{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43534,"path":"security-management/application-vulnerability-response/avr-product-view.md","title":"Application Vulnerability Response product view","bundle":null,"doc_type":null,"release":"australia","body":"\n# Application Vulnerability Response product view\n\nThe Application Vulnerability Response \\(AVR\\) product ingests the weaknesses and vulnerabilities detected by your application security testing tools and provides a single pane of glass to understand the security posture of all the applications in your environment.\n\nAVR enables you to reduce the risks with the remediation workflows. The objective of this product view is to help you understand how AVR key entities work with the core CSDM framework.\n\n## Updated terminology\n\nStarting with AVR v19.0, the following key table and column names have been updated. As a result, you will see references to both the older and newer names in the documentation.\n\n|Prior to AVR v19.0|Starting from AVR v19.0|\n|------------------|-----------------------|\n|CI lookup rules|Lookup rules|\n|CI lookup rule form|Lookup rule form|\n|CI matching rule|Matching rule|\n|Search on table|Search on CI table|\n|Search on field|Search on CI field|\n|Application release|Discovered applications|\n|Application release table|Discovered applications table|\n|Business criticality|Source business criticality|\n\n## Prerequisites\n\nInstall the latest versions of the following applications:\n\n-   Security Support Common\n-   Vulnerability Response\n-   Security Integration Framework\n-   Security Support Orchestration\n-   Scanner integrations such as Veracode and Fortify\n\n## AVR and CSDM 4.0\n\nPrior to AVR v19.0, when application vulnerabilities were ingested, the application for which the vulnerabilities were ingested were looked up using the CI lookup rules, against the Scanned Applications \\(sn\\_vul\\_app\\_scanned\\_application\\). If the application name record was not there, an entry would be made.\n\nStarting from AVR v19.0, to align with the CSDM 4.0 framework, the Product Model tables are used instead of the Scanned Applications table. If the application has the version, the lookup is against the Software Model table. If there is no version, the lookup is against the Application Model table. Both Application Model and Software Model are child tables of the Product Model table, that is the foundation table in CMDB. The following screenshot explains the Product Model.\n\n## System property\n\nTo use the CSDM 4.0 product model-based lookup process, set the system property **sn\\_vul.use\\_product\\_model** to **true**.\n\n|System property name|System property value|Lookup target value|Considerations|\n|--------------------|---------------------|-------------------|--------------|\n|sn\\_vul.use\\_product\\_model|true|Select the value **Product model**|New users should select the value **Product model** to use the CSDM 4.0 framework's Product model lookup rules.|\n|false|Select the value **Configuration item**|Existing users can continue using the CI lookup process and the existing **CI lookup rules**.|\n\n**Note:** To set the lookup target value, navigate to the **Lookup Rule** page > **\\[AVR integration lookup rule\\]** > **Lookup target** field.\n\n## Lookup rules in AVR\n\nIn the CSDM 4.0 framework, product model-based lookup rules are used instead of CI lookup rules to create entries into the respective product model classes. Similarly for scripts, you can define the lookup rules within the framework of the CSDM 4.0 model.\n\nStarting from AVR v19.0, while creating a lookup rule, you must define whether you want to use the configuration item or product model approach using the **Lookup target** field. For more information, see [Create a CI lookup rule](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-create-ci-lookup-rules.md).\n\n## Discovered applications\n\nNavigate to **All** > **Discovered Applications**. The Discovered Applications table displays the applications ingested from the scanners. If the system property **sn\\_vul.use\\_product\\_model** is set to **true**, you can see the corresponding product models for the applications.\n\n## AVR considerations\n\n**Presence of duplicate CI or product model records**\n\nVerify that the system property **sn\\_vul.use\\_product\\_model** has been correctly configured for the lookup process. Ensure that you select either **Configuration item** or **Product model** as the Lookup target while configuring the Lookup rule form.\n\n"}}