ServiceNow CIS-Discovery - Certified Implementation Specialist - Discovery

Agent Collector is the component that executes the osquery commands on agents to gather attribute details from a CI. Agent Collector is a feature of the Agent Client Collector (ACC) for Discovery, which is an integration that enables ServiceNow Discovery to use osquery to collect data from Linux and Windows devices that have the Elastic Agent installed1. Agent Collector allows you to define osquery queries and assign them to policies that target specific devices or groups of devices2. Agent Collector then runs the queries on the agents and sends the results back to the instance, where they are processed by the Agent Listener and stored in the CMDB3.

References: 1: Agent Client Collector for Discovery - ServiceNow 2: Create an Agent Collector policy - ServiceNow 3: Agent Client Collector for Discovery architecture - ServiceNow

A Functionality Definition is a configuration record that defines what protocols to detect from within a Behavior. A Behavior is a set of Functionality Definitions that Discovery uses to identify and explore a device or application. A Functionality Definition specifies the order, type, and parameters of the probes that Discovery launches to gather information about a device or application12.

References:

Functionality Definition

Behavior

 According to the ServiceNow Discovery documentation, the base system CI Identifiers for Windows Server class are name and serial_number. These are the attributes that Discovery uses to uniquely identify a Windows Server CI. If both attributes match an existing CI, Discovery updates that CI. If only one attribute matches, Discovery creates a new CI. If neither attribute matches, Discovery also creates a new CI. In this scenario, the serial_number is the same for both Windows Servers, but the name is different. Therefore, Discovery will create two separate CIs, one with WindowsSN1 as the name and one with WindowsSN2 as the name.

References:

Create a Discovery CI classification - Product Documentation: Tokyo - Now Support Portal

Identification rules - Product Documentation: Tokyo - Now Support Portal

ServiceNow IRE: Identification Rules Explained — Cookdown

Pattern operations are the building blocks of patterns that define the logic and actions to perform on the target CIs. Some pattern operations query targets to retrieve information or execute commands, while others manipulate data or perform other tasks. WMI Query and Get Process are examples of pattern operations that query targets. WMI Query executes a Windows Management Instrumentation (WMI) query on a Windows target and stores the results in a variable. Get Process executes a command to list the processes running on a target and stores the results in a variable12.

References:

Pattern operations - Product Documentation: Vancouver - ServiceNow

Pattern operations - Product Documentation: San Diego - Now Support Portal

Credential-less Discovery is a feature of ServiceNow Discovery that allows the instance to identify configuration items (CIs) without using credentials. Credential-less Discovery uses Network Mapper (Nmap), a free and open-source network scanner, to collect information about the CIs by sending packets and analyzing the responses. Nmap must be installed on the MID Server that runs Credential-less Discovery. Credential-less Discovery can be used as a fallback option when credential-based probes fail, or as a primary option for scanning certain types of devices, such as network devices, printers, or IoT devices12.

References:

Credential-less Discovery with Nmap - Product Documentation: San Diego - Now Support Portal

Credential-less host Discovery - ServiceNow - Now Support

The default thread count for a MID Server is 25. This means that the MID Server can run up to 25 worker threads simultaneously to execute the jobs assigned to it by the ServiceNow instance. The worker threads are divided into different thread pools based on the priority of the jobs. The MID Server can also adjust the thread count dynamically based on the system resources and the workload. The thread count can be configured by changing the MID Server parameters in the ServiceNow instance12. References = 1: MID Server Max Threads - Worker Groups - Priority and Queues - ServiceNow 2: Product Documentation | ServiceNow

On the ECC Queue, sensor records have a Queue value of output and probe records have a Queue value of input. The ECC Queue is the connection point between the instance and the MID Server, and it displays the input and output messages from and to the MID Server1. A probe is a message that the instance sends to the MID Server to request information from a device or application2. A sensor is a script that the MID Server runs to process the results returned by the probe3. When a probe is created, it is inserted into the ECC Queue with a Queue value of input, which means that it is waiting to be picked up by the MID Server4. When a sensor is created, it is inserted into the ECC Queue with a Queue value of output, which means that it is waiting to be processed by the instance.

References: 1: ECC Queue - ServiceNow 2: Probes - ServiceNow 3: Sensors - ServiceNow 4: How the ECC Queue table records get processed: from output ready to input processed - Support and Troubleshooting - Now Support Portal : [ECC Queue Processing and Debugging, with “Discovery - Sensors” used as an example - Support and Troubleshooting - Now Support Portal]

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

References:

Patterns and horizontal discovery - Product Documentation: Tokyo - Now Support Portal

Pattern Designer - Product Documentation: Vancouver - ServiceNow

Discovery pattern designer - ServiceNow IT Operations Management [Book]

Discovery finds and maps dependencies for the following types of storage devices: Direct-attached storage (DAS), network-attached storage (NAS), or storage area network (SAN)1. NAS or SAN storage that is discovered via a Storage Management Initiative Specification (SMI-S) and Common Information Model (CIM) is also supported2. Discovery collects information about storage area networks from specialized devices, such as storage arrays and Fibre Channel (FC) switches, and creates specific references between the tables in the SAN3. Discovery does not support Multiple area network (MAN) or Redundant Array of Independent Disks (RAID) as types of storage devices.

References:

1: Storage device discovery

2: Storage Discovery via SMI-S and CIM

3: Discovery of storage area networks (SAN)

An extension section of a discovery pattern is a section that allows you to modify or extend the functionality of an existing pattern without customizing it. An extension section can contain shared libraries, which are reusable code snippets that can be invoked from any pattern or extension section. Shared libraries can be used to define common functions, variables, or constants that are used across multiple patterns or extension sections. Shared libraries can also be used to override the default behavior of some built-in functions, such as identification or classification12. References = 1: ITOM: Extending Discovery/Service Mapping Patterns - GlideFast ServiceNow 2: How to Create Discovery Pattern Extensions and Why to Use Them