CIS-Discovery Sample Questions Answers

The $process.executableDir expression correctly calls the value of the executableDir variable from the tabular process variable. The process variable is a tabular variable that contains the output of the ps command, which lists the processes running on a CI. The executableDir variable is a column name that holds the directory path of the executable file for each process. To access the value of a column name from a tabular variable, you need to use the dot notation, such as $variable.columnName12.

References1: Pattern variables - Product Documentation: Tokyo - Now Support Portal2: Examples of EVAL scripts used in Discovery patterns - ServiceNow

Global variables are variables that are automatically available for all steps in horizontal discovery patterns. They store information about the target CI, such as its IP address, host name, operating system, and credentials. There are two global variables that may be used for steps in horizontal discovery patterns: system and computer_system. The system variable contains the information about the target CI’s IP address, host name, and credentials. The computer_system variable contains the information about the target CI’s operating system, such as its name, version, and architecture12.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal

 File Based Discovery is used to discover file paths to recognize the signature of installed software. File Based Discovery helps to identify what software is running on Windows and UNIX servers and devices by scanning the file system for specific files or directories that indicate the presence of a software product1. File Based Discovery can also check the file size, version, and checksum of the discovered files to verify the software installation2. File Based Discovery can be configured using file signatures, which are patterns that match the file paths of software products3.

References: 1: File Based Discovery - Support and Troubleshooting - Now Support Portal 2: Use file-based service discovery to discover scrape targets | Prometheus 3: How File based discovery can be used to populate software record running on Linux host. - Support and Troubleshooting - Now Support Portal

One method for deleting specific CIs not discovered in 30 days is to use a scheduled job that runs a script to query the CMDB for CIs that have not been updated by Discovery for a certain period of time, and then delete them or mark them as retired. This method can help you keep your CMDB clean and accurate, and avoid having stale or obsolete CIs. You can configure the scheduled job to run at a specific frequency and time, and specify the criteria for selecting the CIs to delete.

References: Automated way to disable/retire CIs not updated for 45 days, ServiceNow CIS-Discovery Sample Questions

The ECC Queue is the normal connection point between an instance and other systems that integrate with ServiceNow, such as MID Servers1. The ECC Queue displays input and output messages from and to MID Servers2. The actual XML payload that is sent to or from an instance is stored in the ECC Queue3. The ECC Queue also provides a connected flow of probe and sensor activity, as probes are sent from the instance to the MID Server, and sensors are sent from the MID Server to the instance2.

References:

• 1: ServiceNow Discovery Overview
• 2: ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example
• 3: Manage ECC Queue content for a MID Server

The SNMP Query pattern operation executes an SNMP query on a target device and stores the results in a variable. The Variable Type field determines the format of the results. There are two valid Variable Types for this operation: Table and Scalar. Table is used when the query returns multiple values, such as a list of interfaces or processes. Scalar is used when the query returns a single value, such as the system name or uptime12.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• SNMP Query pattern operation - Product Documentation: Vancouver - ServiceNow

The image provided shows a ServiceNow expression used to concatenate two pieces of information. The $name_details[1] suggests that 'name_details' is an array or a list variable, and we're accessing the second element (considering indexing starts at 0). This indicates that 'name_details' is not a tabular variable but rather a list or an array, and there is a scalar value labeled '1' which is being used to index this array. The 'exec_info' and 'executableDir' are likely attributes or properties of the objects within the 'name_details' array and '$process' object, respectively. There is no indication that this is from a WMI query operation step, nor is there any inherent reason why this value could not be used in a pattern step. ServiceNow Discovery patterns can use such expressions to extract and concatenate data during the discovery process.

The image shows a part of a horizontal pattern in Pattern Designer that uses the WMI Query operation to retrieve information about the processes running on a Windows server. The operation takes a WQL query as an input parameter and returns a tabular variable that contains the results of the query. The tabular variable is named ‘WMI Query’ by default, but it can be renamed by the user. The WQL query in the image selects four attributes from the Win32_Process class: Name, MaximumWorkingSetSize, PageFaults, and PeakVirtualSize. These attributes are stored as scalar variables in the tabular variable, and they can be accessed by using the dot notation, such as WMI Query.Name or WMI Query.MaximumWorkingSetSize. Therefore, the most probable results of the image are a tabular variable named ‘WMI Query’ and two scalar variables named ‘MaximumWorkingSetSize’ and ‘PeakVirtualSize’.

References:

• Pattern Designer | WMI Query
• Win32_Process class
• WQL (SQL for WMI)

 The WMI service is a Windows service that enables remote management of Windows devices using the WMI protocol. The WMI service is required for Discovery to access the configuration and status information of Windows devices using WMI queries. If the WMI service is not running on a host, it will prevent the discovery of Windows devices, as Discovery will not be able to communicate with the WMI Collector or execute WMI queries on the target device123.

References:

• How to resolve a failure to communicate with the WMI Collector during top-down discovery - Support and Troubleshooting - Now Support Portal
• Windows discovery without ‘domain admin’ or ‘local admin’ privileges ? - Support and Troubleshooting - Now Support Portal
• Discovery — ServiceNow Elite

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Pattern Designer - Product Documentation: Vancouver - ServiceNow
• Discovery pattern designer - ServiceNow IT Operations Management [Book]

 To allow a MID Server to access servers using WinRM, the following configurations are required:

• MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.
• MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

References:

• Configure Windows servers for WinRM
• MID Server Parameters Add WinRM

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

References: 1: Shazzam probe, port probes, and protocols - Now Support 2: [Discovery properties - ServiceNow]

The deletion strategy ‘Mark as absent’ means that when a related CI that was previously discovered by a pattern is no longer found, the install_status attribute of that CI is set to Absent. This indicates that the CI is missing or removed from the network. The main CI (in this case, the Linux Server CI) is not affected by the deletion strategy of the related CI (in this case, the Disk CI)12.

References1: Set a deletion strategy - Product Documentation: San Diego - ServiceNow2: Network adapter status setting to “Absent” in EMC … - ServiceNow …

 Discovery can provide information about the relationships between configuration items (CIs), including applications and hosts. Application relationships are the connections between applications that run on different hosts or servers, such as web servers, databases, load balancers, etc. Host relationships are the connections between applications and the hosts or servers that they run on, such as Windows, Linux, Unix, etc. Discovery can identify these relationships using various methods, such as probes, sensors, patterns, file-based discovery, etc. Discovery can also create and update these relationships in the CMDB, using the Depends on::Used by or Runs on::Runs relationship types.

References: Discovery Relationship Creation, Application Discovery Mapping Overview, IT Discovery – Application Dependency Mapping

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

References:

• SNMP Query pattern operation - Product Documentation: San Diego - Now Support Portal
• Load a MIB file - Product Documentation: Vancouver - ServiceNow
• How Loading of MIB file works on SNMP Browser ( Pattern Step - SNMP Query) - Support and Troubleshooting

A horizontal pattern is a type of Discovery pattern that discovers configuration items (CIs) and their relationships by moving across the network from one device to another. A horizontal pattern can use the Change user operation to switch from the default credentials to any other appropriate credentials for a specific device or application. This operation allows the pattern to access different types of CIs with different authentication methods.

References:

• Discovery patterns
• Change user operation

 Based on the web search results from the search_web tool, the following choices best represent key capabilities of a ServiceNow ITOM Enterprise solution:

• Manage Hybrid Clouds: ServiceNow ITOM enables organizations to gain visibility into their IT environment, on-premises to cloud, and see the impact of their applications on business services12. It also helps to plan, track, and secure cloud implementation through best-practice governance1. Four apps comprise Cloud Accelerate to help prepare for cloud migration, streamline provisioning requests, and manage cloud resources1.
• Proactively Eliminate Service Outages: ServiceNow ITOM helps to predict issues, reduce user impact, and automate resolutions with predictive AIOps and automation13. It analyzes telemetry and log data using AI to reduce noise, expedite mapping and predict issues1. It also delivers proactive digital operations with real-time log data to solve problems quickly1.

The other choices are not specific to ServiceNow ITOM Enterprise solution, but rather general features of the ServiceNow platform. The ServiceNow platform allows users to create an engaging user experience with intuitive interfaces and workflows. It also enables users to build new apps fast with low-code development tools and pre-built components.

References: 1: ITOM - Enterprise IT Operations Management - ServiceNow 2: ServiceNow IT Operations Management (ITOM) Services | Jade 3: Modernize IT Operations Management with ServiceNow ITOM : ServiceNow Platform

London Linux Servers is a CMDB Group with Health Group type. A CMDB Group is a collection of configuration items (CIs) that share common characteristics or are related in some way1. A Health Group is a type of CMDB Group that is used to monitor and measure the health of a specific set of CIs based on predefined rules and metrics2. The image shows that London Linux Servers is selected from the CMDB Health Group List, which is a dropdown menu that displays all the Health Groups defined in the system3. The image also shows the Group Health tab, which displays the health scores and indicators for the selected Health Group.

References: 1: Create a CMDB group - ServiceNow 2: CMDB health groups - ServiceNow 3: CMDB health dashboard - ServiceNow : [View CMDB health scores - ServiceNow]

A Discovery schedule of type Configuration Item collects complete information from the scanned IP ranges and sends it to the CMDB. This type of schedule runs a series of probes and sensors to identify and classify the devices and applications on the network, and to create or update the corresponding configuration items in the CMDB. A Discovery schedule of type Configuration Item can also run patterns to discover more details and relationships about the configuration items.

References:

• ServiceNow Discovery Overview
• Create a Discovery schedule
• Discovery schedule types

The Credential Affinity table is a table that associates an IP address and a credential in Discovery1. It is used to store the credential that was successfully used to access a device during Discovery2. It can also be used to manually assign a credential to an IP address or a range of IP addresses3. The other options are not tables that associate an IP address and a credential in Discovery. The Service Affinity table is a table that associates a business service and a credential. The Service CI Association table is a table that associates a business service and a configuration item (CI). The Tags table is a table that stores tags that can be applied to records in any table.

References: 1: Credential Affinity table 2: Credential affinity 3: Manually assign a credential to an IP address : Service Affinity table : Service CI Association table : Tags table

The Automation Error Messages list displays the errors that occurred during the execution of Discovery automation scripts. From this list, you can view the details of each error, such as the script name, the error message, the device, and the time. You can also perform actions on the errors, such as retrying the script, ignoring the error, or creating an incident. To do so, you can use the options on the right navigation pane, which are categorized as follows1:

• SELECT ALL: This option allows you to select all the errors in the list.
• SELECT ONE: This option allows you to select one error in the list by clicking on the checkbox next to it.
• ACTION ON SELECTED: This option allows you to perform an action on the selected errors, such as Retry, Ignore, or Create Incident. You can also choose to perform the action on all the errors in the list by selecting the All option from the drop-down menu.
• ACTION ON ALL: This option allows you to perform an action on all the errors in the list, regardless of the selection. You can choose from the same actions as the ACTION ON SELECTED option.

References:

• Discovery error messages: This article explains the different types of error messages and warnings in Discovery, and how to access and manage them.

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable. Get Process executes a command to list the processes running on a target and stores the results in a variable12.

References:

• Pattern operations - Product Documentation: Vancouver - ServiceNow
• Pattern operations - Product Documentation: San Diego - Now Support Portal

ServiceNow Discovery can be extended in three main ways: Classifiers, Probes & Sensors, and Discovery Patterns. Classifiers are used to identify the type of device or application that is being discovered, based on the information returned by a probe. Probes are commands or scripts that are executed on the target device or application to collect data. Sensors are scripts that process the data collected by probes and create or update configuration items (CIs) in the CMDB. Discovery Patterns are graphical representations of the discovery process that can be customized or created to discover specific types of devices or applications, using classifiers, probes, and sensors as building blocks.

References:

• Discovery overview - Product Documentation: Vancouver - Now Support Portal
• Create a Discovery CI classification - Product Documentation: Vancouver - Now Support Portal
• Discovery probes and sensors - Product Documentation: Vancouver - Now Support Portal
• Discovery patterns - Product Documentation: Vancouver - Now Support Portal

Discovery and Service Mapping are both products that help to identify and map the IT infrastructure and services in an organization. However, they have different approaches and objectives. Discovery uses IP address ranges as the starting point for finding devices and applications on the network, and then runs probes and sensors to collect information and classify them. Discovery focuses on inventory-related use-cases, such as asset management, configuration management, and compliance. Service Mapping uses entry points, such as URLs or host names, as the starting point for mapping business services and their dependencies. Service Mapping runs patterns, which are sequences of operations that follow the traffic connections between devices and applications, and then creates a service map that shows the logical and semantic relationships. Service Mapping focuses on service-related use-cases, such as service availability, impact analysis, and root cause analysis12.

References:

• 1: ServiceNow Discovery Overview, page 9
• 2: ServiceNow Discovery Documentation, Service Mapping section

 When Discovery or Service Mapping identifies a CI that matches an existing CI in the CMDB, it checks whether the CIs are duplicates or not. If they are duplicates, Discovery adds them to a de-duplication task, which is a record that groups duplicate CIs and allows you to review and remediate them. You can use the Duplicate CI Remediator wizard to merge, flag, retire, or delete the duplicate CIs. By default, Discovery does not send notifications, create identification rules, or stop the next discovery for duplicate CIs.

References: Handle Duplicate CIs in your CMDB, De-duplication tasks, How to de-duplicate 2 ESX servers with same name?

 The Service Account for the MID Server must have the Log on as service right on the Windows platform. This right allows the MID Server to run as a Windows service and communicate with the ServiceNow instance. The Service Account does not need to have local or domain admin rights, as these are not required for the MID Server functionality. The MID Server User Role is a role on the ServiceNow instance, not on the Windows platform, and it is used to control the access and permissions of the MID Server on the instance.

References:

• Correcting MID Server Windows service account user and permissions
• What is a ServiceNow MID Server and how does it work?
• Configure Windows MID Server service credentials

Variables are used in discovery patterns to store and manipulate data that is collected or calculated during the discovery process. There are three kinds of variables used in discovery patterns12:

• CI attributes: These are variables that correspond to the attributes of the configuration item (CI) type that the pattern is discovering. For example, name, serial_number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information gathered by the pattern.
• Temporary: These are variables that are created and used within the pattern, but are not stored in the CMDB. For example, $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data such as the output of a command, the value of a parameter, or the result of a calculation.
• Global: These are variables that are defined in the global scope and can be accessed by any pattern. For example, $mid, $target, $ip_address, etc. Global variables are used to store and access data that is common to all patterns, such as the MID Server, the target device, or the IP address.

References:

• 1: ServiceNow Discovery Documentation, Pattern Variables section
• 2: ServiceNow Discovery Overview, page 11

For ServiceNow Discovery to detect a Windows device, the Windows Management Instrumentation (WMI) service needs to be running on the host. WMI is a Windows feature that provides a standardized way to access management information about operating system components and services. Discovery uses WMI to query Windows hosts for information about their hardware, software, and system configuration. SSH is used for Unix-like systems, WinRM is an alternative Windows management protocol, and CIM (Common Information Model) is a cross-platform standard; however, WMI is the primary service used for Windows device discovery.

The Extension section in a horizontal pattern is executed after the Identification sections have completed and the CI has been identified. The Extension section allows adding additional attributes or relationships to the CI, or launching other patterns for further discovery12.

References:

• 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow
• 2: Horizontal Pattern probe - Product Documentation: San Diego - ServiceNow