---
title: Preparing the Common Security Advisory Framework \(CSAF\) solution integration
description: Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Security Advisory Framework \(CSAF\) data format.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/prepare-csaf-solution-integration.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Prepare solution integration checklist, Setting up vulnerability solution providers, Configuring Vulnerability Response using the Setup Assistant, Vulnerability Response implementation, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Preparing the Common Security Advisory Framework \(CSAF\) solution integration

Use the Setup Assistant to prepare for implementing a solution intelligence integration for all the vendors that support the Common Security Advisory Framework \(CSAF\) data format.

## Before you begin

To integrate with the vendors that provide the solutions, ensure you perform the tasks in the following checklist. You can print the checklist and verify the items listed are completed before you install the application.

<table id="table_qby_jng_tlb"><thead><tr><th>

Task

</th><th>

Description

</th></tr></thead><tbody><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox image.

</td><td>

Verify that the following applications are installed from the ServiceNow Store:-   Vulnerability Solution Management: For more information about installing Vulnerability Solution Management, see [Install Vulnerability Response third-party applications using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-installapp-setup-asst.md) and [Install the Solution Management for Vulnerability Response application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-solution-mgmt.md).
-   Vulnerability Response: For more information about installing and activating the Vulnerability Response application, see [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr.md). This integration requires version 16.1 of Vulnerability Response or later.

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox image.

</td><td>

Verify you have any third-party account credentials available. They are required to edit some solution integrations.

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox image.

</td><td>

Verify that you have authenticated the vendors for import of solutions using the APIs. For more information on how to authenticate vendors, see [Configure Connection and Credential aliases for the Common Security Advisory Framework \(CSAF\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/configure-connection-credential-aliases-csaf.md). If you do not want to configure an API-based vendor, you can skip this step.

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox image.

</td><td>

If you want to configure an API-based vendor other than Red Hat, then you must customize the flow and flow action for extracting a unique key and CSAF URL from the response of an advisory. **Note:** Publishing CSAF URL is not standard across vendors.

 To customize the flow for vendors other than Red Hat, see [Configure a Common Security Advisory Framework vendor other than Red Hat](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/configure-csaf-vendor.md).

 You can skip this step if they do not want to configure vendors other than Red Hat. By default, the flow for Red Hat has been shipped with the application.

</td></tr><tr><td>

\[Omitted image "checkbox.png"\] Alt text: Checkbox image.

</td><td>

Verify that you have an admin group or user who can manage the integration. If not assigned, the admin assigns the vulnerability admin \(sn\_vul.vulnerability\_admin\) and other roles.

</td></tr></tbody>
</table>