DAST

Choosing where tickets go

• Last updated: October 29, 2026

• Read time: 5 Minutes

Actions decide where Burp Suite DAST creates tickets and what goes into them.

Setting connection defaults

When you add or edit a connection, Configuration sets the values that Burp Suite DAST uses when the connection creates a ticket. An action can override these values. You can set up actions after you save the connection.

On the connection, you set defaults for Reporter, Impact and Urgency. You set Table and Assignment group on each action. Burp Suite DAST has no Priority field for ServiceNow, because ServiceNow sets the priority from impact and urgency.

To change how severity and confidence map to impact and urgency:

1. On Configuration, under Severity mappings, click Impact or Urgency. An Impact mapping or Urgency mapping editor opens, with a row for each of High, Medium, Low and Info, and a column for each of Certain, Firm and Tentative.
2. Choose a value in each cell. On the connection, each cell offers 1 - High, 2 - Medium and 3 - Low.
3. Click Done to keep your changes, or Cancel to discard them.

Burp Suite DAST fills the cells from the issue severity: High maps to 1, Medium to 2, and Low and Info to 3. The same value applies to Certain, Firm and Tentative confidence. Reset to defaults restores these values.

Adding an action

To add an action to a connection:

1. Click the settings icon in the top-right corner of the window, then click Integrations.
2. On the ServiceNow tile, click Edit. The connections page opens.
3. On the card for your connection, click Manage actions.
4. Click Add action. The Add action dialog opens.

Burp Suite DAST confirms that ServiceNow accepts tickets at the destination before it saves the action.

The actions list

Manage actions opens Actions for the connection. The list explains: "Actions decide where tickets are created and what goes into them. Run manually from an issue, or automatically with a trigger." With no actions, it says "This connection has no actions. Users can't create tickets through it until an action is added."

Each action is a card that shows its name, description and Table, and a Raised row. Raised reads "Manually", or "Manually and automatically" with the number of triggers. Click a card to edit the action. The card also has Edit action and Delete action icons and a Manage triggers button. For more information about triggers, see Raising tickets automatically.

The action editor

The Add action and Edit action dialogs have these settings:

• Name - Required. Use 255 characters or fewer. The name must be unique for the connection, ignoring case.
• Description - Optional.
• Table and Assignment group - The destination. See the next section.
• Ticket values - The values that the action sets on its tickets. Unchanged values use the defaults of the connection. Each row shows its state: Connection default, Customized, Not set or the value you chose. Click a row to edit it in a dialog with Cancel and Done.
• Optional fields - The row shows None or the number of fields added. Click it, then click Add optional field to choose from the other columns of the table. To remove a field, click its trash button. Burp Suite DAST then leaves that field out of the ticket.

Ticket fields load once you choose a table, and the dialog shows "Loading ticket fields..." while they load. You can't remove a required field. If a name fails the rules, the dialog shows "Name is required", "Name must be 255 characters or fewer" or "An action with this name already exists".

If a saved field no longer exists for the destination, the dialog shows "<name> is no longer available for this destination." with a Remove button for the field.

Save shows "Saving..." and closes the dialog. If the list can't refresh, the footer says "Action saved. Refresh to see your changes." with Close and Refresh buttons.

To delete an action, click its Delete action icon. The dialog asks "Are you sure you want to delete the action '<name>'? This cannot be undone." Click Delete to confirm. Tickets that you already raised are unaffected.

Choosing the destination

A ServiceNow destination has two parts:

• Table - Burp Suite DAST creates, finds and links tickets in this table. It offers every table that extends Task, at any depth. The default is incident. If the integration user can't read the table, you see "This account can't read this table". Give the user read and create access to it.
• Assignment group - The group that receives the ticket. Search for a group and select it. This part is optional: leave it blank to let the assignment rules in ServiceNow decide.

Required and optional fields

When you choose a table, Burp Suite DAST reads its required columns from ServiceNow, including inherited columns, dictionary overrides and data policies, and shows them as required fields on the action. It also offers the other columns of the table as optional fields that you can add. A field can be text, a number, a date, a yes or no value, a choice or a lookup. Choice fields can depend on other fields.

ServiceNow date columns appear as date fields, entered as yyyy-mm-dd. Burp Suite DAST doesn't offer date and time columns. If a required column is a date and time column, you can't save the action.

Burp Suite DAST checks each value by type, choice, length, date format and dependencies before it saves the action. Connection defaults fill any field that you leave blank.

If a required column is one that Burp Suite DAST can't set, then the dialog shows "<label> (<column>) is required, and DAST can't set it. Choose another table, or make the column optional." Save stays unavailable until you do. If Burp Suite DAST can't read the columns of the table, it saves the action with the notice "This destination's required fields can't be checked." followed by the reason, and a Retry field lookup button.

Overriding the mapping for an action

An action uses the mapping from the connection. To use a different mapping for one action:

1. In Ticket values, click the Impact or Urgency row. It shows Connection default. The mapping editor opens with the values from the connection already copied in.
2. Change the cells that you want. Changing one cell keeps the others.
3. Click Done, then click Save.

A customized mapping replaces the whole mapping from the connection for that action. If your table has customized choices for impact or urgency, the editor offers those choices and the action sends the one you select. To return to the mapping from the connection, open the row again and click Use connection default in the editor. Cancel also discards a customization that you just started. Done keeps a mapping as customized, even if you changed nothing.