Introduction

ServiceNow CMDB integration allows SAFE to ingest infrastructure assets, system details, and operational context to create a unified asset inventory. SAFE’s AI normalizes and deduplicates this data, enriching it with cybersecurity insights to enable risk-based vulnerability prioritization, deployment gap analysis, and enterprise-wide risk quantification. This document provides a step-by-step procedure to configure this Integration in SAFE.

What SAFE Imports from ServiceNow CMDB

This integration fetches assets and related metadata from ServiceNow CMDB.

Note

Operational and business data available in ServiceNow CMDB may vary based on your implementation. SAFE’s integration is configurable to capture required information from supported CMDB tables; however, the availability and accuracy of dynamic data (such as IP addresses and operating systems) depends on how frequently and accurately your CMDB is maintained.

Data Synchronization Behavior

Prerequisites and Permissions

Before configuring the ServiceNow CMDB integration in SAFE, create ServiceNow API credentials with appropriate access. These credentials are required to successfully connect and fetch asset data.

Supported Authentication Methods

SAFE supports the following authentication options:

• Basic authentication (username and password)
• OAuth 2.0 (OAuth provider and profile)
• Key-based authentication

Required Permissions

1. A role with cmdb_read permissions

Create a role in ServiceNow

You can create a role or use an existing role with the appropriate permissions.

To create a role:

1. In ServiceNow, go to All > User Administration > Roles.
2. Click New. Enter a role name like "safe_integration_role".
3. Click Submit, then open the role.
4. Click Contains Roles.
5. Click Edit and add the cmdb_read role.
6. Click Save.

Create a service account

After you have a role with the proper permissions and access assigned, you need to create a service account.

To create a service account:

1. In ServiceNow, go to All > User Administration > Users.
2. Click New. Enter a User ID (for example, safe_integration_user).
3. Enter any other required information.
4. Check Web service access only.
5. Check Internal Integration User (bypasses password expiration for technical accounts).
6. Submit, then open your new service account.
7. Click Set password and configure a password for the account.
8. Save the password and close the dialog box.
9. On the Roles tab, click Edit.
10. Add the role you created.
11. Click Save.
12. Click Update.

Create an OAuth application (For OAuth authentication only)

To create an OAuth application:

1. In ServiceNow, go to All > System OAuth > Application registry.
2. Click New.
3. Select Create an OAuth API endpoint for external clients.
4. Enter a unique name like "safe-integration".
5. Leave the Client Secret field blank to have ServiceNow generate the value.
6. Add a user account in AuthScope.
7. Keep the Token Lifespan values in the default state.
8. Click Submit.
9. Open the OAuth app and copy the Client ID and Client Secret values. You will enter these later when configuring the connector in SAFE.

10. If you do not see fields such as Default Grant Type, auth_type, or OAuth Application User:
    1. On the same OAuth application form, select Configure.
    2. Choose Form Layout.
    3. Add the following fields to the layout:
    4. Default Grant Type
    5. OAuth Application User
    6. Auth Scopes

11. (Optional) Enable client_credentials grant type for OAuth. Note: ServiceNow disables the client_credentials grant by default. You must enable it using a system property if you plan to use this grant type with SAFE.
    1. Open the following URL directly in your ServiceNow instance: https://<instance>.service-now.com/sys_properties.do
    2. Create a new property with the following details and submit:
    3. Name: glide.oauth.inbound.client.credential.grant_type.enabled

Description (optional): Enables the OAuth 2.0 Client Credentials grant for inbound OAuth

1. Type: true|false
2. Value: true

Generate Connection Details

Username and Password

Use the service account created in the prerequisites:

• Username: Service account username
• Password: Service account password. You will enter these directly in the Username and Password fields on the SAFE configuration page when you select the Username and Password authentication option.

OAuth 2.0

The connector supports two OAuth grant types:

• Client Credentials
• Password (Resource Owner Password Credentials)

Client Credentials

As stated in the prerequisites:

1. Create an OAuth application in ServiceNow.
2. Set the Default Grant Type to Client Credentials.
3. Ensure the system property glide.oauth.inbound.client.credential.grant_type.enabled is set to true.
4. From the OAuth application, you will need:
   1. Client ID: From the ServiceNow OAuth application
   2. Client Secret: From the ServiceNow OAuth application

Password

As stated in the prerequisites:

• Create an OAuth application, but configure the grant type as: Resource Owner Password Credentials
• From ServiceNow, you will need:
  • Username: Service account username
  • Password: Service account password
  • Client ID: From the ServiceNow OAuth application
  • Client Secret: From the ServiceNow OAuth application

Configure ServiceNow CMDB Integration in SAFE

To configure the ServiceNow CMDB integration in SAFE, follow these steps:

Save the Connection details

1. Log in to your SAFE account as an Admin.
2. From the left navigation panel, click Integrations.
3. Click the + Icon, then search for the ServiceNow CMDB card.
4. Click the ServiceNow card to configure this integration.
5. On the configuration page, enter the connection details.
6. Enter Integration Name.
7. ServiceNow URL: Enter URL in the format: https://<instance-name>.service-now.com/api/now/v2/table/ Example: https://xyz.service-now.com/api/now/v2/table/
8. Asset last seen days filter: Add the number of days you want to consider since the asset was last seen. Default is 30 days.
9. Import Tags & App Hierarchy: Imports CMDB key-value tags (KEY: value) for each asset, and tags every CI related to a business application with that application's ID.
10. Update Existing Assets Only: Updates only existing assets.
11. Auto Sync: Defines the interval in which SAFE will automatically run a sync. Default is 7 days.
12. Authentication option:
    1. Username and password : Enter the service account credentials.
    2. OAuth: Use the OAuth application details from the prerequisites. Supported grant types:
    3. Password (Resource Owner Password Credentials)
       1. Username: Service account username
       2. Password: Service account password
       3. Client ID: From the ServiceNow OAuth application
       4. Client Secret: From the ServiceNow OAuth application
       5. Access Token URL: https://<instance-name>.service-now.com/oauth_token.do
    4. Client Credentials
       1. Client ID: From the ServiceNow OAuth application
       2. Client Secret: From the ServiceNow OAuth application
       3. OAuth 2.0 Login URL: https://<instance-name>.service-now.com/oauth_token.do
       4. Resource: https://<instance-name>.service-now.com
    5. Key Based (Subscription Key): Enter the subscription key for the account configured to fetch data. For example, xxxx-xxxx-xxxxx-xxxx-xxxxx.

13. Click Next. Clicking Next runs a test connection and saves the connection details.

Table Mapping

Safe provides a default list of ServiceNow CMDB tables for mapping the connector. In Table Mappings, you can view, edit, or add tables. Specify which tables to connect to and how to map the data pulled from those tables. Click the toggle for a table to exclude it and its mappings.

For each CMDB table, you can click the Action button to adjust the field mapping as well as define an API filter that allows you to query only certain records from that table. For the API filter, you can use the standard ServiceNow sysparm_query filter relevant to the specific table you're working with. This allows you to filter based on attributes available in the current table.

Here are a few examples:

• sysparm_query=status NOT IN Elimination_Verified
• sysparm_query=osLIKEwindow
• sysparm_query=osCONTAINSwindows
• sysparm_query=os NOT IN Mac OS 10 (OS/X), Linux Oracle

Remember to include the sysparm_query= prefix when entering the API filter in the field.

Note

When configuring API filters for CMDB tables, avoid using sysparm_exclude_reference_link=true. This parameter, when set to true, prevents the API from returning the actual sys_id values of reference fields. As a result, only string representations are fetched, which can lead to incomplete data in Safe's ingestion process.

Mapping Steps

Follow the steps below to review and adjust your ServiceNow CMDB field mappings.

1. In the Map Fields page, you will see a list of tables that Safe has automatically populated for your instance. These tables correspond to Configuration Item (CI) classes in your ServiceNow CMDB and can be verified in the CI Class Manager. You can also exclude specific tables to prevent Safe from fetching data during the next scheduled run.

2. You can add additional tables as needed to include more data sources from your ServiceNow instance.
3. You can map columns from your ServiceNow tables to the corresponding Safe fields by clicking on the action icon. You may also append prefixes or suffixes to field values, or apply sysparm_query API filters to refine the data being imported.

Note

Asset name mapping is mandatory to sync assets.

Review Integration Details

1. The final step in setting up the integration is to review all configuration details. Carefully verify each configured setting to confirm its accuracy.
2. If any changes are needed, click Back to return to the relevant step and make corrections before completing the setup.
3. Click Save.

Tags

The ServiceNow CMDB Connector supports asset tagging to help classify, organize, search, and filter assets within SAFE.

The connector supports three categories of tags:

• Default Tags
• Key-Value Tags (User Defined)
• Custom Tags (User Defined)

Default Tags

Default tags are automatically generated from standard ServiceNow CMDB fields. They provide a consistent way to classify all your assets based on their properties, they are enabled by default.

Format: CMDB:{field_name}: {value}

Examples: CMDB:operational_status: In Service, CMDB:category: Hardware, CMDB:subcategory: Computer, CMDB:support_group: Infrastructure

When to use:

• Automatic classification without configuration
• Track operational status, asset category, or support ownership
• Consistent tagging across all similar assets

Common Default Tags

Key-Value Tags (User Defined)

Key-value tags are custom, flexible tags stored in ServiceNow's cmdb_key_value table. They allow you to add domain-specific metadata to your assets without schema changes, they are enabled by default.

Format: {KEY}: {VALUE}

When to use:

• Custom tagging beyond the standard CMDB fields
• Track business metadata (owner, environment, compliance status)
• Flexibility to add/remove tags without code changes
• Different assets need different tag sets

Who creates these tags:

• ServiceNow administrators or CMDB managers create key-value tags in ServiceNow
• They define the key (e.g., ENV_PROD, OWNER_DEVOPS) and assign values to each asset

Custom Tags (User Defined)

Custom Tags allow administrators to generate additional tags by mapping any supported source column during connector configuration. Unlike default tags, custom tags provide complete control over how asset metadata is transformed into searchable tags in SAFE.

Custom tags are created during asset ingestion.

How Custom Tags Work

When you enable a custom tag in a mapping, the connector:

1. Reads the mapped source column.
2. Retrieves the column value.
3. Applies an optional prefix.
4. Applies an optional suffix.
5. Creates a tag. Example: [prefix][column value][suffix]
6. Adds the generated tag to the asset in SAFE.

Examples:

Configuration Options

ENCODED Checkbox (One-Hot Encoding)

The Encoded option is intended for Boolean or flag-type fields.

When enabled, the connector evaluates the source value as a Boolean. The generated tag contains only the column name.

Unsupported Values

If the column contains a non-Boolean value, no tag is generated.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.