SecPod Saner CVEM brings continuous vulnerability and patch posture into ServiceNow, and closes the loop by executing remediation from the changerequest that authorised it.
The application connects to your Saner CVEM tenant with an API key, discovers your Saner organisation and its accounts, and reports which Saner modules each account is licensed for. Sync policies then run on your schedule - periodic, daily, weekly or monthly, in a timezone you choose - pulling device inventory,
vulnerability findings and missing-patch findings into scoped tables. Ingestion is paged, resumable and bounded, so large tenants synchronise without long-running transactions, and every run records per-phase status, timings and row counts.
What you can do depends on the Saner modules the account is licensed for, and the application adapts rather than fails:
- Patch Management only. Patch data synchronises and each patch carries its CVE references as text, so you see which CVEs a patch addresses without full vulnerability records. Remediation and reboot are unaffected - both are dispatched and evidenced through the change request exactly as normal, with patches selected by patch severity.
- Vulnerability Management and Patch Management. You can remediate from either side. Synchronise vulnerabilities alone and target devices through the vulnerability-to-device mapping, selecting by CVSS score or severity; synchronise patches alone and target them through the patch-to-device mapping, selecting by patch severity. With both synchronised, each group rule chooses whichever path suits it, so a CVSS-driven rule and a patch-severity-driven rule can run side by side against the same estate.
Each device is correlated to a configuration item on serial number, then on hostname plus MAC address against the CI name, then against its fully qualified domain name, with the matching rule recorded in plain language on the device record. Correlation is strictly read-only - the CMDB is never written to. Where you map CMDB attributes to Saner tags, changed values are pushed back so Saner grouping reflects ServiceNow ownership.
Remediation is governed rather than ad hoc. Group rules turn a saved condition over findings into a change request carrying the correct change type, model, template and approval path, so patching inherits the change policy you already run. Moving that change to Implement dispatches patch or reboot jobs to Saner, and per-device status is reconciled back onto the change. Before it can close, the success percentage is recomputed from live finding state and compared against a per-change threshold and time window, so a change closes as successful only when the vulnerabilities it targeted are genuinely fixed.
Administration runs from a single guided page covering connectors, account and module selection, sync policies and data maintenance, with five roles separating the Saner administrator, SecOps manager, change manager, IT operator and read-only consumer. On-premise Saner deployments are reached through a MID Server. On-demand synchronisation and device rescans are available at any time.
The application uses only core platform capability - no Vulnerability Response, no Integration Hub, no other licensed plugin. ITSM with Change Management is sufficient.
- Continuous vulnerability and patch posture in ServiceNow. Scheduled, resumable synchronisation of devices, vulnerabilities and missing patches from SecPod Saner CVEM into the application's own scoped tables, with per-run telemetry. Per-account schedules, batch sizes, and optional severity and operating-system-family filters.
- Findings tied to configuration items. Each Saner device is correlated to a CI on serial number, then hostname plus MAC address, with the matching rule recorded on the device record. The CMDB is read only and never written to, so existing data quality is preserved.
- Remediation governed by native Change Management. Group rules turn a saved condition over findings into a change request with the correct change type, model, template and approvals. Standard, normal and emergency change paths are all supported, and list actions on Vulnerable Items and Patch Items create a change on demand.
- Patch and reboot dispatch from the change request itself. Moving the change to Implement resolves findings to device-and-patch pairs, groups them by identical patch profile, batches them within payload and device-count limits, and dispatches remediation or reboot jobs to Saner inside the configured deployment window.
- Closure that reflects reality. Scheduled pollers reconcile per-device job status and recompute the success percentage from live finding state, advancing or closing the change only once it clears a per-change threshold and time window. Partial results are announced and retried rather than silently closed.
- On-demand device scan. Ask Saner to rescan selected devices so posture can be refreshed without waiting for the next scheduled run.
- Guided connector onboarding. An administration page validates the Saner tenant domain and API key, discovers the organisation and its accounts, reports which Saner modules each account is licensed for, and stores the credential encrypted. Connector creation is transactional, so a partial failure leaves nothing behind.
- No additional ServiceNow licensing. Core platform capability only. Vulnerability Response, Integration Hub and Flow Designer are not required, and no global-scope artifact is introduced. Outbound calls use RESTMessageV2, with MID Server support for on-premises Saner deployments.
Version 1.0.0 — initial release
First release of SecPod Saner CVEM for ServiceNow. All capability is new in this version:
- Connector onboarding with encrypted API key storage, account discovery and per-account Saner module entitlement reporting.
- Per-account sync policies — periodic, daily, weekly or monthly in a chosen timezone — with independent toggles and batch sizes for device, vulnerability and patch synchronisation, optional severity and operating-system-family filters, and a CMDB-attribute-to-Saner-tag field map.
- Resumable synchronisation engine with per-phase status, timings, insert/update/skip counts, cooperative abort and page-level resume.
- Read-only CMDB correlation with the matching rule recorded on each device.
- Group rules and on-demand list actions that build change requests from findings, supporting standard, normal and emergency change.
- Patch remediation and reboot dispatch on Implement, with per-device job tracking and deployment windows.
- Status reconciliation and threshold-based change closure.
- On-demand device scan.
- Administrator-triggered data maintenance.
ServiceNow compatibility. Built, tested and certified on Yokohama, which is the oldest family release supported. Supported on Yokohama and every subsequent family up to and including Australia. Nothing in the application depends on a release-specific API.
ServiceNow platform.
- Release: Yokohama or later, up to and including Australia. Families older than Yokohama are not supported.
- ITSM with Change Management — change requests are the unit of governance and the trigger for remediation. Change models, standard change record producers, producer versions and templates are read to resolve the change type. Included with ITSM.
- Configuration Management Database — for device correlation and the attribute values pushed back to Saner as tags. Read only, so the base CMDB is sufficient; Discovery and Service Mapping are not required.
- Import Sets — ingestion stages rows in tables extending sys_import_set_row and transforms them with three shipped transform maps.
- MID Server — required only where the customer's Saner deployment is on-premises and therefore unreachable directly from the instance. Not needed for Saner cloud tenants, nor where an on-premises Saner deployment sits in the same network as an on-premises instance.
- Roles: installation requires admin. Day-to-day use is served by the four application roles the package ships.
SecPod Saner CVEM.
- An active SecPod Saner CVEM subscription with at least one organisation and one account.
- A Saner API key with permission to call the service-provision, reporting, remediation and reboot operations. The application validates the key on entry and reports precisely which of these is unavailable.
- Per-account Saner module entitlements determine which capabilities are available: Vulnerability Management for vulnerability synchronisation, Patch Management for patch synchronisation and all remediation and reboot dispatch.
Network.
- Outbound HTTPS on TCP 443 from the ServiceNow instance — or from the customer's MID Server — to the customer's Saner tenant. Saner cloud tenants are regional: saner.secpod.com, eu.saner.secpod.com, uk.saner.secpod.com or in.saner.secpod.com.
- No inbound connectivity to the instance is required. The application exposes no internet-facing endpoint and creates no integration user, webhook or public page.
Browsers. Whichever browsers ServiceNow supports for the family release in use — current versions of Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari. The application sets no browser requirement of its own and embeds no content from non-ServiceNow domains.