question Re: Discovery Credential check automatically in ITOM forum

Discovery Credential check automatically

shubhamverm6594 — Thu, 26 Dec 2024 07:26:18 GMT

Hi All,

I have a requirement to automate the process to check the Discovery credential automatically and create a corresponding task in sc_task table.

I create one flow and check the record in IP affinitity table but it's not working as expected, Some time credentials not having any IP affinity record but still credentials are working fine.

Please check flow chart in attachment.

Re: Discovery Credential check automatically

shubhamverm6594 — Thu, 26 Dec 2024 08:59:49 GMT

Hi All,

If anyone have any idea, please guide me to accomplish above requirement.

Thanks,

Shubham Verma

Re: Discovery Credential check automatically

Runjay Patel — Thu, 26 Dec 2024 09:18:57 GMT

Hi @shubhamverm6594 ,

I didnt get your use case, explain little more which you are trying to achieve.

Re: Discovery Credential check automatically

shubhamverm6594 — Thu, 26 Dec 2024 09:29:06 GMT

Hi @Runjay Patel,

Thank you for your response and for your insightful videos—they’ve been really helpful!

I’d like to discuss an implement to our Discovery process regarding the credential table we are using for authentication. Given that organizations have policies for credential rotation, it’s crucial that we have a systematic approach in place.

The requirement is to ensure that when any credentials are reset in the future, the Discovery Admin should receive an email notification. Alongside this, a task should be created for that specific credential to track the changes and ensure discovery working as expected.

Could we discuss how to implement this feature?

Thanks

Shubham Verma

Re: Discovery Credential check automatically

Runjay Patel — Thu, 26 Dec 2024 10:37:03 GMT

Hi @shubhamverm6594 ,

You can create a BR rule and fire event to send notification. Follow below steps.

Create an event based notification.
Create a after update BR and use below logic.

if (current.password != previous.password || current.auth_key != previous.auth_key || current.certificate != previous.certificate) { // Notify the Discovery Admin gs.eventQueue(‘event.name’, current, parm1, parm2); // Create a task for tracking var task = new GlideRecord('task'); // Use 'task' or a specific table for tracking task.initialize(); task.short_description = "Verify updated credential: " + current.name; task.description = "The credential '" + current.name + "' was updated. Verify that Discovery is working correctly with the new details."; task.assigned_to = "discovery_admin"; // Replace with appropriate user or group task.insert(); }

-------------------------------------------------------------------------

If you found my response helpful, please consider selecting "Accept as Solution" and marking it as "Helpful." This not only supports me but also benefits the community.

Regards
Runjay Patel - ServiceNow Solution Architect
YouTube: https://www.youtube.com/@RunjayP
LinkedIn: https://www.linkedin.com/in/runjay

-------------------------------------------------------------------------

Re: Discovery Credential check automatically

shubhamverm6594 — Thu, 26 Dec 2024 10:47:09 GMT

Hi @Runjay Patel ,

Thanks for your response, I'm curious suppose if the password is not updated in the ServiceNow instance but is updated on the target machine, will it still work as expected or will there be issues accessing the target machine?

Re: Discovery Credential check automatically

Runjay Patel — Thu, 26 Dec 2024 11:34:40 GMT

Hi @shubhamverm6594 ,

It will be having issue accessing that device.

Re: Discovery Credential check automatically

shubhamverm6594 — Thu, 26 Dec 2024 12:06:30 GMT

Hi @Runjay Patel,

Then I think above code not working as per requirement.

Because if the credential are not working then task will be created for that credential to update with new credential.

Re: Discovery Credential check automatically

Runjay Patel — Thu, 26 Dec 2024 12:57:45 GMT

Hi @shubhamverm6594 ,

On that case you can cerate BR on Discovery Log table with bellow condition, It will check if any credential fails.

short_messageSTARTSWITHCould not find any valid credentials to authenticate the target for type^ORshort_messageSTARTSWITHNo credential found for type

-------------------------------------------------------------------------

If you found my response helpful, please consider selecting "Accept as Solution" and marking it as "Helpful." This not only supports me but also benefits the community.

Regards
Runjay Patel - ServiceNow Solution Architect
YouTube: https://www.youtube.com/@RunjayP
LinkedIn: https://www.linkedin.com/in/runjay

-------------------------------------------------------------------------

Re: Discovery Credential check automatically

shubhamverm6594 — Tue, 31 Dec 2024 06:36:49 GMT

Hi @Runjay Patel ,

Thank you for your quick responses regarding recent requirement. I’d like to delve deeper into the last suggestion.

Is it possible to specifically target actual credentials that do not possess valid passwords? As I understand it, discovery may utilize a HIT & TRY method to identify devices.

Looking forward to your insights on this matter.

Thanks & Regards,

Shubham Verma

Re: Discovery Credential check automatically

Runjay Patel — Tue, 31 Dec 2024 06:43:00 GMT

Hi @shubhamverm6594 ,

Yes discovery will try if there IP affinity record present for IP. but you will get error as you had changes the system password.

-------------------------------------------------------------------------

If you found my response helpful, please consider selecting "Accept as Solution" and marking it as "Helpful." This not only supports me but also benefits the community.

Regards
Runjay Patel - ServiceNow Solution Architect
YouTube: https://www.youtube.com/@RunjayP
LinkedIn: https://www.linkedin.com/in/runjay

-------------------------------------------------------------------------

Re: Discovery Credential check automatically

shubhamverm6594 — Tue, 31 Dec 2024 07:22:10 GMT

Hi @Runjay Patel ,

Got it!!
But we have 500+ passwords stored in a table and I need to update the credentials that have expired without affecting others, so how to identify expired credentials effectively?

If you have some time available, I would like to discuss a few matters with you over a call. Please let me know your availability, and I will do my best to accommodate.

Looking forward to hearing from you soon.