---
title: Field mapping for the Wiz Vulnerability Response Integrations
description: Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/wiz-vul-resp-integration-view-findings.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: reference
last_updated: "2026-07-13"
reading_time_minutes: 5
breadcrumb: [Wiz Vulnerability Response Integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Field mapping for the Wiz Vulnerability Response Integrations

Review source and target fields and view imported data on tables and records in your ServiceNow AI Platform® instance.

## Asset Integration field mapping

<table id="table_wwz_tyc_sgc"><thead><tr><th>

Wiz field

</th><th>

ServiceNow table

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

id

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_id

</td></tr><tr><td>

nativeType

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_resource\_typeAlso, stored in source\_data as wiz\_native\_type

</td></tr><tr><td>

type

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_datastored in source\_data as ciType

</td></tr><tr><td>

name

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

name

</td></tr><tr><td>

name

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

resource\_name

</td></tr><tr><td>

graphEntity.providerUniqueId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataIf exist, stored in source\_data as provider\_unique\_id

</td></tr><tr><td>

graphEntity.properties.externalId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataIf exist and graphEntity.providerUniqueId does not exist, then it gets stored in source\_data as provider\_unique\_id

</td></tr><tr><td>

lastSeen

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

non\_infra\_last\_scan\_dateAlso stored as last\_scan\_time in source\_data field in Discovered item table

</td></tr><tr><td>

firstSeen

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as first\_seen

</td></tr><tr><td>

isOpenToAllInternet

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as is\_open\_to\_all\_internet

</td></tr><tr><td>

isAccessibleFromInternet

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cmdb\_ci\_internet\_facingStored in source\_data as is\_accessible\_from\_internet

</td></tr><tr><td>

hasAccessToSensitiveData

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as has\_access\_to\_sensitive\_data

</td></tr><tr><td>

hasAdminPrivileges

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as has\_admin\_privileges

</td></tr><tr><td>

hasHighPrivileges

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as has\_high\_privileges

</td></tr><tr><td>

hasSensitiveData

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as has\_sensitive\_data

</td></tr><tr><td>

typeFields.operatingSystem

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

os

</td></tr><tr><td>

typeFields.instanceType

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as instance\_type

</td></tr><tr><td>

resourceGroup.id

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as resource\_group\_id

</td></tr><tr><td>

resourceGroup.name

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataStored in source\_data as resource\_group\_name

</td></tr><tr><td>

tags

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

host\_tag

</td></tr><tr><td>

cloudPlatform

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_service\_provider

</td></tr><tr><td>

region

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_region

</td></tr><tr><td>

cloudAccount.externalId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_account

</td></tr><tr><td>

projects

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

projects

</td></tr><tr><td>

cloudProviderURL

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

resource\_idThis is used to retrieve project id in case of GCP cloud platform Serverless resource type.

</td></tr><tr><td>

externalId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

resource\_idThis is used as resource\_id in case of Azure cloud platform Virtual machine resource type.

</td></tr></tbody>
</table>## Host vulnerability Integration field mapping

<table id="table_dty_z2c_cgc"><thead><tr><th>

Wiz field

</th><th>

ServiceNow table

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

description

</td><td>

sn\_vul\_detection

</td><td>

proof

</td></tr><tr><td>

status

</td><td>

sn\_vul\_detection

</td><td>

source\_status

</td></tr><tr><td>

lastDetectedAt

</td><td>

sn\_vul\_detection

</td><td>

last\_found

</td></tr><tr><td>

firstDetectedAt

</td><td>

sn\_vul\_detection

</td><td>

first\_found

</td></tr><tr><td>

vulnerableAsset.name

</td><td>

sn\_vul\_detection

</td><td>

dns

</td></tr><tr><td>

remediation

</td><td>

sn\_vul\_detection

</td><td>

solution\_summary

</td></tr><tr><td>

vulnerableAsset.ipAddresses\[0\]

</td><td>

sn\_vul\_detection

</td><td>

ip\_address

</td></tr><tr><td>

vendorSeverity

</td><td>

sn\_vul\_detection

</td><td>

source\_severity

</td></tr><tr><td>

fixedVersion

</td><td>

sn\_vul\_detection

</td><td>

fixed\_version

</td></tr><tr><td>

status

</td><td>

sn\_vul\_detection

</td><td>

is\_ignored

</td></tr><tr><td>

status

</td><td>

sn\_vul\_detection

</td><td>

status

</td></tr><tr><td>

name

</td><td>

sn\_vul\_entry

</td><td>

id

</td></tr><tr><td>

score

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_base\_score

</td></tr><tr><td>

CVEDescription

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

summary

</td></tr><tr><td>

vendorSeverity

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

source\_severity

</td></tr><tr><td>

cvssv3.attackVector

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_attack\_vector

</td></tr><tr><td>

cvssv3.attackComplexity

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_attack\_complexity

</td></tr><tr><td>

cvssv3.confidentialityImpact

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_confidentiality\_impact

</td></tr><tr><td>

cvssv3.privilegesRequired

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_privileges\_required

</td></tr><tr><td>

cvssv3.integrityImpact

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_integrity\_impact

</td></tr><tr><td>

cvssv3.userInteractionRequired

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

v3\_user\_interaction

</td></tr><tr><td>

hasExploit

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

exploit

</td></tr><tr><td>

hasCisaKevExploit

</td><td>

sn\_vul\_third\_party\_entry

</td><td>

cisa\_exists

</td></tr><tr><td>

vulnerableAsset.tags

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

host\_tag

</td></tr><tr><td>

vulnerableAsset.id

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_id

</td></tr><tr><td>

vulnerableAsset.name

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

name

</td></tr><tr><td>

vulnerableAsset.region

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_region

</td></tr><tr><td>

vulnerableAsset.providerUniqueId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

resource\_id

</td></tr><tr><td>

vulnerableAsset.cloudPlatform

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_service\_provider

</td></tr><tr><td>

vulnerableAsset.type

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

assetType

</td></tr><tr><td>

relatedIssueAnalytics

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr><tr><td>

vulnerableAsset.nativeType

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_resource\_type

</td></tr><tr><td>

vulnerableAsset.subscriptionExternalId

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

cloud\_account

</td></tr><tr><td>

vulnerableAsset.name

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

resource\_name

</td></tr><tr><td>

vulnerableAsset.imageName

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

image\_id

</td></tr><tr><td>

vulnerableAsset.\*

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_dataAll the details inside vulnerableAsset are added in source\_data field.

</td></tr><tr><td>

lastDetectedAt

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr></tbody>
</table>## Container vulnerability Integration field mapping

|Wiz field|ServiceNow table|ServiceNow field|
|---------|----------------|----------------|
|imageId|sn\_vul\_container\_image|image\_id|
|vulnerableAsset.name|sn\_vul\_container\_image|image\_name|
|vulnerableAsset.repository.externalId after \#\#|sn\_vul\_container\_image|registry|
|vulnerableAsset.repository.externalId before \#\#|sn\_vul\_container\_image|repo|
|vulnerableAsset.tags|sn\_vul\_container\_image|image\_labels|
|projects|sn\_vul\_container\_image|image\_projects|
|vulnerableAsset.region|sn\_vul\_container\_image|cloud\_regions|
|vulnerableAsset.cloudPlatform|sn\_vul\_container\_image|cloud\_providers|
|vulnerableAsset.subscriptionExternalId|sn\_vul\_container\_image|cloud\_account\_ids|
|vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image|image\_namespace|
|vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image|image\_clusters|
|vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image\_vulnerable\_item|image\_clusters|
|vulnerableAsset.executionControllers.ancestors.name|sn\_vul\_container\_image\_vulnerable\_item|image\_namespace|
|vulnerableAsset.repository.externalId before \#\#|sn\_vul\_container\_image\_vulnerable\_item|image\_repository|
|layerMetadata.isBaseLayer|sn\_vul\_container\_image\_findings|is\_base\_image|
|firstDetectedAt|sn\_vul\_container\_image\_findings|first\_found|
|lastDetectedAt|sn\_vul\_container\_image\_findings|last\_found|
|detailedName|sn\_vul\_container\_image\_package|name|
|version|sn\_vul\_container\_image\_package|version|
|locationPath|sn\_vul\_container\_image\_package|path|
|name|sn\_vul\_entry|id|
|score|sn\_vul\_third\_party\_entry|v3\_base\_score|
|CVEDescription|sn\_vul\_third\_party\_entry|summary|
|vendorseverity|sn\_vul\_third\_party\_entry|source\_severity|
|cvssv3.attackVector|sn\_vul\_third\_party\_entry|v3\_attack\_vector|
|cvssv3.attackComplexity|sn\_vul\_third\_party\_entry|v3\_attack\_complexity|
|cvssv3.confidentialityImpact|sn\_vul\_third\_party\_entry|v3\_confidentiality\_impact|
|cvssv3.privilegesRequired|sn\_vul\_third\_party\_entry|v3\_privileges\_required|
|cvssv3.integrityImpact|sn\_vul\_third\_party\_entry|v3\_integrity\_impact|
|cvssv3.userInteractionRequired|sn\_vul\_third\_party\_entry|v3\_user\_interaction|
|hasExploit|sn\_vul\_third\_party\_entry|hasExploit|
|layerMetadata.isBaseLayer|sn\_vul\_container\_image\_layer|Base layer|
|layerMetadata.details|sn\_vul\_container\_image\_layer|instruction|
|layerMetadata.id|sn\_vul\_container\_image\_layer|id|
|status|sn\_vul\_container\_image\_findings|is\_ignored|
|validate\_at\_runtime|sn\_vul\_container\_image\_findings|validate\_at\_runtime|
|id|sn\_vul\_container\_image\_findings|unique\_key|
|fixed\_version|sn\_vul\_container\_image\_findings|fix\_status|

## Configuration Compliance Test Results Integration field mapping

<table id="table_p5l_ngc_cgc"><thead><tr><th>

Wiz field

</th><th>

ServiceNow table

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

rule.id

</td><td>

sn\_vulc\_test

</td><td>

source\_id

</td></tr><tr><td>

rule.name

</td><td>

sn\_vulc\_test

</td><td>

short\_description

</td></tr><tr><td>

rule.remediationInstructions

</td><td>

sn\_vulc\_test

</td><td>

remediation

</td></tr><tr><td>

rule.description

</td><td>

sn\_vulc\_test

</td><td>

description

</td></tr><tr><td>

severity

</td><td>

sn\_vulc\_test

</td><td>

source\_criticality

</td></tr><tr><td>

status

</td><td>

sn\_vulc\_result

</td><td>

result

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

source\_id

</td></tr><tr><td>

analyzedAt

</td><td>

sn\_vulc\_result

</td><td>

last\_seen

</td></tr><tr><td>

firstSeenAt

</td><td>

sn\_vulc\_result

</td><td>

first\_seen

</td></tr><tr><td>

rule.remediationInstructions

</td><td>

sn\_vulc\_result

</td><td>

remediation

</td></tr><tr><td>

resource.nativeType

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr><tr><td>

resource.type

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

description

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

source\_id

</td></tr><tr><td>

securitySubCategories.category.framework.id

</td><td>

sn\_vulc\_auth\_src

</td><td>

source\_id

</td></tr><tr><td>

securitySubCategories.category.framework.name

</td><td>

sn\_vulc\_auth\_src

</td><td>

short\_description

</td></tr><tr><td>

securitySubCategories.category.framework.description

</td><td>

sn\_vulc\_auth\_src

</td><td>

description

</td></tr><tr><td>

securitySubCategories.id

</td><td>

sn\_vulc\_citation

</td><td>

section

</td></tr><tr><td>

securitySubCategories.title

</td><td>

sn\_vulc\_citation

</td><td>

section\_name

</td></tr><tr><td>

resource.projects

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

projects

</td></tr><tr><td>

status

</td><td>

sn\_vulc\_result

</td><td>

is\_ignoredif status is Rejected, is\_ignored is set to true, else false.

</td></tr></tbody>
</table>## Issues Integration field mapping

**Note:** Data mapped for the Issues Integration to cloud test results \(CTRs\) are labeled with `Wiz Issues` as the source to help you differentiate these CTRs from the test results integration CTRs.

<table id="table_tn5_hhc_cgc"><thead><tr><th>

Wiz field

</th><th>

ServiceNow table

</th><th>

ServiceNow field

</th></tr></thead><tbody><tr><td>

sourceRule.id

</td><td>

sn\_vulc\_test

</td><td>

source\_id

</td></tr><tr><td>

sourceRule.name

</td><td>

sn\_vulc\_test

</td><td>

short\_description

</td></tr><tr><td>

sourceRule.resolutionRecommendation/sourceRule.remediationInstructions

</td><td>

sn\_vulc\_test

</td><td>

remediation

</td></tr><tr><td>

sourceRule.description

</td><td>

sn\_vulc\_test

</td><td>

description

</td></tr><tr><td>

severity

</td><td>

sn\_vulc\_test

</td><td>

source\_criticality

</td></tr><tr><td>

createdAt

</td><td>

sn\_vulc\_result

</td><td>

first\_seen

</td></tr><tr><td>

updatedAt

</td><td>

sn\_vulc\_result

</td><td>

last\_seen

</td></tr><tr><td>

status

</td><td>

sn\_vulc\_result

</td><td>

result

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

source\_id

</td></tr><tr><td>

sourceRule.resolutionRecommendation/sourceRule.remediationInstructions

</td><td>

sn\_vulc\_result

</td><td>

remediation

</td></tr><tr><td>

sourceRule.controlDescription

</td><td>

sn\_vulc\_result

</td><td>

description

</td></tr><tr><td>

entitySnapshot.nativeType

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr><tr><td>

entitySnapshot.type

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

source\_data

</td></tr><tr><td>

Wiz issue

</td><td>

sn\_vulc\_result

</td><td>

result\_type

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

description

</td></tr><tr><td>

severity

</td><td>

sn\_vulc\_test

</td><td>

source\_criticality

</td></tr><tr><td>

id

</td><td>

sn\_vulc\_result

</td><td>

source\_id

</td></tr><tr><td>

sourcerule.securitySubCategories.category.framework.id

</td><td>

sn\_vulc\_auth\_src

</td><td>

source\_id

</td></tr><tr><td>

sourcerule.securitySubCategories.category.framework.name

</td><td>

sn\_vulc\_auth\_src

</td><td>

short\_description

</td></tr><tr><td>

sourcerule.securitySubCategories.category.framework.description

</td><td>

sn\_vulc\_auth\_src

</td><td>

description

</td></tr><tr><td>

sourcerule.securitySubCategories.id

</td><td>

sn\_vulc\_citation

</td><td>

section

</td></tr><tr><td>

sourcerule.securitySubCategories.title

</td><td>

sn\_vulc\_citation

</td><td>

section\_name

</td></tr><tr><td>

projects

</td><td>

sn\_sec\_cmn\_src\_ci

</td><td>

projects

</td></tr><tr><td>

status

</td><td>

sn\_vulc\_result

</td><td>

is\_ignoredif status is Rejected, is\_ignored is set to true, else false.

</td></tr></tbody>
</table>## Wiz SCA Findings Integration

|Wiz JSON Field|ServiceNow Table|ServiceNow Field|
|--------------|----------------|----------------|
|name|sn\_vul\_app\_vul\_entry|id|
|CVEDescription|sn\_vul\_app\_vul\_entry|threat, summary|
|CVSSSeverity|sn\_vul\_app\_vul\_entry|source\_severity|
|cvssv3.attackVector|sn\_vul\_app\_vul\_entry|v3\_attack\_vector|
|cvssv3.attackComplexity|sn\_vul\_app\_vul\_entry|v3\_attack\_complexity|
|cvssv3.confidentialityImpact|sn\_vul\_app\_vul\_entry|v3\_confidentiality\_impact|
|cvssv3.privilegesRequired|sn\_vul\_app\_vul\_entry|v3\_privileges\_required|
|cvssv3.integrityImpact|sn\_vul\_app\_vul\_entry|v3\_integrity\_impact|
|cvssv3.userInteractionRequired|sn\_vul\_app\_vul\_entry|v3\_user\_interaction|
|hasExploit|sn\_vul\_app\_vul\_entry|exploit|
|hasCisaKevExploit|sn\_vul\_app\_vul\_entry|cisa\_exists|
|id|sn\_vul\_app\_vulnerable\_item|source\_avit\_id|
|name|sn\_vul\_app\_vulnerable\_item|source\_entry\_id|
|vendorSeverity|sn\_vul\_app\_vulnerable\_item|source\_severity|
|status|sn\_vul\_app\_vulnerable\_item|computed\_status, source\_remediation\_status, source\_finding\_status|
|status == REJECTED|sn\_vul\_app\_vulnerable\_item|is\_ignored = "true"|
|description|sn\_vul\_app\_vulnerable\_item|source\_vulnerability\_summary, description|
|remediation|sn\_vul\_app\_vulnerable\_item|source\_recommendation|
|link|sn\_vul\_app\_vulnerable\_item|source\_notes|
|portalUrl|sn\_vul\_app\_vulnerable\_item|source\_link|
|locationPath|sn\_vul\_app\_vulnerable\_item|location \(part of affected\_url\)|
|lastDetectedAt|sn\_vul\_app\_vulnerable\_item|last\_found \(date\), last\_found\_dt\_tm \(datetime\)|
|firstDetectedAt|sn\_vul\_app\_vulnerable\_item|first\_found|
|resolvedAt|sn\_vul\_app\_vulnerable\_item|source\_resolved\_date|
|projects|sn\_vul\_app\_vulnerable\_item, sn\_sec\_cmn\_projects|source\_additional\_info\_string, projects|
|vulnerableAsset.repositoryId|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release, sn\_vul\_app\_vul\_scan\_summary|source\_app\_id|
|vulnerableAsset.repositoryName|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release|app\_name|
|vulnerableAsset.cloudProviderURL|sn\_vul\_app\_vulnerable\_item|affected\_url \(prepended to locationPath\)|
|detailedName|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_package|package\_unique\_id, package\_name|
|version|sn\_vul\_app\_package|package\_version|
|fixedVersion|sn\_vul\_app\_package|fixed\_package\_version|
|lastDetectedAt|sn\_vul\_app\_vul\_scan\_summary|last\_scan\_date|

**Important:** Fixed values for SCA Findings:

-   sn\_vul\_app\_vulnerable\_item.scan\_type = "sca"
-   sn\_vul\_app\_vul\_scan\_summary.source\_scan\_id = "Wiz\_SCA\_Scan"
-   sn\_vul\_app\_vul\_scan\_summary.scan\_summary\_name = "Wiz SCA Scan"

## Wiz Secret Findings Integration

|Wiz JSON Field|ServiceNow Table|ServiceNow Field|
|--------------|----------------|----------------|
|rule.id|sn\_vul\_app\_vul\_entry|id \(stored as "Wiz-" + rule.id\)|
|rule.name|sn\_vul\_app\_vul\_entry|threat, summary|
|severity|sn\_vul\_app\_vul\_entry|source\_severity|
|id|sn\_vul\_app\_vulnerable\_item|source\_avit\_id|
|rule.id|sn\_vul\_app\_vulnerable\_item|source\_entry\_id \(as "Wiz-" + rule.id\)|
|severity|sn\_vul\_app\_vulnerable\_item|source\_severity|
|status|sn\_vul\_app\_vulnerable\_item|computed\_status, source\_remediation\_status, source\_finding\_status|
|path|sn\_vul\_app\_vulnerable\_item|location \(part of source\_link and description\)|
|lineNumber|sn\_vul\_app\_vulnerable\_item|line\_number|
|firstSeenAt|sn\_vul\_app\_vulnerable\_item|first\_found|
|lastSeenAt|sn\_vul\_app\_vulnerable\_item|last\_found \(date\), last\_found\_dt\_tm \(datetime\)|
|resolvedAt|sn\_vul\_app\_vulnerable\_item|source\_resolved\_date|
|externalId|sn\_vul\_app\_vulnerable\_item|source\_notes|
|relatedIssueAnalytics|sn\_vul\_app\_vulnerable\_item|source\_additional\_info\_string|
|resource.typedProperties.repository.id|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release, sn\_vul\_app\_vul\_scan\_summary|source\_app\_id|
|resource.typedProperties.repository.name|sn\_vul\_app\_vulnerable\_item, sn\_vul\_app\_release|app\_name \(part of description\)|
|resource.typedProperties.repository.url|sn\_vul\_app\_vulnerable\_item|source\_link \(base\), part of description|
|resource.type + resource.externalId|sn\_vul\_app\_vulnerable\_item|source\_link \(branch suffix\)|
|lastSeenAt|sn\_vul\_app\_vul\_scan\_summary|last\_scan\_date|

**Important:** Fixed values for Secret Findings:

-   sn\_vul\_app\_vulnerable\_item.scan\_type = "secret"
-   sn\_vul\_app\_vul\_scan\_summary.source\_scan\_id = "Wiz\_Secret\_Scan"
-   sn\_vul\_app\_vul\_scan\_summary.scan\_summary\_name = "Wiz Secret Scan"

## Wiz Application List Integration

|Wiz JSON Field|ServiceNow Table|ServiceNow Field|
|--------------|----------------|----------------|
|id|sn\_vul\_app\_release|source\_app\_id|
|name|sn\_vul\_app\_release|app\_name|
|createdAt|sn\_vul\_app\_release|app\_creation\_date|
|updatedAt|sn\_vul\_app\_release|app\_updation\_date|
|lastSeen|sn\_vul\_app\_release|last\_seen\_date|
|graphEntity.properties.description|sn\_vul\_app\_release|description|
|All other graphEntity.properties.\* + technology|sn\_vul\_app\_release|source\_additional\_info|

**Important:** Fixed values for Application List: sn\_vul\_app\_release.active = true

## Mapping to vulnerable item and test result records

-   The Asset Integration imports data about your cloud assets reported by the Wiz scanner.
-   Host vulnerability findings are mapped to host vulnerable items \(VITs\).
-   Host test results that are associated with the resource type, VIRTUAL MACHINE are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application.
-   Container vulnerability findings are mapped to container vulnerable items \(CVITs\).
-   Configuration test results findings are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application.
-   Issues findings are mapped to cloud test results records \(CTRs\) in the Configuration Compliance application.
-   The Backfill Integrations import and process any Asset IDs that are reported as missing by the primary vulnerability and compliance integrations.