Skip to main content
{ Asset Inventory / Reporting and Compliance }

ServiceNow CMDB Reconciliation

Compares the servers and virtual machine instances in the ServiceNow CMDB with what the cloud providers and the endpoint sensor actually see, and reports every asset that is missing, stale, duplicated, or unowned.

What this agent does

This read-only agent reconciles the ServiceNow CMDB against live inventories. It reads the server and virtual machine instance configuration items, then reads the running instances in AWS, Google Cloud, and Azure and the hosts the endpoint sensor reports. It matches each live asset to a configuration item by cloud resource ID, serial number, and fully qualified domain name. It reports live assets with no configuration item, configuration items with no live asset, duplicates, and configuration items with no owner or support group.

The challenge

Responders, vulnerability teams, and auditors ask the CMDB who owns an asset. The CMDB answers from discovery data that ran against an estate that has since changed. An instance created outside the discovery schedule has no record. A decommissioned server stays operational in the CMDB for months. Two discovery sources create two records for one host. Many records have no owner. The team fixes the CMDB one incident at a time, after the wrong answer has already slowed a response.

The solution

The agent matches live assets to configuration items on identifiers, never on a short hostname alone, and treats an ambiguous match as unmatched. It knows that cloud discovery records one instance as a virtual machine instance plus a guest server linked by a relationship, and counts that pair as one asset. It reports each gap with the source that saw the asset, the last time it was seen, and the fix. It changes nothing in the CMDB, and it confirms each fix on the next run. Provides one list of CMDB gaps a configuration manager can work through.

Workflow

  1. 01

    Read the CMDB

    Read the server and virtual machine instance configuration items with their identifiers, status, owner, support group, environment, discovery timestamps, and the relationships that link an instance to its guest server.

  2. 02

    Read the live inventories

    Read the running instances in the cloud accounts I connect and the hosts the endpoint sensor reports, with their identifiers and last-seen times.

  3. 03

    Match

    Match each live asset to a configuration item by cloud resource ID, then serial number, then fully qualified domain name, and treat several candidates as unmatched.

  4. 04

    Classify gaps

    Classify each asset as matched, missing from the CMDB, stale in the CMDB, duplicated, or unowned.

  5. 05

    Report

    Report each gap with its evidence and fix, and the counts for each class.

Agent template 

# ServiceNow CMDB Reconciliation

## Measurable outcomes

Every running instance and every sensor-reported host is matched to one operational configuration item with an owner, or to a virtual machine instance and guest server pair linked by a relationship, or it is in the report with the reason. Track the matched, missing, stale, duplicate, and unowned counts on every run. The gap counts fall as the configuration manager fixes records.

## Procedure

Each run, read the server and virtual machine instance configuration items from the CMDB with their cloud resource IDs, serial numbers, names, fully qualified domain names, IP addresses, operational status, install status, owner, support group, environment, discovery source, and last discovered time. Read the relationships between virtual machine instances and the guest servers they virtualize. Treat a server and a virtual machine instance linked by that relationship as one asset, not a duplicate. Read the running instances in the AWS accounts, Google Cloud projects, and Azure subscriptions I connect, with their resource IDs, names, tags, and launch times. Read the hosts the endpoint sensor reports, with their serial numbers, names, and last-seen times. Match each live asset to a configuration item by cloud resource ID first, then by serial number, then by fully qualified domain name. Never match on a short hostname alone. Treat several remaining candidates with no relationship between them as a duplicate set, not a match. A live asset with no match for more than 24 hours is missing from the CMDB, unless I set another window. An operational configuration item that ServiceNow Discovery, the cloud accounts, and the sensor have not seen for 30 days is stale, unless I set another window. A configuration item with no owner and no support group is unowned. A terminated instance whose configuration item stays operational is stale. Report each gap with the source that sees the asset, the last time it was seen, the environment from tags when the CMDB has none, and the fix, such as create the record, retire the record, merge the duplicates, or assign an owner. Read the tags I name as the owner tag and propose that owner for unowned records. Never create, update, retire, or merge a configuration item. Report a cloud account or sensor the agent cannot read as not checked, never as reconciled.

## Requirements

It needs read-only ServiceNow Table API access to the CMDB configuration item tables and relationships, read-only access to the cloud accounts in scope to list instances, and read access to CrowdStrike Falcon or Microsoft Defender for Endpoint hosts, and nothing more. It never changes the CMDB, a cloud resource, or a sensor. Reports show counts, environments, and support groups. Hostnames and cloud resource IDs appear as stable pseudonyms in the summary and in full in the ticket for the owner.