---
title: Runtime exposure visibility for container images
description: Chained Wiz integrations create container vulnerable items for images deployed across unlimited clusters, removing the previous 16-cluster limitation.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/wiz-container-runtime-exposure-cvr.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-09-29"
reading_time_minutes: 3
keywords: [Wiz, container vulnerability, runtime exposure, CVIT, clusters]
breadcrumb: [Configure, Wiz Vulnerability Response Integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Runtime exposure visibility for container images

Chained Wiz integrations create container vulnerable items for images deployed across unlimited clusters, removing the previous 16-cluster limitation.

With the addition of two new container vulnerability integrations that are included with the Wiz Vulnerability Response Integration, container vulnerable items for active images with vulnerabilities are no longer limited to a maximum of 16 clusters. Container vulnerable items are created for images deployed on any number of clusters without limitation. Three chained integrations work together to identify active images, map them to their cluster locations, and create container vulnerable items. The integrations are activated by default and run automatically in sequence. Duplicate container vulnerable items for images aren't created, and the \[sn\_vul\_container\_image\_relationship\_mapping\] and \[sn\_vul\_container\_image\_vulnerable\_item\] tables are updated appropriately.

Navigate to **All** > **Wiz Vulnerability Integration** > **Integrations** to view the records for the following integrations.

## Chained container vulnerability response integrations

The integrations are run automatically in the following order.

-   **Wiz Container Grouped Vulnerability Integration**

    Runs daily to gather Source IDs and other data for active images and stores the data on the Discovered Items \[Container Images\] \[sn\_vul\_container\_image\] table. Every docker image has a unique Source ID based on the repository it is stored in. This integration imports the Source ID and stores it in the Source IDs column on the Discovered Items \[Container Images- sn\_vul\_container\_image\] table.

-   **Wiz Container Deployment Context Integration**

    Triggered by the successful completion of the first integration. Creates a relationship between an image and where it is stored on the \[sn\_vul\_container\_image\_relationship\_mapping\] table. This table maps the docker image to cluster, Namespace and Services at their specific repository level. This Integration will also create missing Vulnerable Items if any new deployment comes for any image.

-   **Wiz Container Vulnerability Integration**

    Creates container vulnerable items for the vulnerable image based on any of the clusters/namespace/service it is deployed on using the data from sn\_vul\_container\_image\_relationship\_mapping.


## Container vulnerable item creation with granularity keys

Container vulnerable items are created based on what you have configured for container image granularity keys. Each third-party container vulnerability scanner integration has its own record on the Configure Image Vulnerability Keys \[sn\_vul\_container\_image\_vulnerability\_keys\] table. By default without any additional keys configured, a finding is created by combining the image repository, vulnerability, and image data that is imported by a scanner product.

For existing customers, container vulnerable items with the integration chain are created based on what you've already configured for the Registry, Namespace, Cluster, and Service keys. To view the configuration page, navigate to **All** > **Container Vulnerability Response** > **Administration** > **Configure VI granularity**.

These keys aren't editable unless there is no container vulnerability data in the instance, or unless you're a new customer. If you have none of the keys selected on the page, container vulnerable items are created by the Container Vulnerability Integration as existing behavior.

For new customers, configure key granularity before you make your first data import with the integrations.

See [Configuring container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configuring-findings-key-granularity.md) for more information about key granularity.

## Deactivating the chained integrations

The image runtime exposure feature with the enhanced imports is available to all customers who have entitlements to Container Vulnerability Response. The integrations are installed automatically and are activated by default. If you don't want to use this integration chain because you aren't using clusters as a condition to create container vulnerable items, set the **sn\_vul\_wiz.deployment\_context\_gate\_writes** system property to `false`. This setting deactivates the Wiz Container Grouped Vulnerability and Wiz Container Deployment Context integrations so that container vulnerable item creation remains based on your existing settings with the Wiz Container Vulnerability Integration integration and scanner imports.

To open the record, navigate to **All** > **System Properties** > **All Properties** > **sn\_vul\_wiz.deployment\_context\_gate\_writes**.