SecPod Saner CVEM brings continuous vulnerability and patch posture into ServiceNow, and closes the loop by executing remediation from the changerequest that authorised it.

The application connects to your Saner CVEM tenant with an API key, discovers your Saner organisation and its accounts, and reports which Saner modules each account is licensed for. Sync policies then run on your schedule - periodic, daily, weekly or monthly, in a timezone you choose - pulling device inventory,
vulnerability findings and missing-patch findings into scoped tables. Ingestion is paged, resumable and bounded, so large tenants synchronise without long-running transactions, and every run records per-phase status, timings and row counts.

What you can do depends on the Saner modules the account is licensed for, and the application adapts rather than fails:

- Patch Management only. Patch data synchronises and each patch carries its CVE references as text, so you see which CVEs a patch addresses without full vulnerability records. Remediation and reboot are unaffected - both are dispatched and evidenced through the change request exactly as normal, with patches selected by patch severity.

- Vulnerability Management and Patch Management. You can remediate from either side. Synchronise vulnerabilities alone and target devices through the vulnerability-to-device mapping, selecting by CVSS score or severity; synchronise patches alone and target them through the patch-to-device mapping, selecting by patch severity. With both synchronised, each group rule chooses whichever path suits it, so a CVSS-driven rule and a patch-severity-driven rule can run side by side against the same estate.

Each device is correlated to a configuration item on serial number, then on hostname plus MAC address against the CI name, then against its fully qualified domain name, with the matching rule recorded in plain language on the device record. Correlation is strictly read-only - the CMDB is never written to. Where you map CMDB attributes to Saner tags, changed values are pushed back so Saner grouping reflects ServiceNow ownership.

Remediation is governed rather than ad hoc. Group rules turn a saved condition over findings into a change request carrying the correct change type, model, template and approval path, so patching inherits the change policy you already run. Moving that change to Implement dispatches patch or reboot jobs to Saner, and per-device status is reconciled back onto the change. Before it can close, the success percentage is recomputed from live finding state and compared against a per-change threshold and time window, so a change closes as successful only when the vulnerabilities it targeted are genuinely fixed.

Administration runs from a single guided page covering connectors, account and module selection, sync policies and data maintenance, with five roles separating the Saner administrator, SecOps manager, change manager, IT operator and read-only consumer. On-premise Saner deployments are reached through a MID Server. On-demand synchronisation and device rescans are available at any time.

The application uses only core platform capability - no Vulnerability Response, no Integration Hub, no other licensed plugin. ITSM with Change Management is sufficient.

- **Continuous vulnerability and patch posture in ServiceNow.**  Scheduled, resumable synchronisation of devices, vulnerabilities and missing patches from SecPod Saner CVEM into the application's own scoped tables, with per-run telemetry. Per-account schedules, batch sizes, and optional severity and operating-system-family filters.
- **Findings tied to configuration items.**  Each Saner device is correlated to a CI on serial number, then hostname plus MAC address, with the matching rule recorded on the device record. The CMDB is read only and never written to, so existing data quality is preserved.
- **Remediation governed by native Change Management.**  Group rules turn a saved condition over findings into a change request with the correct change type, model, template and approvals. Standard, normal and emergency change paths are all supported, and list actions on Vulnerable Items and Patch Items create a change on demand.
- **Patch and reboot dispatch from the change request itself.**  Moving the change to Implement resolves findings to device-and-patch pairs, groups them by identical patch profile, batches them within payload and device-count limits, and dispatches remediation or reboot jobs to Saner inside the configured deployment window.
- **Closure that reflects reality.**  Scheduled pollers reconcile per-device job status and recompute the success percentage from live finding state, advancing or closing the change only once it clears a per-change threshold and time window. Partial results are announced and retried rather than silently closed.
- **On-demand device scan.**  Ask Saner to rescan selected devices so posture can be refreshed without waiting for the next scheduled run.
- **Guided connector onboarding.**  An administration page validates the Saner tenant domain and API key, discovers the organisation and its accounts, reports which Saner modules each account is licensed for, and stores the credential encrypted. Connector creation is transactional, so a partial failure leaves nothing behind.
- **No additional ServiceNow licensing.**  Core platform capability only. Vulnerability Response, Integration Hub and Flow Designer are not required, and no global-scope artifact is introduced. Outbound calls use RESTMessageV2, with MID Server support for on-premises Saner deployments.