ServiceNow SBOM Integration

ServiceNow - Snyk Vulnerability Intelligence for SBOM

The Snyk Vulnerability Intelligence for SBOM app brings Snyk package vulnerability intelligence to SBOMs stored in ServiceNow for a more accurate understanding of risk within the enterprise software supply chain. Together, Snyk and ServiceNow provide the tools to prioritize efficiently and remediate vulnerabilities.

Use cases for ServiceNow SBOM integration

Understand how and where to apply remediation

When a new vulnerability is discovered for a particular package, know which applications are using the package (by version) and what version is needed for remediation.

Compliance and reporting

Identify packages with vulnerabilities within infrastructure based on a complete list of SBOMs stored in ServiceNow to achieve compliance and reporting requirements.

Purchased software security validation

Validate purchased software to ensure the new applications are not introducing vulnerabilities from open-source packages.

Identify, prioritize, and track new high-risk vulnerabilities

Using rules in ServiceNow, application vulnerable items (AVITs) can be created automatically when Snyk discovers high or critical-severity vulnerabilities that put key applications at risk. The AVIT workflow tracks remediation progress and can include stakeholder notification for visibility.

Prerequisites for Snyk Vulnerability Intelligence for SBOM

  • Snyk Vulnerability Intelligence for SBOM SKU

  • Entitlements needed with ServiceNow. Contact your ServiceNow representative to inquire.

  • A valid Purchase Order with Snyk for "Snyk Vulnerability Intelligence for SBOM" and the associated entitlement to activate the integration.

Getting started

From the ServiceNow Store, search Integrations for "Snyk". From there, select "Snyk Vulnerability Intelligence for SBOM". Once that integration is selected, follow the steps in the "Installation Guide" shown on that page.

As your customers upload SBOMs to ServiceNow, whether for purchased applications or internally developed applications, background jobs use the Package URL data found in SBOMs to query the Snyk Vulnerability Intelligence Database and add vulnerabilities to the "Third-Party Library" in ServiceNow.

The "Snyk SBOM Dashboard", included with the installation, provides key metrics from your environment in graphical format.

Demo video

Additional documentation

The "Snyk Vulnerability Intelligence for SBOM" ServiceNow Integration allows you to know when your software is at risk, how to fix it, and track the workflow to completion. In the event of a massive zero-day vulnerability, such as Log4j, you want to quickly see if the vulnerability is present in your environment and which applications are impacted.

Additionally, to better manage risk and compliance requirements, you need a complete list of the open-source and third-party software components used in application development, as well as the ability to identify and triage remediation for any vulnerabilities discovered in SBOM components. Snyk Vulnerability Intelligence for SBOM allows you to identify that risk.


If you need help, contact Snyk Support.

Last updated

More information

Snyk privacy policy

© 2023 Snyk Limited | All product and company names and logos are trademarks of their respective owners.