ServiceNow - Create Assets

ServiceNow - Create Assets creates an asset in ServiceNow for:

• Assets returned by the selected query or assets selected on the relevant asset page.

See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.

When accessing an enforcement action using the API, you must use the backend form of field names.

Use the Syntax Helper to find the correct name. In the enforcement action, enable Configure Dynamic Values and select Syntax Helper.

📘

Note

• Not all asset types are supported for all Enforcement Actions.
• See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
• See Actions supported for Aggregated Security Findings.
• See Actions supported for Software.

Required Fields

These fields must be configured to run the Enforcement Set.

• Use stored credentials from ServiceNow adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  📘

  Note

  To use this option, you must successfully configure a ServiceNow adapter connection.

• Retry count (default: 1) - If the action fails, Axonius will retry running it the specified number of times for each asset.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Main Asset Configuration

This section describes how to configure the main asset record created in ServiceNow.

• CMDB CI table name (default: cmdb_ci_computer) - Specify the target table in your ServiceNow CMDB where the new Configuration Item (CI) will be created, if other than the default table. For example, if you are creating a record for a network switch, you would enter cmdb_ci_netgear_switch here to ensure it's placed in the correct table.

• Split by field values - Select the adapter and the list field from that adapter to split into individual entities. The system will iterate through the specified list and generate a new entity for each entry, allowing you to send a distinct record for every item.
  Example: If a single device record contains a list of three separate IP addresses, enabling this option will create three individual device entities, one for each IP address.

• Map Axonius fields to ServiceNow fields - Use the Map Fields component to define how Axonius data is transferred to ServiceNow. Each row maps a ServiceNow field (the target field in ServiceNow) to an Axonius field (the source data from Axonius, or a static value entered directly).

  • Click + Add Field to add a new mapping row.
  • Click + Add alternative on a row to specify additional Axonius fields as fallback sources. Axonius uses the first field in the list that contains a value.
  • Click Template to load a set of default field mappings as a starting point.
  • Click Import CSV to import mappings from a CSV file.
  • Click JSON view to view or edit the mapping configuration directly in JSON format.

  For details, see Axonius to External Field Mapping.

• Use full URL for device creation - Select this option to use the entire URL entered in the ServiceNow Domain field when creating a new asset. When not selected, only the domain part of the URL is used, and the rest is calculated by the action based on the table name. This can be used, for example, to insert assets using a custom API in ServiceNow.

• Create ServiceNow asset even if device's asset entities include ServiceNow - Select this option to allow the enforcement action to create or update an asset in ServiceNow even if the device record in Axonius was originally discovered by a ServiceNow adapter. By default, the system prevents this to avoid creating duplicate records.

• When using IRE, specify main asset referenced field names that must be translated to sys_id - This only applies when using the Identification and Reconciliation Engine (IRE). Enter the names of fields that contain a reference to another record in ServiceNow. By default, Axonius sends the display value of a field (for example, a user's name or a department's name). However, ServiceNow's IRE requires the unique system ID (sys_id) of the related record to correctly link assets. Press Enter to add each field name as a new entry.

• Additional fields to use by querying ServiceNow - Use this option to enrich new assets with data from an external ServiceNow table. For every asset created, the system uses key fields from Axonius to find a matching record in ServiceNow. The results are appended to the newly created asset. Click + Add Enrichment Query and define the following:

  • Table Name - The ServiceNow source table to query for additional data (for example, cmdb_ci_server).

  • Axonius to source table query mapping - Define the mapping between Axonius fields and ServiceNow source table fields used to query for a match.

  • Filter Operator - Select the type of match to use when querying the ServiceNow table:

    • Is one of - Checks if the Axonius field value is contained within a list of values in the ServiceNow field.
    • Contains - Checks if the Axonius field value is a substring of the ServiceNow field value.
    • Is - Checks for a complete and exact match between the Axonius and ServiceNow fields.

  • Create Record with matching values if no existing values found - When enabled, a new record is created in the specified ServiceNow table if no matching asset is found. When disabled, the query is skipped for an asset if a required Axonius field is missing. The system uses only the first result from each query, even if multiple matches are found.

  • Source table fields to Destination table fields mapping - Define in JSON format how to transfer data from the enrichment query results to the newly created asset. The key is the field from the source table; the value is the corresponding field in the destination table.

    JSON

    {"source_table_field": "dest_table_field", "source_table_field_2": "dest_table_field_2"}

• Skip asset creation if the asset already exists in ServiceNow - When selected, Axonius queries ServiceNow before creating an asset. If the asset already exists (based on the non-empty mapped keys from Map Axonius fields to ServiceNow fields and the CMDB CI table name), it will not be created again. This only applies to main asset creation when IRE is not used.

• Asset payload static data - When using IRE, use this field to add static, predefined key-value pairs directly to the asset payload's root level that will be sent to the ServiceNow Identification and Reconciliation Engine (IRE). This is primarily used for providing IRE-specific metadata, such as the discovery source, that doesn't fit into the standard field mapping.

  • Example: To define Axonius as the discovery source for all created assets, enter the following JSON:
  JSON

  {"sys_object_source_info": {"source_name": "Axonius"}}

  The result will be:

  JSON

  {
    "items": [
      {
        "className": "cmdb_ci_computer",
        "lookup": [],
        "values": {here are the asset fields},
        "sys_object_source_info": {
          "source_name": "Axonius"
        }
      }
    ],
    "relations": [here are the relations]
  }

Related Asset and IRE Configuration

Use these settings to create and manage assets related to the main asset. For instance, you can create a new software asset and link it to its host computer.
The Identification and Reconciliation Engine (IRE) fields in this section are optional.

• Use Identify Reconcile Discovery Source to create asset and related assets - Creates the asset using the Identification and Reconciliation (IdentifyReconcile) API. The supplied value is used as the source for the newly created asset. This is the recommended method as it minimizes the creation of duplicate Configuration Items (CIs) and reconciles CI attributes by only accepting information from authorized sources. It is recommended to use Axonius as the source value.

  • If not supplied, the asset is created via the Table API, and the CMDB will be updated directly.

• Create virtual related assets if VM data exists - Enable this option to create a separate related asset for each virtual machine. Configure the virtual machine asset in the Related Assets Configurations section below. The Related asset table name field must be empty.

• Create cloud related assets if Cloud data exists - Enable this option to create a separate related asset for each cloud instance. Configure the cloud asset in the Related Assets Configurations section below. The Related asset table name field must be empty.

Related Assets Configuration

Create related assets in addition to the main asset. Click + Add related asset configuration for each related asset you want to configure.

Related Asset

• Related asset table name - When creating a non-virtual or non-cloud asset, enter the exact name of the ServiceNow table where the new related asset record will be created (for example, cmdb_ci_web_server, cmdb_ci_network_device). When creating a VM or cloud-related asset, leave this field empty.

• Asset Internal ID (IRE) - Used to configure relations or references between related assets. May be omitted if not needed. If used, it must be unique.

• Related asset creation method - Select between IRE, Table, insertMultiple, and Main Asset Lookup List.

  • When you select insertMultiple, the Related asset table name must extend sys_import_set_row.
  • When you select Main Asset Lookup List and an IRE endpoint exists, the related asset will be added to the main asset's lookup field rather than created as a separate asset.

• Split related assets by complex field - Enable this option to create a separate related asset for each item in a specified list field within a single payload. For example, if a payload for a single server contains a network_interfaces list field with three entries, the system creates three separate network interface assets, each using the data from its corresponding list item.

  • Filter related assets by field - When Split related assets by complex field is enabled, filter the items using:
    • Axonius field - Select an adapter and the field to filter by.
    • Filter type - Select the type of filter.
    • Filter value - Enter the value to filter for.
    • Click + to configure multiple filters. Only related assets that match all filters are created (AND logic).

• Related asset fields with static data - Set specific, non-changing values for fields on the related asset. Any field set here will be overridden if it is also included in the ServiceNow related asset fields mapping section, which takes precedence.

• ServiceNow related asset fields mapping - Use the Field Mapping Wizard to map Axonius fields to fields on the related asset in ServiceNow.

  📘

  Note

  • For details, see Axonius to External Field Mapping.
  • When Fetch dynamic dropdown values is enabled for the ServiceNow adapter connection, the Field Mapping Wizard automatically displays live IRE field names from ServiceNow.

• Skip creating related asset if first "ServiceNow related asset fields mapping" mapped field value is empty - Enable this option to prevent the creation of a related asset if the first mapped field in the ServiceNow related asset fields mapping section contains no value. This prevents creating incomplete records in your CMDB.

• Specify related asset referenced field names that must be translated to sys_id - Enter the field names of the related asset whose display values you want to translate to sys_id. For example, reference fields in the ServiceNow related asset fields mapping or in the Related asset fields with static data.

• Main Asset fields to append when creating related asset - Appends the fields from the main asset to the related asset values.

• Update exists related assets (Table API only) - Enable this option for Axonius to look up existing assets in the specified ServiceNow table, using the fields listed in Asset unique key identifiers. If one asset is found, it is updated. If more than one asset is found, no action is performed. This prevents creating duplicate assets.

• Asset unique key identifiers - Specify the ServiceNow field names (for example, name, serial_number, mac_address) that, when combined, form a unique identifier for the asset. Axonius uses the values of these fields from the incoming asset data to query the target ServiceNow table. If a match is found, the existing record is updated. If no match is found, a new record is created. Press Enter to add each field as a new entry.

• IRE Relations or Reference configuration - Configure CMDB relationships or reference fields between assets. Click + Add Relationship to define a new relation. For CMDB relations, use types with :: (for example, Runs on::Runs). For reference fields, use the field name without :: (for example, cmdb_ci).

  • Relation Direction - Specifies the direction of the relationship between assets:
    • Other Asset::This Asset - The main (or other) asset is the source. For example, a server hosts a website.
    • This Asset::Other Asset - The related asset is the source. For example, an application runs on a server.
  • Internal ID (IRE) - Used to identify the "Other Related Asset" when using relevant relation direction types. Can only be used with IRE. Leave empty to point to the Main Asset. When Split related assets by complex field is used and both directions are generated, both adapter fields must be the same length.
  • Relation Type or Reference field name - Select or enter the specific nature of the relationship:
    • Runs on::Runs - Describes a process or application that executes on another asset.
    • Hosted on::Hosts - Describes a hosting relationship where one asset provides a platform for another.
    • cmdb_ci or asset - Reference field name pointing to the referred asset.

Additional Fields

These fields are optional.

• Number of parallel requests (default: 10) - Controls the maximum number of requests sent to ServiceNow simultaneously. The system only applies this limit when the total number of tasks exceeds the limit.

• Perform bulk insert (insertMultiple) - Select this option to insert multiple assets into ServiceNow in a single bulk operation.

  📘

  Note

  • This option cannot be used with the Use full URL for device creation or Use Identify Reconcile Discovery Source to create asset and related assets options.
  • When using this option, the table name configured in CMDB CI table name must extend the sys_import_set_row table in ServiceNow.

• Exclude connections - Enable this option to prevent the action from querying assets from a list of selected connections. This is useful for filtering out data from specific sources when creating assets.

Legacy Options

These options are retained for backward compatibility with existing saved actions. For new enforcement actions, use the Map Axonius fields to ServiceNow fields component in the Main Asset Configuration tab.

• Add last seen aggregated field details name if it was input in the previous mapping - Configure this option to enrich an aggregated field in Axonius with additional details from a ServiceNow field.

  • Click + to add values.
  • In the ServiceNow Key field, enter the name of the ServiceNow field to reference (for example, serial_number, device_status).
  • In the ServiceNow Value field, enter the name of the corresponding Axonius field.

• Send True/False as boolean values - Enable this option to send True/False values from Axonius to ServiceNow as a standard Boolean data type (true or false). When not enabled, these values may be sent as text strings ("True" or "False"), which ServiceNow may not interpret correctly.

• Convert Preferred Total RAM (GB) to MB - Select to convert the total RAM value from GB to MB before it is sent to ServiceNow. Use this when the corresponding field in your ServiceNow CMDB is configured to store data in MB.

• Use first IP address only - Select this option to send only the first IP address from the Axonius device record to the ServiceNow asset. When not selected, all IP addresses are added, separated by the specified IP addresses delimiter.

• IP addresses delimiter (default: /) - Specify the character to use between multiple IP addresses added to a ServiceNow asset.

• Use first MAC address only (default: enabled) - Enable this option to ensure that only the first MAC address from the Axonius record is added to the ServiceNow asset. When disabled, all MAC addresses are added, separated by the specified MAC addresses delimiter.

• MAC addresses delimiter (default: /) - Specify the character to use between multiple MAC addresses added to a ServiceNow asset.

• CIDR exclude list - Specify a comma-separated list of CIDRs to exclude from the data sent to ServiceNow. Any IP address within the specified ranges will be ignored.

• CIDR include list - Specify a comma-separated list of CIDRs to include. Only IP addresses within the specified ranges are sent to ServiceNow.

• Do not map default Axonius fields (default: enabled for new actions) - By default, new actions do not automatically map the standard Axonius fields (such as hostname, serial_number, and mac_addresses) to corresponding ServiceNow fields. Disable this option only if you want Axonius to apply its built-in default field mapping in addition to any mapping configured in Map Axonius fields to ServiceNow fields. For details, see Default Field Mapping.

• Create devices in Axonius - Select this option to also create a corresponding device record in the Axonius platform using the data being sent to ServiceNow. Only relevant when not using IRE and related assets configurations.

• Create ServiceNow asset for each installed software - Select this option to automatically create a new ServiceNow asset for each software application installed on the device.

  • By default, the enforcement action creates only a single asset for the main device.
  • When enabled, a new related asset is also created for each installed software application, linked to the main device asset.

• Assure uniqueness of created software assets - When both this option and Create ServiceNow asset for each installed software are selected, a new software asset will not be created if a matching software asset was already created in the same batch. This prevents duplication within a single enforcement run.

Required Permissions

The ServiceNow user configured for this action must have the necessary roles to interact with the CMDB.

• For the IdentifyReconcile API - The ServiceNow user must have either the itil or asset role to use this API.
• For the Table API - If you are not using the IdentifyReconcile API, the user must have the necessary permissions to write directly to the target table. This generally requires the itil or admin role.