CIS-Discovery Questions and Answers

Agent Collector is the component that executes the osquery commands on agents to gather attribute details from a CI. Agent Collector is a feature of the Agent Client Collector (ACC) for Discovery, which is an integration that enables ServiceNow Discovery to use osquery to collect data from Linux and Windows devices that have the Elastic Agent installed1. Agent Collector allows you to define osquery queries and assign them to policies that target specific devices or groups of devices2. Agent Collector then runs the queries on the agents and sends the results back to the instance, where they are processed by the Agent Listener and stored in the CMDB3.

References: 1: Agent Client Collector for Discovery - ServiceNow 2: Create an Agent Collector policy - ServiceNow 3: Agent Client Collector for Discovery architecture - ServiceNow

When designing steps with operations requiring variables, it is best practice to query targets for variables1. This allows you to dynamically obtain the values of the variables from the target devices, rather than hard coding them or using scalar variables that may not reflect the current state of the target. Querying targets for variables also enables you to design for a dynamic environment, where the target configuration may change over time.

References:

• 1: Define discovery steps

Discovery uses the ping method to determine if a host IP is active or alive. Ping is a network utility that sends an ICMP echo request packet to a target IP address and waits for an ICMP echo reply packet. If the target IP address responds, it means that the host is active or alive12.

References:

• 1: ServiceNow Discovery Documentation, Discovery Process section
• 2: ServiceNow Discovery Overview, page 8

 A Behavior is a set of rules that determines which MID Servers launch which types of probes during a Discovery1. It can be assigned to a Discovery IP Range, which is a range of IP addresses that Discovery scans for CIs2. By using the Behavior drop-down menu on a Discovery IP Range, one can control how Discovery behaves for each IP address in that range3. The other options are not related to using a Behavior for discovery. The MID Server selection method on a Discovery Schedule is a way to specify which MID Servers are eligible to run Discovery for a given schedule4. The Behavior drop-down menu on a Discovery Status is a way to filter the Discovery Status records by the Behavior used. The Behavior checkbox on a CI is a way to indicate whether the CI was discovered using a Behavior or not.

References: 1: Discovery behaviors 2: Discovery IP ranges 3: Assign a behavior to an IP range 4: MID Server selection method : Discovery Status : Behavior field on the cmdb_ci table

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

• A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.
• A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.
• An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.

References:

• 1: IfTable - Product Documentation: San Diego - ServiceNow
• 2: InstanceID - Product Documentation: San Diego - ServiceNow

Horizontal discovery patterns are a series of operations that tell Discovery which CIs to find on your network, what credentials to use, and what tables to populate in the CMDB. Horizontal discovery patterns use variables to store and pass information between the operations. By default, there are two variables that are automatically available for horizontal discovery patterns: infrastructure_system and computer_system. These variables store the information about the infrastructure and the computer system of the target CI, respectively. They are populated by the Horizontal Pattern probe and sensor, which enable Discovery to use patterns for horizontal discovery123.

References:

• Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal
• Horizontal Pattern probe - Product Documentation: San Diego - Now Support Portal
• Using patterns for horizontal discovery - Product Documentation: Vancouver - ServiceNow

Hardware Models are templates that define the attributes and default values for a specific type of hardware configuration item (CI). Hardware Models can have a one-to-many relationship with the following entities:

• Assets: An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract. A Hardware Model can be associated with multiple assets that share the same characteristics and specifications.
• Configuration Items: A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A Hardware Model can be associated with multiple CIs that share the same characteristics and specifications.
• Model Categories: A model category is a classification of Hardware Models based on their function, such as network, storage, or server. A Hardware Model can belong to one or more model categories that define its scope and usage.

References:

• Hardware Model
• Asset
• Configuration Item (CI)
• [Model Category]

In a Merge Table pattern operation within ServiceNow Discovery, the editable fields typically include the Target Table, Second Table, and First Table. These fields are configurable and allow users to specify the tables involved in the merge operation. The Target Table is where the merged data will be stored, while the First and Second Tables are the source tables whose data is being merged. The Primary Table is not typically an editable field in this context. References = ServiceNow Discovery documentation, particularly the sections discussing pattern design and operations, including Merge Table operations within Discovery Patterns.

 A scheduled job is a background process that runs at a specified time or interval to perform a specific task1. It is not a method for deleting specific CIs that are not discovered in 30 days. The other options are methods for deleting or updating CIs based on discovery data. A UI policy is a script that can dynamically change the behavior of a form or list2. A service mapping is a process that creates a map of the relationships between CIs that support a business service3. A data policy is a rule that enforces data consistency and accuracy by validating the data entered into a record.

References: 1: Scheduled Jobs 2: UI Policies 3: Service Mapping : Data Policies

In ServiceNow Discovery, the reconciliation process is governed by precedence rules. These rules determine which data source’s information will be retained if there are conflicts when multiple sources discover the same CI. In this case, Altiris has a higher order of precedence (300) compared to ServiceNow (100), as seen in the “Data Source Precedents” section of the image. Therefore, if Altiris discovers ‘Windows2’ for the name attribute on the same CI after ServiceNow sets it to ‘Windows1’, the name will change to ‘Windows2’ due to Altiris’s higher precedence.

References: The explanation is inferred from understanding how reconciliation and data source precedents work in ServiceNow Discovery, though not directly quoted from specific documents. You can find more information on these topics in the following links:

• Reconciliation
• Data source precedents

The main Key Performance Indicators (KPIs) for the CMDB Health scorecard in ServiceNow include Correctness, Completeness, and Staleness. These KPIs are critical for assessing the overall health and quality of the CMDB. Correctness refers to the accuracy of the data in the CMDB, Completeness measures whether all required CI data is present, and Staleness indicates the freshness or timeliness of the CI data. Compliance and Duplicates, while important, are not considered main KPIs in the context of the CMDB Health scorecard. References = ServiceNow CMDB documentation and CMDB Health Dashboard user guide, focusing on the key performance indicators for CMDB health.

In ServiceNow Discovery, relationships between Configuration Items (CIs) in a horizontal pattern are created using the "Create Relation/Reference" operation. This operation allows the pattern to define and establish relationships or references between discovered CIs, based on the information gathered during the discovery process. Options B and C are incorrect as relationships are not automatically created nor is it true that they cannot be created via patterns. Option D, "Create Connections," is not a standard operation in this context. References = ServiceNow Discovery documentation, specifically the sections on creating and managing horizontal discovery patterns.

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

References: Patterns and horizontal discovery, Available discovery patterns

The CMDB contains records of configuration items (CIs) and their relationships. A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A relation type defines the nature of the connection between two CIs, such as depends on, uses, or contains. A model is a template for a CI that defines its attributes and default values. An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract.

References:

• Configuration Item (CI) types: Attributes and relationships
• What is a configuration management database (CMDB)?
• CSA Challenge Questions Flashcards

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable. Get Process executes a command to list the processes running on a target and stores the results in a variable12.

References:

• Pattern operations - Product Documentation: Vancouver - ServiceNow
• Pattern operations - Product Documentation: San Diego - Now Support Portal

The Set Parameter Value operation is used to assign a value to a variable in a Discovery pattern1. The syntax for this operation is as follows2:

Set Parameter Value: =

The  can be either a constant or an expression. To declare a constant, unchanging value, one must use quotes around the value. For example2:

Set Parameter Value: $name = "John"

This assigns the string “John” to the variable $name. The quotes indicate that the value is a constant and will not change. The other options, hash tag, brackets, and dollar sign, are not used to declare a constant value. They have different meanings in the syntax of the Set Parameter Value operation. A hash tag (#) is used to indicate a comment2. Brackets ([]) are used to access an element of an array or a map2. A dollar sign

The Pattern Designer is a graphical tool that allows users to create and edit horizontal discovery patterns. The Pattern Designer has three main sections: the left section shows the CI type and the pattern type, the middle section shows the pattern steps and the flow diagram, and the far-right section shows the details of the selected step or operation. The far-right section can display the following tabs, depending on the type of step or operation selected12:

• Operations: This tab shows the list of available operations that can be added to the pattern, such as Execute Command, Parse File, Set Parameter Value, etc. Operations are the basic building blocks of a pattern that perform specific actions on the target device or the MID Server.
• CI Attributes: This tab shows the list of attributes that can be set or updated for the CI type of the pattern, such as name, serial number, manufacturer, etc. CI attributes are used to populate the CI record in the CMDB with the information collected by the pattern.
• Temporary Variables: This tab shows the list of temporary variables that can be created or used by the pattern, such as $result, $output, $user_var, etc. Temporary variables are used to store and manipulate data within the pattern, such as the output of a command, the value of a parameter, or the result of a calculation.
• CMDB Dashboard: This tab shows the CMDB dashboard that displays the CI record and its related lists, such as relationships, identification rules, sensors, etc. The CMDB dashboard is used to preview and verify the outcome of the pattern on the CI record in the CMDB.

References:

• 1: ServiceNow Discovery Documentation, Pattern Designer section
• 2: ServiceNow Discovery Overview, page 11

Debug mode is a feature of the Pattern Designer that allows you to test and troubleshoot your patterns in real time. To activate Debug mode, you need to have the admin role or a role that includes the pattern_designer_debug permission. Debug mode is not available for users who only have the pattern_designer_read permission1.

References: 1: Activate pattern Debug mode - Product Documentation: San Diego - ServiceNow

Quick Discovery is a wizard that helps you get up and running with Discovery quickly. It discovers both physical and logical components, including virtual machines, servers, storage, databases, applications, and more. To use Quick Discovery, you need to have a MID Server installed and configured, and provide a target IP range or subnet to scan. You do not need to create a Discovery Schedule or a PID for Quick Discovery.

References: ServiceNow Discovery Data Sheet, Discovery Quick Start

 CI reclassification is the process of changing the class of a CI in the CMDB based on the discovery data. It can be done manually or automatically, depending on the configuration settings. CI reclassification can result in data loss if the new class has fewer or different attributes than the original class, and the existing attribute values are not preserved or mapped to the new class. This can happen when a CI is switched to a different class hierarchy, such as from a Linux Server to a Windows Server, or when a CI is downgraded to a less specific class, such as from a Database to a Software Instance. Therefore, switching and downgrading have a higher chance of leading to lost data during CI reclassification.

References:

• CI reclassification
• Reclassify CIs
• Configure automatic CI reclassification

A /24 subnet IP Range means that there are 256 possible IP addresses in the range, from 0 to 255. A Shazzam batch size of 5000 means that Discovery will send 5000 ICMP packets at a time to scan the IP addresses. Therefore, Discovery will launch the Shazzam probe once for every 5000 IP addresses in the range, or 256 / 5000 = 0.0512 times. Since the number of times must be an integer, Discovery will round up to 1 and launch the Shazzam probe once. However, since the Shazzam probe is launched for each MID Server that is assigned to the Discovery Schedule, the actual number of times will depend on how many MID Servers are available. If there are N MID Servers, then the Shazzam probe will be launched N times, each sending 5000 ICMP packets to the same IP range. Therefore, the total number of times that the Shazzam probe will be launched during discovery is N * 1 = N.

References:

• Discovery Schedule form
• Shazzam Probe
• Discovery IP range

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload. The thread count can be configured by changing the MID Server parameters in the ServiceNow instance12. References = 1: MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow 2: Product Documentation | ServiceNow

During the Discovery process, the Model Category of the Configuration Item (CI) determines if an Asset record is created. A Model Category is a grouping of models that share the same asset tracking strategy and the same CI and Asset tables. The asset tracking strategy defines whether Discovery creates an Asset record for each CI of that Model Category. There are three possible asset tracking strategies: Create Assets, Don’t create Assets, and Create Consumable Assets12.

References:

• 1: ServiceNow Discovery Documentation, Model Categories section
• 2: ServiceNow Support Article, Why do Assets get created when inserting a CI that has a Model that is set to Don’t create Assets?

A classifier is a set of rules that identifies a device type based on the results of a probe. A classifier can have one or more related lists that define the classification criteria, the pattern probes, and the triggers probes. The pattern probes related list specifies which horizontal discovery pattern to run for the device type. The triggers probes related list specifies which probes to run after the device is classified, and before the horizontal discovery pattern is executed. The triggers probes can be used to gather additional information or credentials that are needed for the horizontal discovery pattern12.

References:

• 1: ServiceNow Discovery Overview, page 9
• 2: ServiceNow Discovery Documentation, Classifiers section

On the ECC Queue, sensor records have a Queue value of output and probe records have a Queue value of input. The ECC Queue is the connection point between the instance and the MID Server, and it displays the input and output messages from and to the MID Server1. A probe is a message that the instance sends to the MID Server to request information from a device or application2. A sensor is a script that the MID Server runs to process the results returned by the probe3. When a probe is created, it is inserted into the ECC Queue with a Queue value of input, which means that it is waiting to be picked up by the MID Server4. When a sensor is created, it is inserted into the ECC Queue with a Queue value of output, which means that it is waiting to be processed by the instance.

References: 1: ECC Queue - ServiceNow 2: Probes - ServiceNow 3: Sensors - ServiceNow 4: How the ECC Queue table records get processed: from output ready to input processed - Support and Troubleshooting - Now Support Portal : [ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example - Support and Troubleshooting - Now Support Portal]

London Linux Servers is a CMDB Group with Health Group type. A CMDB Group is a collection of configuration items (CIs) that share common characteristics or are related in some way1. A Health Group is a type of CMDB Group that is used to monitor and measure the health of a specific set of CIs based on predefined rules and metrics2. The image shows that London Linux Servers is selected from the CMDB Health Group List, which is a dropdown menu that displays all the Health Groups defined in the system3. The image also shows the Group Health tab, which displays the health scores and indicators for the selected Health Group.

References: 1: Create a CMDB group - ServiceNow 2: CMDB health groups - ServiceNow 3: CMDB health dashboard - ServiceNow : [View CMDB health scores - ServiceNow]