{
  "name": "ServiceNowCMDBConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "ServiceNowCMDBConnector",
      "title": "ServiceNow CMDB (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [ServiceNow CMDB Data Connector](https://www.servicenow.com/) allows ingesting Configuration Management Database (CMDB) and Asset Management records from ServiceNow into Microsoft Sentinel. This connector retrieves multiple records from the ServiceNow Table API for specified tables including Asset Management (alm_asset), Configuration Items (cmdb_ci), Computer CIs (cmdb_ci_computer), and Server CIs (cmdb_ci_server). This connector is built on the Microsoft Sentinel Codeless Connector Platform and supports DCR-based ingestion time transformations for efficient query execution. Refer to [ServiceNow Table API documentation](https://www.servicenow.com/docs/r/api-reference/rest-apis/c_TableAPI.html?section=c_TableAPI) for more information.",
      "graphQueries": [
        {
          "metricName": "Total CMDB records",
          "legend": "All CMDB Records",
          "baseQuery": "ServiceNowCmdbCi"
        },
        {
          "metricName": "Total ServiceNowAlmAsset data received",
          "legend": "ServiceNowAlmAsset",
          "baseQuery": "ServiceNowAlmAsset"
        },
        {
          "metricName": "Total ServiceNowCmdbCiServer data received",
          "legend": "ServiceNowCmdbCiServer",
          "baseQuery": "ServiceNowCmdbCiServer"
        },
        {
          "metricName": "Total ServiceNowCmdbCiComputer data received",
          "legend": "ServiceNowCmdbCiComputer",
          "baseQuery": "ServiceNowCmdbCiComputer"
        },
        {
          "metricName": "Total ServiceNowCmdbRelCi data received",
          "legend": "ServiceNowCmdbRelCi",
          "baseQuery": "ServiceNowCmdbRelCi"
        },
        {
          "metricName": "CMDB record summary",
          "legend": "CMDB Summary",
          "baseQuery": "ServiceNowCmdbCi | summarize count()"
        }
      ],
      "sampleQueries": [
        {
          "description": "Sample of 20 recent CMDB records",
          "query": "ServiceNowCmdbCi\n| take 20"
        }
      ],
      "dataTypes": [
        {
          "name": "ServiceNowAlmAsset",
          "lastDataReceivedQuery": "ServiceNowAlmAsset\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "ServiceNowCmdbCi",
          "lastDataReceivedQuery": "ServiceNowCmdbCi\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "ServiceNowCmdbCiComputer",
          "lastDataReceivedQuery": "ServiceNowCmdbCiComputer\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "ServiceNowCmdbCiServer",
          "lastDataReceivedQuery": "ServiceNowCmdbCiServer\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "ServiceNowCmdbRelCi",
          "lastDataReceivedQuery": "ServiceNowCmdbRelCi\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        },
        {
          "type": "IsConnectedQuery",
          "value": [
            "union ServiceNowAlmAsset, ServiceNowCmdbCi, ServiceNowCmdbCiComputer, ServiceNowCmdbCiServer, ServiceNowCmdbRelCi | where TimeGenerated > ago(1h) | take 1"
          ]
        }
      ],
      "availability": {
        "isPreview": true,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "1. ServiceNow Configuration",
          "description": "Configure your ServiceNow instance connection and select a CMDB table to collect.",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connector Name",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "Selected Tables",
                    "columnValue": "properties.addOnAttributes.tableName"
                  },
                  {
                    "columnName": "Instance URL",
                    "columnValue": "properties.request.apiEndpoint"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "label": "Add Connector",
                "title": "Add ServiceNow CMDB Connector",
                "subtitle": "Connect to ServiceNow CMDB",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## ServiceNow Instance\n\nProvide your ServiceNow instance URL and credentials."
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "ServiceNow Instance URL",
                          "placeholder": "https://<instance>.service-now.com",
                          "type": "text",
                          "name": "instanceUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Enter your ServiceNow instance URL (e.g., https://dev12345.service-now.com). Do not include the /api path.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Username",
                          "placeholder": "admin",
                          "type": "text",
                          "name": "username",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Password",
                          "placeholder": "Enter your ServiceNow password",
                          "type": "password",
                          "name": "password",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Basic Authentication is used.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": "## Select CMDB Tables\n\nChoose which ServiceNow CMDB tables to ingest for this connection. You can select one or more tables."
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "CMDB Tables",
                          "name": "tableName",
                          "options": [
                            {
                              "key": "alm_asset",
                              "text": "Asset Management (alm_asset)"
                            },
                            {
                              "key": "cmdb_ci",
                              "text": "Configuration Items (cmdb_ci)"
                            },
                            {
                              "key": "cmdb_ci_computer",
                              "text": "Computer CIs (cmdb_ci_computer)"
                            },
                            {
                              "key": "cmdb_ci_server",
                              "text": "Server CIs (cmdb_ci_server)"
                            },
                            {
                              "key": "cmdb_rel_ci",
                              "text": "CI Relationships (cmdb_rel_ci)"
                            }
                          ],
                          "isMultiSelect": true,
                          "defaultAllSelected": true,
                          "required": true
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Select one or more ServiceNow CMDB tables to ingest.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connector Friendly Name",
                          "placeholder": "Enter a unique friendly name for this connector",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "The friendly name helps you identify this connector in the list.",
                          "visible": true,
                          "inline": true
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
}