How to Configure Discovery Extension for Windows & Linux Server, Qualys Agent is discovered ?

[PareshW]

How to Configure Discovery Extension for existing Windows Server Pattern and Linux Server Pattern When Qualys Agent is Discovered in Running Processes and we need to Use 'Mark as absent" rule for Custom CI deletion?

[AJ-TechTrek]

Hi @PareshW ,

As per my understanding the Goal is

* Extend existing Windows & Linux Server discovery patterns to detect the Qualys Agent in running processes.
* If Qualys Agent is absent (i.e., previously seen but not detected now), then mark the related custom Qualys Agent CI as absent in CMDB.

Probable Solution will be :-

1. Identify the pattern to extend
* Go to:
Discovery Patterns → Find the OOB Windows Server and Linux Server patterns.
* DO NOT directly modify OOB patterns.
* Use the Extension mechanism:
* Click Create Extension → It creates a new pattern linked to the base.

2. Extend the pattern to detect Qualys Agent
* In the extension:
* Add a new process probe (for Windows & Linux separately).
* Configure it to look for process name (e.g., qualysagent, qualys-cloud-agent etc.).
* Add a Process Classification step to classify it as a Qualys Agent CI or custom CI class (cmdb_ci_qualys_agent).

3. Insert / update the CI using Identification Section
* In the same extension pattern, add an Identification Section:
* Identify Qualys Agent using process name & version, maybe host reference.
* This ensures when the agent is found, a CI record is created or updated.

4. Configure "Mark as Absent" for when the agent is missing
* Go to:
Discovery Definition → Mark as Absent Rules.
* Create a new rule:
* Class: your custom CI class (e.g., cmdb_ci_qualys_agent).
* Condition: “If not seen in last discovery run” (or older than X days).
* This rule ensures:
* When discovery doesn’t find Qualys Agent anymore, it marks the CI as absent.
* Optional: Configure Data Manager policy to delete or retire absent CIs after X days.

5. Validate the discovery
* Run discovery on test Windows & Linux servers:
* Confirm agent is detected → Qualys Agent CI created/updated.
* Remove/stop agent → Next discovery → Marked as absent.

Best Practices:
* Use extension patterns, not direct edits of OOB patterns — keeps upgrades safe.
* Keep “Mark as Absent” rules specific to custom CI classes (don’t use broad rules).
* Use naming & version fields in identification for uniqueness.

Thank You
AJ - TechTrek with AJ - ITOM Trainer
LinkedIn:- https://www.linkedin.com/in/ajay-kumar-66a91385/
YouTube:- https://www.youtube.com/@learnitomwithaj
Topmate:- https://topmate.io/aj_techtrekwithaj (Connect for 1-1 Session)
ServiceNow Community MVP 2025