CIS-Discovery Certified Implementation Specialist - Discovery Questions and Answers

The mid.discovery.max_pattern_payload_size property defines the maximum overall size for the returned payload that comes from patterns. This property is set on the MID Server and applies to all patterns that run on that MID Server. If the payload size exceeds this limit, the pattern execution fails and an error message is logged in the ECC queue. The default value of this property is 10 MB1.

According to the ServiceNow website1, the key capabilities of a ServiceNow ITOM Enterprise solution are:

Manage hybrid clouds: Gain visibility and control across your hybrid cloud environment with a single system of action for IT.

Proactively eliminate service outages: Identify issues and anomalies before they cause service outages with AIOps and machine learning.

Automate IT service operations: Automate common service requests, processes, and tasks with digital workflows and virtual agents.

Optimize IT service delivery: Align your IT resources and investments with business priorities and optimize service delivery performance.

The Extension section in a horizontal pattern is executed after the Identification sections have completed and the CI has been identified. The Extension section allows adding additional attributes or relationships to the CI, or launching other patterns for further discovery12.

The SNMP Query operation on a pattern for a custom device query allows Discovery to retrieve information from the target device using the SNMP protocol. It is best practice to use the published manufacturer’s device MIB, which is the official and standard definition of the device’s SNMP data. Using the manufacturer’s device MIB ensures that the query is accurate, consistent, and compatible with the device. Modifying the default MIB information, enabling SSH as a secondary protocol, or using live devices in production are not recommended practices, as they may introduce errors, security risks, or performance issues123.

The MID Server parameters like 'mid.ssh.session_timeout', 'url', and 'mid.windows.management_protocol' can be modified through the ServiceNow platform UI under the MID Server configuration settings. These parameters control various aspects of the MID Server's operation, such as timeout settings for SSH sessions, the URL for the MID Server to communicate with the ServiceNow instance, and the management protocol to use for Windows servers, respectively. The 'name' of the MID Server, however, is not typically a parameter that can be changed through the UI as it is a unique identifier for the MID Server within the ServiceNow instance. Once a MID Server is registered with a name, that name is usually persistent and not intended to be modified through configuration settings.

Credential affinity is an association between a set of credentials and a device on your network. When Discovery or Orchestration first attempts to access a device, they try all available credentials until a valid one is found. Once a valid credential is found, it is recorded in the dscy_credentials_affinity table, and further discovery processes rely on this information. If the credentials are modified or changed, the process will be repeated until a valid credential is found and updated in the same table. Credential affinity allows Discovery to use the most efficient and successful credential for each device, and avoid unnecessary credential failures.

The Parse Variable pattern operation allows you to extract information from the output of a previous operation and save it in a variable. You can choose from different parsing methods, such as JSON File, XML File, Regular Expression, or Custom Script. To have two different parsing methods to populate variables, you need to use two different steps, each with a different Define Parsing selection. For example, you can use one step to parse a JSON file and another step to parse an XML file. You cannot use two different parsing methods on the same step, as the Define Parsing selection is unique for each step.

Quick Discovery is a wizard that helps you get up and running with Discovery quickly. It discovers both physical and logical components, including virtual machines, servers, storage, databases, applications, and more. To use Quick Discovery, you need to have a MID Server installed and configured, and provide a target IP range or subnet to scan. You do not need to create a Discovery Schedule or a PID for Quick Discovery.

When designing steps with operations requiring variables, it is best practice to query targets for variables1. This allows you to dynamically obtain the values of the variables from the target devices, rather than hard coding them or using scalar variables that may not reflect the current state of the target. Querying targets for variables also enables you to design for a dynamic environment, where the target configuration may change over time.

To launch any pattern, you need to specify the CI classification and the CI type. The CI classification determines the table where the discovered CI is stored in the CMDB, and the CI type defines the specific attributes and relationships of the CI. For example, if you want to discover a Windows server, you need to select the CI classification as cmdb_ci_win_server and the CI type as Windows Server. These choices are mandatory for any pattern, as they enable Discovery to identify and classify the CIs correctly.

In the ServiceNow Discovery module, under the Recommended Actions pane for an Automated Error Messages list within Discovery > Home, the possible options under ACTION ON ALL include "View instructions" and "Retry Discovery". "View instructions" allows users to see guidance on how to address the errors, while "Retry Discovery" enables users to reinitiate the discovery process for the affected devices. "Make Ranges" and "Ping IP Addresses" are not standard options in this context.References= ServiceNow Discovery documentation and user guides, particularly those discussing the management of automated error messages and recommended actions in Discovery.

Discovery uses the ping method to determine if a host IP is active or alive. Ping is a network utility that sends an ICMP echo request packet to a target IP address and waits for an ICMP echo reply packet. If the target IP address responds, it means that the host is active or alive12.

A MID Server needs to have access to the install.service-now.com domain to automatically stay up-to-date with instance versions. This domain hosts the MID Server upgrade files that are downloaded and installed by the MID Server when a new version is available. The MID Server checks for updates every 24 hours by default, or when the mid.upgrade.check_interval property is set12.

 To allow a MID Server to access servers using WinRM, the following configurations are required:

MID Servers need to be added to the WinRM Group policy on the Servers: This enables the servers to accept WinRM connections from the MID Servers and grant them the necessary permissions to execute commands and scripts1.

MID Server Parameters Add WinRM: This enables the MID Server to use WinRM as a protocol for Discovery and Orchestration and specify the WinRM port, authentication method, and encryption settings2.

A is true because the target table $cmdb_ci_web_server is a ServiceNow CMDB table that stores information about web servers1.

B is true because the merge table operation is typically used for application patterns, which are horizontal patterns that discover applications and their dependencies. The condition on the process.executablePath variable suggests that the operation is looking for a specific application (mongoose) running on the web servers.

D is true because the merge table operation requires at least one matching field value between the two source tables1. In this case, the process.executablePath variable is the matching field, and it must contain “mongoose” for the operation to run.

 CI reclassification is the process of changing the class of a CI in the CMDB based on the discovery data. It can be done manually or automatically, depending on the configuration settings. CI reclassification can result in data loss if the new class has fewer or different attributes than the original class, and the existing attribute values are not preserved or mapped to the new class. This can happen when a CI is switched to a different class hierarchy, such as from a Linux Server to a Windows Server, or when a CI is downgraded to a less specific class, such as from a Database to a Software Instance. Therefore, switching and downgrading have a higher chance of leading to lost data during CI reclassification.

During the Discovery process, the Model Category of the Configuration Item (CI) determines if an Asset record is created. A Model Category is a grouping of models that share the same asset tracking strategy and the same CI and Asset tables. The asset tracking strategy defines whether Discovery creates an Asset record for each CI of that Model Category. There are three possible asset tracking strategies: Create Assets, Don’t create Assets, and Create Consumable Assets12.

For a pattern operation, the <_> placeholder can be replaced by any valid index or wildcard character that can be used to access an element of an array or a table. The $IfTable variable is a table that contains information about the network interfaces of a device1. The InstanceID attribute is a unique identifier for each interface2. To access the InstanceID of a specific interface, the pattern operation can use the following syntax:

$IfTable[].InstanceID

where is either:

A numeric index that corresponds to the position of the interface in the table, such as 3 for the third interface.

A dot (.) followed by a key-value pair that matches a specific attribute and value of the interface, such as [.Name=eth0] for the interface with the name eth0.

An asterisk () that represents a wildcard that matches any interface in the table, such as [] for all interfaces.

The CMDB contains records of configuration items (CIs) and their relationships. A CI is any component that needs to be managed in order to deliver an IT service, such as a server, an application, or a user. A relation type defines the nature of the connection between two CIs, such as depends on, uses, or contains. A model is a template for a CI that defines its attributes and default values. An asset is a tangible or intangible resource that is tracked and managed by the organization, such as a laptop, a license, or a contract.

A horizontal discovery pattern is a series of operations that tell Discovery how to find and identify an application on a host1. To extract the build and version numbers from the config file, the pattern can use either of the following methods:

Parse File operation with Delimited Text parsing strategy: This operation reads the content of a file and splits it into fields based on a delimiter character. The pattern can specify the delimiter as a space and the fields to extract as the second and fourth ones from the first line of the file2.

Parse File operation with Regular Expression parsing strategy: This operation reads the content of a file and matches it against a regular expression. The pattern can specify the regular expression as app build (\d+\.\d+\.\d+\.\d+) version (\d+\.\d+) and the groups to extract as the first and second ones from the first line of the file2.

The Discovery Dashboard provides a summary of the Discovery status, including the number of active discovery errors, the number of devices discovered, and the number of credentials used. Each error has a help link that provides more information about the cause and possible solutions.

 File Based Discovery is used to discover file paths to recognize the signature of installed software. File Based Discovery helps to identify what software is running on Windows and UNIX servers and devices by scanning the file system for specific files or directories that indicate the presence of a software product1. File Based Discovery can also check the file size, version, and checksum of the discovered files to verify the software installation2. File Based Discovery can be configured using file signatures, which are patterns that match the file paths of software products3.

The Debug Identification Section in Debug Mode allows you to specify the identification attributes of a CI that you want to debug. These attributes are used to find the CI in the CMDB and run the pattern on it. The identification attributes vary depending on the CI class, but for infrastructure patterns, the common ones are IP and Host Name. These attributes are also used by the horizontal discovery to identify CIs. AWS Endpoint and PID are not valid identification attributes for infrastructure patterns.

 The MID Server’s user account must have the mid_server role to interact with a ServiceNow instance. This role allows the MID Server to access protected tables and perform discovery and orchestration tasks on behalf of the instance. The other roles are not related to the MID Server functionality. The discovery_admin role is for configuring and managing discovery, the sm_mid role is for using the Service Mapping MID Server, and the mid_discovery role is for running discovery probes and sensors.

The ECC Queue tab displays the input and output messages from and to MID Servers. The default fields that are displayed on this tab are:

Topic: The topic of the message, such as Discovery, Orchestration, or MID Server.

Queue: The queue name of the message, such as input, output, or error.

Source: The source of the message, such as the MID Server name, the instance name, or the probe name.

State: The state of the message, such as ready, processed, or ignored.

Created: The date and time when the message was created.

Updated: The date and time when the message was last updated.

Some other fields that can be added to the ECC Queue tab are:

Details: The details of the message, such as the payload, the response, or the error message.

Pattern log link: The link to the pattern log file, if the message is related to a pattern execution.

CMDB CI: The configuration item that is associated with the message, if any.

Discovery schedule name: The name of the discovery schedule that triggered the message, if any.

The Shazzam Batch Size property determines how many IP addresses are scanned by a single Shazzam probe1. If this value is set to 1000 and a discovery must scan 10,000 IP addresses using a single MID Server, it creates 10 Shazzam probes with each probe scanning 1000 IP addresses. This property can be configured in the Discovery Properties module under Discovery Definition2.

In a discovery pattern, CI Attributes are the fields that store the information about the configuration items (CIs) that are discovered by the pattern. The Pattern Designer is a graphical interface that allows users to create and edit patterns using drag-and-drop operations. In the Pattern Designer, there are two types of CI Attributes that are available: Main pattern CI type and Related CI types. The Main pattern CI type is the CI type that the pattern is designed to discover, such as Windows Server, Linux Server, or Database. The Related CI types are the CI types that are related to the main CI type, such as IP Address, Network Adapter, or Software Installation. Users can select the CI Attributes from these types to populate the CMDB tables with the data collected by the pattern123.

A horizontal pattern is a type of Discovery pattern that discovers configuration items (CIs) and their relationships by moving across the network from one device to another. A horizontal pattern can use the Change user operation to switch from the default credentials to any other appropriate credentials for a specific device or application. This operation allows the pattern to access different types of CIs with different authentication methods.