><td>

Non-infra last compliance scan date

</td><td>

Date and time of the most recent Configuration Compliance scan for this discovered item when it's identified as a non-infrastructure \(cloud\) asset, for example an AWS, Microsoft Azure, or GCP resource.

</td></tr></tbody>
</table>Starting with v23.0 of Vulnerability Response, the **Test Result Compliance % \(CI\)** column shows the percentage of test results that are compliant for the corresponding CI. To obtain this value, you must set the `calcTRComplianceForCI` to `true` in the **Update remediation metrics** scheduled job.

**Note:** The **Test Result Compliance % \(CI\)** value populates only for the Discovered Items which have a non-empty value in either the **Last Configuration Compliance scan date** or **Non-infra last compliance scan date** columns.

Starting with version 18.0 of Vulnerability Response, Qualys, Tenable for Vulnerability Response and Rapid7 scanners can receive the following additional metadata for cloud assets.

|Field|Description|
|-----|-----------|
|Cloud service provider|Name of the cloud service provider that offers cloud computing services. For example, Amazon Web Services \(AWS\), Microsoft Azure and Google Cloud Platform \(GCP\).|
|Cloud region|Location where the resource has been hosted.|
|Cloud account|Account provided by cloud service providers such as AWS, GCP, and so on to access cloud computing services.|
|Cloud resource type|Types of assets present in the cloud such as Amazon Elastic Compute Cloud \(EC2\) machine, AWS S3 buckets and so on.|
|Resource ID|Unique identifier that is assigned to a resource in a cloud computing environment. This ID is used to identify and manage the resource.|
|Resource name|User-defined name used to identify and manage a resource in a cloud computing environment.|
|Image|Virtual machine image or a server image, is a pre-configured virtual machine that contains an operating system, applications, and other software. For example, Amazon Machine Image.|

A new CI Lookup Rule, ‘Cloud Resource ID’, has been introduced to match the cloud CIs based on the cloud metadata.