Hi @PareshW ,
As per my understanding the Goal is
* Extend existing Windows & Linux Server discovery patterns to detect the Qualys Agent in running processes.
* If Qualys Agent is absent (i.e., previously seen but not detected now), then mark the related custom Qualys Agent CI as absent in CMDB.
Probable Solution will be :-
1. Identify the pattern to extend
* Go to:
Discovery Patterns → Find the OOB Windows Server and Linux Server patterns.
* DO NOT directly modify OOB patterns.
* Use the Extension mechanism:
* Click Create Extension → It creates a new pattern linked to the base.
2. Extend the pattern to detect Qualys Agent
* In the extension:
* Add a new process probe (for Windows & Linux separately).
* Configure it to look for process name (e.g., qualysagent, qualys-cloud-agent etc.).
* Add a Process Classification step to classify it as a Qualys Agent CI or custom CI class (cmdb_ci_qualys_agent).
3. Insert / update the CI using Identification Section
* In the same extension pattern, add an Identification Section:
* Identify Qualys Agent using process name & version, maybe host reference.
* This ensures when the agent is found, a CI record is created or updated.
4. Configure "Mark as Absent" for when the agent is missing
* Go to:
Discovery Definition → Mark as Absent Rules.
* Create a new rule:
* Class: your custom CI class (e.g., cmdb_ci_qualys_agent).
* Condition: “If not seen in last discovery run” (or older than X days).
* This rule ensures:
* When discovery doesn’t find Qualys Agent anymore, it marks the CI as absent.
* Optional: Configure Data Manager policy to delete or retire absent CIs after X days.
5. Validate the discovery
* Run discovery on test Windows & Linux servers:
* Confirm agent is detected → Qualys Agent CI created/updated.
* Remove/stop agent → Next discovery → Marked as absent.
Best Practices:
* Use extension patterns, not direct edits of OOB patterns — keeps upgrades safe.
* Keep “Mark as Absent” rules specific to custom CI classes (don’t use broad rules).
* Use naming & version fields in identification for uniqueness.
Thank You
AJ - TechTrek with AJ - ITOM Trainer
LinkedIn:- https://www.linkedin.com/in/ajay-kumar-66a91385/
YouTube:- https://www.youtube.com/@learnitomwithaj
Topmate:- https://topmate.io/aj_techtrekwithaj (Connect for 1-1 Session)
ServiceNow Community MVP 2025
