Comment on page
ServiceNow SBOM Integration
The Snyk Vulnerability Intelligence for SBOM app brings Snyk package vulnerability intelligence to SBOMs stored in ServiceNow for a more accurate understanding of risk within the enterprise software supply chain. Together, Snyk and ServiceNow provide the tools to prioritize efficiently and remediate vulnerabilities.
When a new vulnerability is discovered for a particular package, know which applications are using the package (by version) and what version is needed for remediation.
Identify packages with vulnerabilities within infrastructure based on a complete list of SBOMs stored in ServiceNow to achieve compliance and reporting requirements.
Validate purchased software to ensure the new applications are not introducing vulnerabilities from open-source packages.
Using rules in ServiceNow, application vulnerable items (AVITs) can be created automatically when Snyk discovers high or critical-severity vulnerabilities that put key applications at risk. The AVIT workflow tracks remediation progress and can include stakeholder notification for visibility.
- Snyk Vulnerability Intelligence for SBOM SKU
- Entitlements needed with ServiceNow. Contact your ServiceNow representative to inquire.
- A valid Purchase Order with Snyk for "Snyk Vulnerability Intelligence for SBOM" and the associated entitlement to activate the integration.
From the ServiceNow Store, search Integrations for "Snyk". From there, select "Snyk Vulnerability Intelligence for SBOM". Once that integration is selected, follow the steps in the "Installation Guide" shown on that page.
As your customers upload SBOMs to ServiceNow, whether for purchased applications or internally developed applications, background jobs use the Package URL data found in SBOMs to query the Snyk Vulnerability Intelligence Database and add vulnerabilities to the "Third-Party Library" in ServiceNow.
The "Snyk SBOM Dashboard", included with the installation, provides key metrics from your environment in graphical format.
ServiceNow Snyk Vulnerability Intelligence for SBOM Demo
The "Snyk Vulnerability Intelligence for SBOM" ServiceNow Integration allows you to know when your software is at risk, how to fix it, and track the workflow to completion. In the event of a massive zero-day vulnerability, such as Log4j, you want to quickly see if the vulnerability is present in your environment and which applications are impacted.
Additionally, to better manage risk and compliance requirements, you need a complete list of the open-source and third-party software components used in application development, as well as the ability to identify and triage remediation for any vulnerabilities discovered in SBOM components. Snyk Vulnerability Intelligence for SBOM allows you to identify that risk.