0
32.8.4
Brazil, Australia, Zurich, Yokohama Patch 6, Yokohama
Integration
This app version is intended for Unified Security Exposure Management (USEM), a major architectural upgrade to Vulnerability Response applications.
If you are currently using Vulnerability Response and upgrading to USEM for the first time, you must use the Migration assistant for Unified Security Exposure Management to ensure a safe and successful upgrade.
For full details, please refer to the KB2556844 and documentation before proceeding.
If you do not intend to upgrade to USEM, please select a version of this app below 30.x when installing or upgrading.
The Wiz integrations import vulnerability and compliance data from Wiz scanners into your ServiceNow AI Platform instance to help you get deeper insights into your cloud infrastructure risks. These integrations provide you with a comprehensive assessment of your overall cloud security posture and drive remediation actions directly from the ServiceNow AI Platform.
The Vulnerability Response Integration with Wiz application includes the following key integrations:
- Wiz Asset Integration
- This integration is a prerequisite to run any of the other Wiz integrations. Import assets to which the findings from other subsequent integrations are linked to.
- Wiz Vulnerability Integration
- Import host vulnerability findings related to virtual machines and serverless assets in your cloud environment with Wiz’s Host Vulnerability Integration. These findings are mapped to Host Vulnerable Items (VITs) within the Vulnerability Response application to support remediation workflows.
- Import container image vulnerability data discovered by Wiz. Findings are mapped to container vulnerable items (CVITs) to support triage, risk prioritization, and targeted remediation workflows for container-based workloads.
- Wiz Configuration Compliance Integration (Wiz Test Results)
- Import configuration test results from Wiz to detect non-compliant cloud configurations. Findings are mapped to cloud test results (CTRs) in the Configuration Compliance application to help you enforce security policies and standards across your cloud environment.
- Wiz Issues Integration
- Import Wiz Issues that identify assets involved in toxic combinations of vulnerabilities and misconfigurations. These findings are also mapped to CTRs with 'Wiz Issues' labeled as the source to help you track and remediate assets that may pose complex multi-vector risks.
- Wiz Application list, Wiz SCA findings, and Wiz Secret findings integrations
- Import application, Software Composition Analysis (SCA), findings, Secrets (passwords, tokens and keys) data.
New:
- Two new chained integrations to the Wiz container vulnerability pipeline:
- The Wiz Container Grouped Vulnerability Integration that retrieves vulnerability findings from Wiz that are grouped by image.
- The Wiz Container Deployment Context Integration that retrieves the complete deployment/execution context that includes clusters, namespaces, services for each image.
- Both integrations appear in the customer's Vulnerability Integrations list alongside the existing Wiz Container Vulnerability Integration.
- The integrations are installed automatically and are activated by default. To disable this integration chain, set the sn_vul_wiz.deployment_context_gate_writes system property to 'false'. This setting deactivates the Wiz Container Grouped Vulnerability and Wiz Container Deployment Context integrations so that container vulnerable item creation remains based on your existing settings with the Wiz Container Vulnerability Integration integration.
- These integrations are available to all customers who are entitled to Container Vulnerability Response.
- They remove a previous 16-controller-per-image cap that might leave large deployments with incomplete cluster/namespace visibility and unreliable auto-closing of vulnerable items when a deployment is removed.
- They provide a more accurate runtime exposure visibility at scale.
Changed:
- Enhancements to improve handling of Wiz API error codes that include clearer notifications directing users to contact the Wiz support team when a vendor-side error occurs.
- Enhancements to improve the reliability of the data migration for Wiz Container Vulnerability Response.
Fixed:
- An issue with duplicate container repository entries in Wiz container vulnerability data that might cause import errors.
- An error in the Wiz Host Test Results integration when processing configuration items with a null subscription state.
- An issue where the Vulnerability Summary displayed asset-specific details (such as file paths) instead of the standard CVE description.
- An issue where the "Send AI security findings to AI security exposure management" checkbox did not reflect its saved state when returning to the Wiz configuration page.
- An issue where the Wiz Container Vulnerability integration did not create label relationships on container image configuration items.
Not applicable for this application version.
- The following Security Operations plugins must be installed and activated:
- com.snc.security_support.vul
- com.snc.secops.orchestration
- The following applications must be installed and activated. These applications are available from the Servicenow Store:
- Vulnerability Response application and its dependent plugins
- For ingesting misconfigurations from Wiz, we need to install the com.snc.vulc plugin
- For ingesting the container vulnerabilities from Wiz, we need to install the com.snc.vulnerability.container plugin.
- Permissions and roles:
- System Admin (admin) for installation, and
- sn_vul_container.configure_integration or sn_vul_int_fw.configure_integration to configure the integration.