ServiceNow CIS-Discovery Dumps

A check is a part of Agent Client Collector that defines the osquery commands to run on a CI and the frequency of execution. A check can also specify the conditions for generating alerts or events based on the osquery results.

References1: Agent Client Collector - Product Documentation: San Diego - ServiceNow2: Agent Client Collector for Visibility - Product Documentation: San Diego - ServiceNow

Discovery and Service Mapping are both products that help to identify and map the IT infrastructure and services in an organization. However, they have different approaches and objectives. Discovery uses IP address ranges as the starting point for finding devices and applications on the network, and then runs probes and sensors to collect information and classify them. Discovery focuses on inventory-related use-cases, such as asset management, configuration management, and compliance. Service Mapping uses entry points, such as URLs or host names, as the starting point for mapping business services and their dependencies. Service Mapping runs patterns, which are sequences of operations that follow the traffic connections between devices and applications, and then creates a service map that shows the logical and semantic relationships. Service Mapping focuses on service-related use-cases, such as service availability, impact analysis, and root cause analysis12.

References:

• 1: ServiceNow Discovery Overview, page 9
• 2: ServiceNow Discovery Documentation, Service Mapping section

A horizontal discovery pattern is a set of steps that execute operations to identify, classify, and populate attributes for configuration items (CIs) of a specific category or class, such as infrastructure or application. A horizontal pattern can be applied to any operating system or platform that supports the required protocols and commands12.

References:

• Horizontal discovery patterns
• Discovery pattern types

For discovering Windows Servers, ServiceNow Discovery recommends using credentials that have a domain user account with local administrator access on the target servers. This level of access ensures that Discovery can successfully execute the necessary probes and sensors to collect comprehensive data about the server without being restricted by permission limitations. The other options either provide excessive permissions (like a domain administrator with sudo access) or insufficient privileges (like a standard domain user with read access).

SNMP credentials are used by Discovery to communicate with devices that support the Simple Network Management Protocol (SNMP). SNMP credentials do not include a user name, just a password, called the community string. The default read-only community string for many SNMP devices is public, and Discovery will try that automatically. Enter the appropriate SNMP credentials if they differ from the public community string1.

References: 1: SNMP credentials - Product Documentation: Utah - Now Support Portal

When increasing the maximum number of threads for a MID Server in ServiceNow Discovery, it's often necessary to also increase the memory allocated to the MID Server application. This is because more threads can result in higher memory usage as each thread may consume resources while performing discovery tasks. Increasing disk space, updating ACL rules for CMDB tables, or increasing the MID Server max payload size are not directly related to the number of threads used by a MID Server. References = ServiceNow Discovery documentation, especially sections discussing MID Server configuration and performance tuning.

For a MID Server to access servers using Windows Remote Management (WinRM), it's necessary to specify that WinRM should be used as the protocol for Windows management. This is typically done by setting the appropriate MID Server parameter, such as mid.windows.management_protocol, to WinRM. This configuration tells the MID Server to use the WinRM protocol when communicating with the target servers for executing commands and collecting data. The answer is derived from understanding how ServiceNow Discovery uses MID Servers to perform remote operations and the need to configure these MID Servers appropriately to communicate using different protocols like WinRM. It is not sufficient to just add the WinRM parameter on target servers or simply add the MID Servers as a trusted source with DNS; the MID Server itself must be configured to use WinRM. Setting a 'JEA Property' to true is not relevant to the basic configuration of a MID Server for WinRM access.

The image provided shows a ServiceNow expression used to concatenate two pieces of information. The $name_details[1] suggests that 'name_details' is an array or a list variable, and we're accessing the second element (considering indexing starts at 0). This indicates that 'name_details' is not a tabular variable but rather a list or an array, and there is a scalar value labeled '1' which is being used to index this array. The 'exec_info' and 'executableDir' are likely attributes or properties of the objects within the 'name_details' array and '$process' object, respectively. There is no indication that this is from a WMI query operation step, nor is there any inherent reason why this value could not be used in a pattern step. ServiceNow Discovery patterns can use such expressions to extract and concatenate data during the discovery process.

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

References:

• Correcting MID Server Windows service account user and permissions
• What is a ServiceNow MID Server and how does it work?
• Configure Windows MID Server service credentials

The image shows a part of a horizontal pattern in Pattern Designer that uses the WMI Query operation to retrieve information about the processes running on a Windows server. The operation takes a WQL query as an input parameter and returns a tabular variable that contains the results of the query. The tabular variable is named ‘WMI Query’ by default, but it can be renamed by the user. The WQL query in the image selects four attributes from the Win32_Process class: Name, MaximumWorkingSetSize, PageFaults, and PeakVirtualSize. These attributes are stored as scalar variables in the tabular variable, and they can be accessed by using the dot notation, such as WMI Query.Name or WMI Query.MaximumWorkingSetSize. Therefore, the most probable results of the image are a tabular variable named ‘WMI Query’ and two scalar variables named ‘MaximumWorkingSetSize’ and ‘PeakVirtualSize’.

References:

• Pattern Designer | WMI Query
• Win32_Process class
• WQL (SQL for WMI)

The SNMP Query pattern operation executes an SNMP query on a target device and stores the results in a variable. The Variable Type field determines the format of the results. There are two valid Variable Types for this operation: Table and Scalar. Table is used when the query returns multiple values, such as a list of interfaces or processes. Scalar is used when the query returns a single value, such as the system name or uptime12.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• SNMP Query pattern operation - Product Documentation: Vancouver - ServiceNow

A horizontal pattern must have a TCP entry point type or an ALL entry point type to execute from a process classifier. A process classifier is a rule that matches a process running on a host and triggers a horizontal pattern to discover the application associated with that process1. The entry point type determines the type of connection that the pattern uses to access the target host. A TCP entry point type means that the pattern uses a TCP port to connect to the host, while an ALL entry point type means that the pattern can use any available connection method2.

References:

• 1: Process classifiers - Product Documentation: San Diego - ServiceNow
• 2: Horizontal Pattern probe - Product Documentation: San Diego - ServiceNow

Global variables are variables that are automatically available for all steps in horizontal discovery patterns. They store information about the target CI, such as its IP address, host name, operating system, and credentials. There are two global variables that may be used for steps in horizontal discovery patterns: system and computer_system. The system variable contains the information about the target CI’s IP address, host name, and credentials. The computer_system variable contains the information about the target CI’s operating system, such as its name, version, and architecture12.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal

The reconciliation process in ServiceNow refers to the method of ensuring data integrity and consistency in the Configuration Management Database (CMDB) by allowing only designated authoritative data sources to write or update information at the CI (Configuration Item) table and attribute level. This process helps maintain accurate and reliable data in the CMDB by controlling how and from where data is sourced and updated. The other options describe different processes or aspects of CMDB management and are not directly related to the reconciliation process. References = ServiceNow CMDB documentation, particularly the sections on CI data management and reconciliation processes.

Debug mode is a feature of the Pattern Designer that allows you to test and troubleshoot your patterns in real time. To activate Debug mode, you need to have the admin role or a role that includes the pattern_designer_debug permission. Debug mode is not available for users who only have the pattern_designer_read permission1.

References: 1: Activate pattern Debug mode - Product Documentation: San Diego - ServiceNow

Without seeing the specific image, it's challenging to definitively identify the operation. However, based on the options provided, if the image shows an operation that involves interpreting or extracting data from a variable, then "Parse Variable" is the most likely answer. "Parse Variable" is used in ServiceNow Discovery patterns to analyze and extract data from variables collected during the discovery process. References = ServiceNow Discovery documentation, particularly the sections on Discovery Pattern Designer and the various operations that can be used in patterns.

From the Discovery Status record, a Device record in ServiceNow Discovery contains a link to the discovered Configuration Item (CI). This link provides direct access to the CI record that was discovered and processed during the discovery cycle. The Device record does not contain the contents of the CI, a link to the discovered Asset, or a link to the CMDB Health Dashboard. References = ServiceNow Discovery documentation, focusing on the details of Discovery Status records and the information contained within Device records.

A horizontal discovery pattern is a sequence of operations that collects information about a specific type of configuration item (CI), such as an operating system, a database, or a web server1. A horizontal discovery pattern does not use the connectivity section, which is only used for the application pattern type2. The connectivity section defines how to connect to a CI and run commands on it3. A horizontal discovery pattern uses the following sections1:

• Variables: Defines the variables that store the data collected by the pattern and map them to the target table fields.
• Identification: Defines the criteria to identify a CI and update or create a record in the CMDB.
• Operations: Defines the actions to perform on the target CI, such as running commands, querying databases, or parsing files.

References: 1: ServiceNow Docs - Horizontal discovery patterns 2: ServiceNow Docs - Application pattern types 3: ServiceNow Docs - Connectivity section

The Set Parameter Value operation is used to assign a value to a variable in a Discovery pattern1. The syntax for this operation is as follows2:

Set Parameter Value: =

The  can be either a constant or an expression. To declare a constant, unchanging value, one must use quotes around the value. For example2:

Set Parameter Value: $name = "John"

This assigns the string “John” to the variable $name. The quotes indicate that the value is a constant and will not change. The other options, hash tag, brackets, and dollar sign, are not used to declare a constant value. They have different meanings in the syntax of the Set Parameter Value operation. A hash tag (#) is used to indicate a comment2. Brackets ([]) are used to access an element of an array or a map2. A dollar sign

The Application Pattern Type is a pattern that discovers applications and their dependencies by using probes and sensors1. It has two main components: the Run Order and the Identification Section2. The Run Order defines the sequence of probes and sensors that Discovery uses to find and classify CIs2. The Identification Section specifies the criteria that Discovery uses to identify CIs and their relationships2. The other options, CI Type and Operating System, are not specific to the Application Pattern Type. They are used for other pattern types, such as the Horizontal Pattern Type and the Service Mapping Pattern Type3 .

References: 1: Application Pattern Type 2: Application Pattern Type components 3: Horizontal Pattern Type : Service Mapping Pattern Type

CI identifiers can be viewed under the CI record1. A CI identifier is a set of attributes that uniquely identify a CI of a specific class2. CI identifiers are used by the identification and reconciliation engine (IRE) to match incoming data with existing CIs in the CMDB3. CI identifiers can be viewed and edited in the CI record by clicking the Identification Information related link1.

References:

• 1: View and edit CI identifiers
• 2: Create or edit a CI identification rule
• 3: Identification rules

 The functionality shown in the image is related to the Tracked Configuration files feature of ServiceNow Discovery. This feature allows Discovery to track changes in configuration files on Windows and Unix hosts and store them as configuration items (CIs) in the CMDB1. To modify this functionality, such as adding or removing files to track, changing the file attributes to capture, or defining the CI relationships, one needs to edit the Discovery Pattern that is associated with the Tracked Configuration files classifier2. A Discovery Pattern is a series of operations that tell Discovery how to find and identify an application or a configuration file on a host3.

References:

• 1: Tracked Configuration files - Product Documentation: San Diego - ServiceNow
• 2: Tracked Configuration files pattern - Product Documentation: San Diego - ServiceNow
• 3: Patterns and horizontal discovery - Product Documentation: Tokyo - ServiceNow

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• Load a MIB file - Product Documentation: Vancouver - ServiceNow
• How Loading of MIB file works on SNMP Browser ( Pattern Step - SNMP Query) - Support and Troubleshooting

A Functionality Definition is a configuration record that defines what protocols to detect from within a Behavior. A Behavior is a set of Functionality Definitions that Discovery uses to identify and explore a device or application. A Functionality Definition specifies the order, type, and parameters of the probes that Discovery launches to gather information about a device or application12.

References:

• Functionality Definition
• Behavior

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

• CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.
• Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.
• Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

References:

• 1: ServiceNow Discovery Documentation, Pattern Variables section
• 2: ServiceNow Discovery Overview, page 11

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

References:

• Discovery Schedule form
• Shazzam Probe
• Discovery IP range

Hardware Models are templates that define the attributes and default values for a specific type of hardware configuration item (CI). Hardware Models can have a one-to-many relationship with the following entities:

• Assets: An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract. A Hardware Model can be associated with multiple assets that share the same characteristics and specifications.
• Configuration Items: A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A Hardware Model can be associated with multiple CIs that share the same characteristics and specifications.
• Model Categories: A model category is a classification of Hardware Models based on their function, such as network, storage, or server. A Hardware Model can belong to one or more model categories that define its scope and usage.

References:

• Hardware Model
• Asset
• Configuration Item (CI)
• [Model Category]

The $process.executableDir expression correctly calls the value of the executableDir variable from the tabular process variable. The process variable is a tabular variable that contains the output of the ps command, which lists the processes running on a CI. The executableDir variable is a column name that holds the directory path of the executable file for each process. To access the value of a column name from a tabular variable, you need to use the dot notation, such as $variable.columnName12.

References1: Pattern variables - Product Documentation: Tokyo - Now Support Portal2: Examples of EVAL scripts used in Discovery patterns - ServiceNow

 CI reclassification is the process of changing the class of a CI in the CMDB based on the discovery data. It can be done manually or automatically, depending on the configuration settings. CI reclassification can result in data loss if the new class has fewer or different attributes than the original class, and the existing attribute values are not preserved or mapped to the new class. This can happen when a CI is switched to a different class hierarchy, such as from a Linux Server to a Windows Server, or when a CI is downgraded to a less specific class, such as from a Database to a Software Instance. Therefore, switching and downgrading have a higher chance of leading to lost data during CI reclassification.

References:

• CI reclassification
• Reclassify CIs
• Configure automatic CI reclassification

In ServiceNow Discovery, most properties related to the Discovery module start with the prefix 'glide.discovery'. This naming convention is part of ServiceNow's system property design, where 'glide' typically indicates system properties and 'discovery' specifies that the property is related to the Discovery module. Properties are used to configure various aspects of the Discovery process, such as behavior, timeouts, and performance settings.

 The Location field for a discovered CI is populated by the Location field of the Discovery Schedule that triggered the discovery of that CI. This is done by the DiscoverySensor script, which gets the location ID from the Discovery Schedule and passes it to the Shazzam probe, which then updates the cidata with the location information. The Location field for a parent CI Type, a Port Probe, or a Discovery Dashboard report does not affect the Location field for a discovered CI.

References: Discovery - How Location field is set for a CI, How to pass discovery schedule fields to a CI record via discovery