Skip to content
Identify applications in Application Vulnerability Response automatically › Use › Application Vulnerability Response › Unified Security Exposure Management › Security Operations
Release: Australia · Updated: 2026-06-25 · Official documentation · View source

Create a CI lookup rule

The CI Lookup Rules module contains rules that define what fields have matching data in the Configuration Management Database (CMDB). These rules are used to identify applications and application releases and add them to the application vulnerable item (AVI) record to aid in remediation.

Before you begin

Role required: App-Sec Manager group

About this task

Creating CI lookup rules requires advanced ServiceNow and Application Vulnerability Management expertise. Rather than modifying one of the existing lookup rules, consider copying it and modifying the copy. When you are satisfied that the new rule does what you want, deactivate the original.

Note: Rules, once removed, cannot be recovered. Rather than removing existing rules, deactivate them when creating new ones.

Procedure

  1. Navigate to All > Security Operations > CMDB > CI Lookup Rules.

  2. Click New.

  3. On the form, fill in the fields.

FieldDescription
NameName of the rule.
Lookup methodMethod used for matching. Choices are:- Script: Pre-built or custom script. - Field matching: Search on table or field in the CMDB.
TypeType used with the Script Lookup method.
OrderOrder of precedence for the rule. Matches with the lowest order are evaluated first.
ActiveCheck box for whether the rule is active or disabled.
SourceSource used as input to this rule. Once chosen, Condition filters appear.
Source fieldSource field used as input to this rule. Fields must be a string or number.
DescriptionText describing the rule.
Applies to

This field has no value by default.

For third-party and ServiceNow® integrations that support both Application Vulnerability Response (AVR) and Vulnerability Response (VR) like the Vulnerability Response Integration with Wiz, for example, select one as it applies to each rule:

  • Discovered Item - for Vulnerability Response lookup rules.
  • Discovered Application - for Application Vulnerability Response lookup rules. Note: If you leave this field empty for lookup rules that support both VR and AVR integrations, background jobs for both applications apply changes on the same set of lookup rules. This state might cause a conflict and set the reapply flag incorrectly.

With this distinction set, after the respective background jobs for AVR and VR are completed, the system resets the flag only for the lookup rules for the background job that was run.

V19.0: Lookup targetLookup approach you want to follow. Select from:- Configuration item - Product model
Script

Editable sample script, based on the Type, is shown. Implement the custom script following the comments included in the template of the default function.Note:

The process function has three parameters: rule, sourceValue, and sourcePayload

Search on CI tableTable to search within the CMDB. Used with field matching Lookup Method.
V19.0: Search on product tableIf you choose the Product model Lookup target, the default value is Application Model.
Search on CI fieldField that contains information that can be used to locate a CI. Used with the field matching Lookup method. This field may be on the CI record, or on a related record, such as a network adapter.
V19.0: Search on product model fieldIf you choose the Product model Lookup target, the default value is Name.
  1. Click Submit.
Image omitted: AVR-CI-LookupRules.png
CI lookup rule using a script

Related topics

Application Vulnerable Item fields