---
title: Set filtering for the Wiz Container Vulnerabilities Integration
description: Set the filtering values to import the container vulnerability data that you want.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/wiz-container-tab-filters.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-09-03"
reading_time_minutes: 4
breadcrumb: [Configure, Wiz Vulnerability Response Integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Set filtering for the Wiz Container Vulnerabilities Integration

Set the filtering values to import the container vulnerability data that you want.

## Before you begin

<table id="table_r52_5tl_hkc"><thead><tr><th>

Supporting core application

</th><th>

Benefit

</th><th>

Wiz Integration

</th><th>

Users

</th></tr></thead><tbody><tr><td>

Container Vulnerability Response

</td><td>

First integration in the integration chain. Runs daily to gather Source IDs and other data for active images and stores the data on the Discovered Items \[Container Images\] \[sn\_vul\_container\_image\] table. Every docker image has a unique Source ID based on the repository it is stored in. This integration imports the Source ID and stores it in the Source IDs column on the Discovered Items \[Container Images- sn\_vul\_container\_image\] table.

</td><td>

Wiz Container Grouped Vulnerability Integration

</td><td>

 

</td></tr><tr><td>

 

</td><td>

Triggered by the successful completion of the Wiz Container Grouped Vulnerability Integration. Creates a relationship between an image and where it is stored on the \[sn\_vul\_container\_image\_relationship\_mapping\] table. This table maps the docker image Source ID to where it is stored on the cluster's Namespace or Services.

</td><td>

Wiz Container Deployment Context Integration

</td><td>

 

</td></tr><tr><td>

 

</td><td>

Triggered by the successful completion of the Wiz Container Deployment Context Integration. Imports and evaluates container image vulnerability data for vulnerable and non-compliant assets in your cloud infrastructure.Findings are mapped to container vulnerable items \(CVITs\) to support triage, risk prioritization, and targeted remediation workflows for container-based workloads.

</td><td>

Wiz Container Vulnerability Integration

</td><td>

 

</td></tr></tbody>
</table>See [Runtime exposure visibility for container images](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/wiz-container-runtime-exposure-cvr.md) for more information about the chained integrations and container vulnerability response finding \(container vulnerable items\) creation.

Role required: sn\_vul\_wiz.configure\_integration

## Procedure

1.  Navigate to **All** &gt; **Wiz Vulnerability Integration** &gt; **Administration** &gt; **Configuration**.

2.  Select the **Container Vulnerabilities Configuration** tab.

3.  Select the **Configure CVR Based VI Granularity** link if you want to configure the image granularity keys that create container vulnerable items \(CVITs\).

    A CVIT is created by default by combining the image repository, vulnerability, and image. You can add components to the key for further granularity in the **Configure VI Granularity** module. For example, you might create a CVIT is for a combination of image repository, vulnerability, image, and cluster. See [Configuring container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configuring-findings-key-granularity.md) for more information.

4.  Fill in the fields.

    For some fields, you can specify multiple values. `--None--` is the \(default\). If `--None--` remains selected for a field, no data is imported for this field.

    If displayed select the lock icons \(\[Omitted image "dlp-lock-icon.png"\] Alt text: An closed padlock icon that indicates the field is locked and not editable.\) and \(\[Omitted image "dlp-unlock-icon.png"\] Alt text: An opened padlock icon that indicates the field is unlocked and editable.\) to edit and lock your edits.

<table id="table_wdj_klr_qfc"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

First

</td><td>

Pagination. Enter a value. You might prefer to start with 1000.

</td></tr><tr><td>

Has Public Exploit

</td><td>

Filter on vulnerability findings for vulnerabilities with an available exploit: \(true/false\).

</td></tr><tr><td>

Subscription

</td><td>

Import findings from the following strings for external subscription IDs: \(AWS Account, Azure Subscription, GCP Project, and OCI Compartment\). If you don't provide a value, all subscriptions are returned.

</td></tr><tr><td>

Has Fix

</td><td>

Import vulnerability findings for vulnerabilities with an available fix \(true/false\).

</td></tr><tr><td>

Vulnerability

</td><td>

Import vulnerability findings with matching external ID\(s\), for example, CVE-1234-5678,CVE-9110-26117.

</td></tr><tr><td>

Has CISA KEV Exploit

</td><td>

Import only vulnerability findings for vulnerabilities with an available CISA KEV exploit \(true/false\).

</td></tr><tr><td>

Project ID

</td><td>

Import only vulnerability findings for the given projects \(strings\).

</td></tr><tr><td>

Resource Has High Privileges

</td><td>

Return only vulnerability findings that have high privileges \(true/false\).

</td></tr><tr><td>

Resource Status

</td><td>

Return only findings with these statuses. You can specify multiple values:-   --None--
-   Active
-   Error
-   Inactive


</td></tr><tr><td>

Resource Has Admin Privileges

</td><td>

Return only vulnerability findings that have admin privileges. \(true/false\)

</td></tr><tr><td>

Detection Method

</td><td>

Filter on vulnerability findings found by these detection methods:-   --None--
-   DEFAULT\_PACKAGE
-   FILE\_PATH
-   INSTALLED\_PROGRAM
-   INSTALLED\_PROGRAM\_BY\_SERVICE
-   LIBRARY
-   OS
-   PACKAGE


</td></tr><tr><td>

Resource Has Limited Internet Exposure

</td><td>

Filter for vulnerability findings that have low internet exposure-   --None--
-   TRUE
-   FALSE


</td></tr><tr><td>

Status

</td><td>

Filter findings by status:-   --None--
-   OPEN
-   RESOLVED


</td></tr><tr><td>

Vulnerability Severity

</td><td>

Filter findings by vulnerability severity:-   --None--
-   CRITICAL
-   HIGH
-   LOW
-   MEDIUM


</td></tr><tr><td>

Validated In Runtime

</td><td>

-   --None--
-   Yes- Select **Yes** to pull in data for resources that have this flag set to `Yes` in the Runtime field. In Wiz console, the 'Validated in Runtime' status for a finding typically persists for a 48-hour period from the last time the vulnerable package was detected in memory.
-   No. Do not pull data for these resources.


</td></tr></tbody>
</table>5.  **Select Save and test**.

    If the credentials have been saved and validated successfully a message is displayed. You can select filtering for another integration import.

6.  [Configure container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configure-key-granularity.md).

    You can configure the granularity of the container vulnerable items \(CVITs\) by specifying the key combination. For more information about supported keys, system properties, and the scheduled job also required, see [Configuring container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configuring-findings-key-granularity.md).

    A CVIT is created by default by combining the image repository, vulnerability, and image. You can add components to the key for further granularity. For example, create a CVIT is for a combination of image repository, vulnerability, image, and cluster.