Need documentation that explains why these accounts access our instances for audit: usagestat.sync@snc, instance.scanner@snc, or system@snc

[Sara3]

For audit purposes, we have a need for documentation we can point to that explains why these ServiceNow accounts access our instances:
usagestat.sync@snc
instance.scanner@snc
system@snc

Has anyone been able to get this from ServiceNow before, or can point me to a KB article possibly? Thanks!

[Kieran Anson]

I'm not aware of any documentation other than raising a support case. As a note, depending on your audit requirement, you can leverage the SNC Access Control plugin as a risk reduction measure to prevent ServiceNow from accessing your instance. SNC Access Control plugin (instance security hardening) (servicenow.com)

[Ash-ITSM]

Hi Sara, your question is now old and hopefully you've already had the answers, but the 'instance.scanner' account specifically if used for our HealthScan service, which provides benchmarking and health assessment for your platform, data, configuration and customisations. I don't believe that we have formal documentation to describe this however.