ServiceNow Rapid7 Integration Guide

Architecture Overview

Implementation Steps

// Data transformation script for InsightVM to ServiceNow vulnerability mapping
(function transform(source, target) {
    target.source_id = source.id;
    target.vulnerability = source.title;
    target.description = source.description;
    target.cvss_base_score = source.cvss_v3_score || source.cvss_v2_score;
    target.priority = mapSeverityToPriority(source.severity);
    target.state = 'open';
    target.source_table = 'rapid7_insightvm';
    
    function mapSeverityToPriority(severity) {
        switch(severity.toLowerCase()) {
            case 'critical': return '1';
            case 'severe': return '2';
            case 'moderate': return '3';
            default: return '4';
        }
    }
})(source, target);

// Business Rule script for automated remediation task creation
(function executeRule(current, previous /*null when async*/) {
    var task = new GlideRecord('sn_vul_remediation_task');
    task.initialize();
    task.vulnerable_item = current.sys_id;
    task.short_description = 'Remediate: ' + current.vulnerability;
    task.description = 'Address vulnerability: ' + current.description;
    task.priority = current.priority;
    task.assigned_to = determineAssignee(current.cmdb_ci);
    task.due_date = calculateDueDate(current.cvss_base_score);
    task.state = 'open';
    task.insert();
    
    function calculateDueDate(cvssScore) {
        var daysToAdd = cvssScore >= 9 ? 7 : cvssScore >= 7 ? 14 : 30;
        var dueDate = new GlideDateTime();
        dueDate.addDays(daysToAdd);
        return dueDate;
    }
})(current, previous);

// Risk scoring script incorporating InsightVM threat data
(function calculateRisk() {
    var riskScore = 0;
    var cvssScore = parseFloat(current.cvss_base_score) || 0;
    var exploitMaturity = current.u_exploit_maturity || '';
    var assetCriticality = current.cmdb_ci.u_criticality || 'medium';
    
    // Base CVSS contribution (40% weight)
    riskScore += (cvssScore / 10) * 40;
    
    // Exploit maturity modifier (30% weight)
    var exploitWeight = {'proof-of-concept': 10, 'functional': 20, 'weaponized': 30};
    riskScore += (exploitWeight[exploitMaturity] || 0);
    
    // Asset criticality modifier (30% weight)
    var criticalityWeight = {'low': 5, 'medium': 15, 'high': 25, 'critical': 30};
    riskScore += criticalityWeight[assetCriticality] || 15;
    
    return Math.min(riskScore, 100);
})();

// Flow error handling and retry logic
var attempt = 0;
var maxAttempts = 3;
var success = false;

while (attempt < maxAttempts && !success) {
    try {
        var response = sn_ih_rapid7.InsightVM().getVulnerabilities({
            connection: 'Rapid7_InsightVM_Connection',
            site_id: inputs.site_id,
            severity: inputs.severity_filter
        });
        
        if (response.status_code == 200) {
            success = true;
            outputs.vulnerabilities = response.body.resources;
        } else if (response.status_code == 429) {
            // Rate limit exceeded, wait and retry
            gs.sleep(60000); // Wait 1 minute
            attempt++;
        }
    } catch (ex) {
        gs.error('Rapid7 sync error on attempt ' + (attempt + 1) + ': ' + ex.message);
        attempt++;
        if (attempt < maxAttempts) gs.sleep(30000);
    }
}

// Validation script to verify data integrity after sync
(function validateSync() {
    var vulnItems = new GlideRecord('sn_vul_vulnerable_item');
    vulnItems.addQuery('source_table', 'rapid7_insightvm');
    vulnItems.addQuery('sys_created_on', '>', gs.daysAgoStart(1));
    vulnItems.query();
    
    var validCount = 0;
    var errorCount = 0;
    
    while (vulnItems.next()) {
        if (vulnItems.source_id.nil() || vulnItems.cvss_base_score.nil()) {
            gs.error('Invalid vulnerability record: ' + vulnItems.number);
            errorCount++;
        } else {
            validCount++;
        }
    }
    
    gs.info('Rapid7 sync validation: ' + validCount + ' valid, ' + errorCount + ' errors');
    return {valid: validCount, errors: errorCount};
})();

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom business rules to automatically adjust vulnerability priorities based on asset business criticality and InsightVM threat context, creating a more sophisticated risk-based prioritization than default CVSS scoring alone. Use ServiceNow's Event Management capabilities to correlate vulnerability findings with security incidents for comprehensive threat response workflows.
• →Configure InsightVM vulnerability categories to map to ServiceNow knowledge base articles containing standardized remediation procedures, enabling consistent and efficient vulnerability resolution across teams. Leverage ServiceNow's approval workflows for vulnerability exceptions to maintain audit trails and periodic review cycles for accepted risks.
• →Utilize ServiceNow's Performance Analytics to create trending dashboards showing vulnerability discovery rates, mean time to remediation, and team performance metrics based on InsightVM data. Set up automated reporting for compliance frameworks by correlating vulnerability findings with specific regulatory requirements and control mappings.
• →Implement webhook endpoints in ServiceNow to receive real-time notifications from InsightVM for critical vulnerabilities, enabling immediate response workflows that bypass scheduled synchronization delays. Use ServiceNow's Machine Learning capabilities to predict vulnerability remediation timeframes based on historical InsightVM data and asset characteristics.
• →Create custom Integration Hub actions that enrich InsightVM vulnerability data with external threat intelligence feeds and ServiceNow asset context before creating vulnerable item records. Establish bidirectional workflows that update InsightVM scan schedules based on ServiceNow change management activities to ensure vulnerabilities are re-verified after remediation.
• →Design your integration to handle InsightVM site-based architecture by creating separate flows for different network segments or business units, allowing for customized vulnerability management workflows based on organizational structure and security requirements.

Known Limitations

• —The InsightVM API enforces strict rate limiting of 500 requests per minute per API key, which can significantly impact bulk vulnerability import operations and requires careful flow design with retry logic and request throttling. Large organizations with extensive vulnerability datasets may need to implement pagination and extended synchronization windows to avoid hitting these limits.
• —InsightVM's vulnerability data model includes proprietary threat intelligence fields and risk calculations that may not have direct equivalents in ServiceNow's standard vulnerability schema, requiring custom field extensions and complex data transformation logic. Some InsightVM-specific vulnerability context may be lost during the mapping process to ServiceNow's standardized vulnerability format.
• —The integration relies heavily on asset correlation between InsightVM and ServiceNow CMDB, but asset naming conventions and identification methods may differ significantly between systems, potentially resulting in unlinked vulnerabilities and incomplete risk assessment. Manual intervention may be required to establish proper asset relationships for newly discovered systems.
• —Real-time vulnerability notifications require webhook implementation and additional development beyond the standard spoke functionality, as the default integration pattern relies on scheduled polling which introduces latency in critical vulnerability response scenarios. Organizations requiring immediate vulnerability notifications must implement custom webhook receivers and associated security measures.
• —The IntegrationHub Professional license is required for the Rapid7 spoke functionality, and spoke action limitations may restrict the complexity of vulnerability data processing and transformation operations within flow designer, potentially requiring custom scripted solutions for advanced integration requirements.

Frequently Asked Questions