---
title: "Before You Begin: What Frontier AI Defense Needs"
slug: "before-you-begin-what-frontier-ai-defense-needs"
updated: 2026-10-27T15:43:30Z
published: 2026-10-27T15:43:30Z
canonical: "docs.databee.buzz/before-you-begin-what-frontier-ai-defense-needs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Before You Begin: What Frontier AI Defense Needs

Frontier AI Defense works on data you already have. This page lists what needs to be in place, what you get back, and a checklist you can work through with your DataBee contact before you start.

## What goes in, what comes out

![Your scanner findings, threat intelligence, your application list, and your CMDB go in. Ranked applications, routed tickets, proof of fixes, and coverage gaps come out.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/frontier-ai-20b-inputs-outputs.png?sv=2026-02-06&spr=https&st=2026-11-11T13%3A48%3A06Z&se=2026-11-11T14%3A48%3A06Z&sr=c&sp=r&sig=s0ARHIuL7bD340quxoF95k%2FZEAugn9QHzTQvETgDxCs%3D)

*Your scanner findings, threat intelligence, your application list, and your CMDB go in. Ranked applications, routed tickets, proof of fixes, and coverage gaps come out.*

**What goes in:**

- **Scanner findings** — the vulnerabilities your scanner already finds on your servers.
- **Threat intelligence** — which vulnerabilities attackers are actually using, from the public NIST CVE and FIRST EPSS feeds. You connect these like any other feed.
- **Your line-of-business applications** — each application, its business owner, and the servers it runs on. This is the most important input: it is how findings on servers become risk to the business.
- **Your CMDB** — every server and the IT team that owns it.

**What comes out:**

- **Applications ranked by exposure**, and the few fixes that clear most of their findings. See [Finding Your Riskiest Applications](/user-manual/docs/finding-your-riskiest-applications).
- **Tickets sent to the right team**, in your ServiceNow or by email. See [Sending Fixes to Remediation Teams](/user-manual/docs/sending-fixes-to-remediation-teams).
- **Proof it got fixed** — a later scan, not a closed ticket, confirms each fix. See [Tracking Remediation Activity](/user-manual/docs/tracking-remediation-activity).
- **Gaps you didn't know about** — servers with no owner, servers that have never been scanned, and servers past their vendor's end-of-life.

## What you need

Four things are required. Without them, Frontier AI Defense still opens, but it cannot rank your applications.

| Item | Need | Provided by | Details | Without it |
| --- | --- | --- | --- | --- |
| **A data lake** | Required | You | Snowflake, or Iceberg on AWS S3 or Azure ADLS, in the same region as your DataBee tenant. You own the storage and connect it from the setup wizard. Guides: [Snowflake](https://docs.databee.buzz/docs/snowflake-setup-guide), [Azure ADLS](https://docs.databee.buzz/docs/adls-iceberg-wizard-setup-guide). | Nothing can be stored or scored. |
| **A vulnerability scanner** | Required | You (pick one) | **Qualys VMDR**: an API user with the Manager role; the Qualys KnowledgeBase feed comes with it. **Tenable VM**: API keys from a dedicated user with the Basic and Scan Operator roles. Guides: [Qualys](https://docs.databee.buzz/docs/qualys-vuln-scanner), [Tenable](https://docs.databee.buzz/docs/tenable-vulnerability-management). | There are no findings to rank. |
| **Threat intelligence feeds** | Required | You (connect both) | **NIST CVE**, which carries the CISA Known Exploited Vulnerabilities list and CISA's exploitation grade, and **FIRST EPSS**, a daily estimate of how likely each vulnerability is to be exploited. Both are public and need no credentials. You connect them like any other feed, and the data is stored in your data lake. | Applications rank by severity alone, which your scanner already does. |
| **Your line-of-business applications** | Required | You | Each application, its business owner, and the servers that support it, brought in through any feed. See [below](/docs/before-you-begin-what-frontier-ai-defense-needs#your-line-of-business-application-list). | There are no applications to rank. |
| **Your CMDB** | Recommended | You | Every server and the support group that owns it. For ServiceNow CMDB: an OAuth client plus a user with the ITIL role. Guide: [ServiceNow CMDB](https://docs.databee.buzz/docs/servicenow-cmdb). | Tickets go to each application's business owner instead of the team that patches the server. |
| **ServiceNow for tickets** | Optional | You | A ServiceNow connection, set up once on the **Integrations** page. Work arrives as change requests. You can point it at a test instance while you evaluate. | Ranking still works; send work by email or export it instead. |

## Your line-of-business application list

Your scanner knows servers. Only you know which servers make up, say, your claims portal. This list is how Frontier AI Defense connects the two.

![Example: the Claims Portal has a business owner and three servers. The scanner reports findings on the same three hostnames, so those findings attach to the application.](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/frontier-ai-21-lob-diagram.png?sv=2026-02-06&spr=https&st=2026-11-11T13%3A48%3A06Z&se=2026-11-11T14%3A48%3A06Z&sr=c&sp=r&sig=s0ARHIuL7bD340quxoF95k%2FZEAugn9QHzTQvETgDxCs%3D)

*Example: the Claims Portal has a business owner and three servers. The scanner reports findings on the same three hostnames, so those findings attach to the application.*

For each application, provide:

1. **Application name**, flagged as line of business. Retired or inactive applications are left out.
2. **Business owner** — the name and email of the person who funds and answers for the application.
3. **Supporting servers** — every server and host the application runs on.
4. *Optional:* **Business criticality** (Critical, High, Medium, Low). It appears as a filter and does not change the score.

**The one rule:** name servers the way your scanner names them, by hostname or IP address. If the names don't match, the findings can't reach the application.

| Application | Line of business | Business owner | Criticality | Servers |
| --- | --- | --- | --- | --- |
| Claims Portal | Yes | Dana Ruiz · dana.ruiz@example.com | High | `clm-web-01, clm-app-02, clm-db-01` |
| Policy Admin | Yes | Sam Okafor · sam.okafor@example.com | High | `pol-app-01, pol-app-02, 10.4.12.30` |
| Intranet Wiki | No | IT Shared Services |  | `wiki-01` |

*Example file layout. Any column names work.*

You bring the list in as a feed, and it is stored in your data lake like any other. The usual sources are:

- **Already in ServiceNow** — business applications in your CMDB, related to the servers that support them, through the ServiceNow CMDB feed.
- **A file** — a spreadsheet or CSV export from wherever you keep it, laid out like the example above, through a custom feed.

You can combine sources; Frontier AI Defense looks at the application data in your lake, not at which feed brought it in. A file needs a custom feed, so allow about a week for that and send your DataBee contact a sample early.

## Access and network

- **Who gets access.** Your people sign in to DataBee through your organization's own login. An administrator then gives each person a role: *Administrator* or *Security Analyst* to manage Frontier AI Defense, or *Data Engineer* to view it. See [Roles and permissions](/user-manual/docs/frontier-ai-overview#roles-and-permissions).
- **Network access.** DataBee connects out to your scanner's API and, if you use it, your ServiceNow instance. If either sits behind a firewall or IP allow-list, ask your DataBee contact for DataBee's outbound IP addresses and allow them.
- **Email.** If you send work by email, make sure messages from DataBee are not filtered as spam. Your DataBee contact can give you the sending address.

## Checklist

Work through this list with your DataBee contact. Credentials and the application list take the longest, so start those first.

- ☐ Data lake chosen (Snowflake, AWS S3, or Azure ADLS), in the same region as your DataBee tenant, and connected
- ☐ Scanner API credentials created (Qualys VMDR or Tenable VM)
- ☐ NIST CVE and FIRST EPSS feeds connected
- ☐ Application servers scanned at least weekly
- ☐ Line-of-business application list connected as a feed, with owners and servers (send your DataBee contact a sample first if it needs a custom feed)
- ☐ Server names in the list match the scanner's hostnames or IP addresses
- ☐ ServiceNow CMDB credentials created (OAuth client and ITIL-role user) — recommended
- ☐ ServiceNow connection added on the Integrations page — optional
- ☐ DataBee's outbound IP addresses allowed by your scanner and ServiceNow, if they restrict access
- ☐ Users signed in and given the Administrator, Security Analyst, or Data Engineer role

## How to tell it's working

Once your data has arrived, check that:

- The number of applications matches your list.
- Most of your scanner's findings appear under an application. Agree on a target with your DataBee contact at the start; findings that don't appear usually mean a server name doesn't match.
- The top application shows a business owner and a remediation team.

## Next steps

- [Frontier AI Defense Overview](/user-manual/docs/frontier-ai-overview)
- [Finding Your Riskiest Applications](/user-manual/docs/finding-your-riskiest-applications)
- [Sending Fixes to Remediation Teams](/user-manual/docs/sending-fixes-to-remediation-teams)