Cranium AVR Connector brings the vulnerability findings Cranium discovers in your AI and machine-learning applications into ServiceNow Application Vulnerability Response, where your security team already works.
Findings arrive as native Application Vulnerable Items through the Vulnerability Response Integration Framework, and each one is correlated to the Business Application configuration item it affects. ServiceNow’s own risk scoring, business-criticality weighting and assignment rules then apply to Cranium findings exactly as they do to every other source, so analysts work a single prioritised backlog instead of watching a second console.
The connector keeps the lifecycle in step with Cranium — findings create, update, close and reopen as the source changes — while preserving closures an analyst has made in ServiceNow. Ingestion is delta-based and idempotent, so a re-run converges rather than duplicating.
Administrators get an operational dashboard showing connection status, run history, CI correlation coverage, the applications that matched no CI, and a diagnostics checklist that names the fix for each failing check.
The connector calls the Cranium API outbound over HTTPS using OAuth 2.0 credentials held in the platform credential vault. It registers no inbound endpoint and sends no instance data to Cranium. A Cranium subscription is required.
- Cranium findings arrive as native Application Vulnerable Items in one prioritised AVR queue.
- Every finding is correlated to its Business Application CI, so native risk scoring applies.
- Runs on the Vulnerability Response Integration Framework: data source, staging, transform map.
- Lifecycle tracks Cranium — create, update, close, reopen — and preserves manual closures.
- Dashboard shows connection status, run history, correlation coverage and diagnostics.
Initial Release.
ServiceNow release: Australia or later.
Required ServiceNow applications — all four are declared as application dependencies and are enforced at install:
- Vulnerability Response (sn_vul), including Application Vulnerability Response. Provides the Application Vulnerable Item, Application Vulnerability Entry, Package and Release tables that the connector writes into.
- Vulnerability Response Integration Framework (sn_vul_int_fw). Provides the integration, data source and transform pipeline the connector runs on.
- Security Support Common (sn_sec_cmn). Provides the CI Lookup Rule engine used to correlate findings to a Business Application.
- Security Integration Framework (sn_sec_int). Provides the Discovered Application registration that owns the connector’s lookup rules.
Configuration Management Database: cmdb_ci_business_app records are required for CI correlation. Findings still ingest without a match, without a CI link.
Roles: an administrator to install and configure. Operators additionally need the Vulnerability Response Integration Framework roles sn_vul_int_fw.configure_integrations and sn_vul_int_fw.read_integrations.
Single domain: the connector is not domain-aware, so it must be installed and run on an instance that is not domain-separated. Run Diagnostics counts the domains on the instance and warns before the sync jobs are activated.
No MID Server is required. All traffic is outbound HTTPS, initiated by the instance.
Other Requirements:A Cranium AI platform subscription with access to the Cranium public vulnerabilities API. The connector is inoperable without a Cranium tenant and credentials.
- Cranium tenant, and the API base URL for that tenant.
- OAuth 2.0 client credentials (client ID and client secret) issued by Cranium, with the scope required by the vulnerabilities API.
- Outbound HTTPS connectivity from the ServiceNow instance to the Cranium API endpoint.
No other third-party software, licence or subscription is required.