---
sourceDocument: Australia ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/servicenow-platform

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Target CMDB classes

# CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint

The Service Graph Connector for Microsoft Defender Endpoint integrates security data into the ServiceNow CMDB by periodically pulling information from machines using Microsoft Defender for Endpoint.
This integration populates and extends key CMDB tables related to computers, network adapters, IP addresses, software, and servers, enabling better visibility and management of endpoint security assets within ServiceNow.
Show full answer Show less  

## Key CMDB Classes and Attributes Populated

* **Computer \[cmdbcicomputer\]**: Core attributes such as discovery source, install status, name, operating system, and OS version are updated. It maintains relationships owning IP addresses and network adapters, and references related Defender machine data and software installations.
* **IP Address \[cmdbciipaddress\]**: Attributes like install status, IP address, IP version, and NIC are populated. It references network adapters to establish connectivity relationships.
* **Network Adapter \[cmdbcinetworkadapter\]**: Includes attributes such as discovery source, install status, MAC address, and name. It references servers and computers and is linked to Defender machine records.
* **SG-Defender Machines Related \[sndefenderintegsgdefendermachinesrelated\]**: Contains endpoint-specific security details including agent version, device ID, exposure level, health status, onboarding status, and management information.
* **Software \[cmdbcispkg\]**: When ServiceNow SAM is not installed, software key, name, and version are captured.
* **Software Installation \[cmdbsamswinstall\]**: When SAM is installed, this table records discovery source, display name, and version of software installations.
* **Software Instance \[cmdbsoftwareinstance\]**: Captures installation details such as installed on and name when SAM is not installed; references server and Windows Server classes.
* **Windows Server \[cmdbciwinserver\]**: Populates attributes like class, discovery source, install status, name, OS, and OS version. It owns network adapters and IP addresses and references related Defender machine and software installation records.

## Relationships and Data Integration

The connector establishes key relationships between these classes to map the configuration items accurately:

* **Computer** owns IP addresses and network adapters, and references Defender machines and software installations.
* **IP Address** references network adapters, connecting network infrastructure elements.
* **Network Adapter** references servers and computers, linking hardware components.
* **Software and Software Instances** reference installation records and servers to track software deployment.
* **Windows Server** owns network adapters and IP addresses and references Defender machine and software installation data.

## Practical Benefits for ServiceNow Customers

This integration enriches the CMDB with detailed endpoint security data, improving asset visibility and facilitating security management workflows. Customers can expect automated, accurate population of key configuration items and their relationships, supporting better incident response, compliance, and operational efficiency.  
When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item \[cmdb_ci\] table.

## Computer \[cmdb_ci_computer\] {#sgc-cmdb-msdefender-classes__section_ryj_rym_dfc}

The following attributes in the Computer \[cmdb_ci_computer\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_imw_tym_dfc__entry__2}

| Attribute label | Attribute name |
|-|-|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
[ ]

{#sgc-cmdb-msdefender-classes__table_imw_tym_dfc}{#sgc-cmdb-msdefender-classes__table_chc_5ym_dfc__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Computer \[cmdb_ci_computer\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Computer \[cmdb_ci_computer\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Computer \[cmdb_ci_computer\] | Reference | SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] |
| Computer \[cmdb_ci_computer\] | Reference | Software Installation \[cmdb_sam_sw_install\] |
[Table 1. Relationships created for Computer]

{#sgc-cmdb-msdefender-classes__table_chc_5ym_dfc}

## IP Address \[cmdb_ci_ip_address\] {#sgc-cmdb-msdefender-classes__section_c3g_zkg_fxb}

The following attributes in the IP Address \[cmdb_ci_ip_address\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_exf_hl1_4wb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Install Status | install_status |
| IP Address | ip_address |
| IP version | ip_version |
| Name | name |
| Nic | nic |
[ ]

{#sgc-cmdb-msdefender-classes__table_exf_hl1_4wb}{#sgc-cmdb-msdefender-classes__table_clf_l35_tqb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| IP Address \[cmdb_ci_ip_address\] | Reference | Network Adapter \[cmdb_ci_network_adapter\] |
[Table 2. Relationship created for IP Address]

{#sgc-cmdb-msdefender-classes__table_clf_l35_tqb}

## Network Adapter \[cmdb_ci_network_adapter\] {#sgc-cmdb-msdefender-classes__section_gy2_yx5_tzb}

The following attributes in the Network Adapter \[cmdb_ci_network_adapter\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_hy2_yx5_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Discovery source | discovery_source |
| Install Status | install_status |
| MAC Address | mac_address |
| Name | name |
[ ]

{#sgc-cmdb-msdefender-classes__table_hy2_yx5_tzb}{#sgc-cmdb-msdefender-classes__table_iy2_yx5_tzb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Network Adapter \[cmdb_ci_network_adapter\] | Reference | Server \[cmdb_ci_server\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Reference | Computer \[cmdb_ci_computer\] |
[Table 3. Relationships created for Network Adapter]

{#sgc-cmdb-msdefender-classes__table_iy2_yx5_tzb}

## SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] {#sgc-cmdb-msdefender-classes__section_ulw_455_tzb}

The following attributes in the SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_vlw_455_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Agent Version | agent_version |
| Device Id | device_id |
| Exposure Level | exposure_level |
| First Seen | first_seen_date |
| Health Status | health_status |
| IsAadJoined | isaadjoined |
| Last Reported | last_reported |
| Managed by | managed_by |
| Onboarding Status | onboarding_status |
[ ]

{#sgc-cmdb-msdefender-classes__table_vlw_455_tzb}

## Software \[cmdb_ci_spkg\] {#sgc-cmdb-msdefender-classes__section_bfg_zlg_fxb}

The following attributes in the Software \[cmdb_ci_spkg\] table are populated by collected data when the Software Asset Management (SAM) application isn't installed:{#sgc-cmdb-msdefender-classes__table_rhv_1wh_k5b__entry__2}

| Attribute label | Attribute name |
|-|-|
| Key | key |
| Name | name |
| Version | version |
[ ]

{#sgc-cmdb-msdefender-classes__table_rhv_1wh_k5b}{#sgc-cmdb-msdefender-classes__table_grm_dhj_k5b__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Software \[cmdb_ci_spkg\] | Reference | Software Instance \[cmdb_software_instance\] |
[Table 4. Relationship created for Software]

{#sgc-cmdb-msdefender-classes__table_grm_dhj_k5b}

## Software Installation \[cmdb_sam_sw_install\] {#sgc-cmdb-msdefender-classes__section_eqb_zgs_zxb}

The following attributes in the Software Installation \[cmdb_sam_sw_install\] table are populated by collected data when the SAM application is installed:{#sgc-cmdb-msdefender-classes__table_dgd_lx5_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Discovery source | discovery_source |
| Display name | display_name |
| Version | version |
[ ]

{#sgc-cmdb-msdefender-classes__table_dgd_lx5_tzb}

## Software Instance \[cmdb_software_instance\] {#sgc-cmdb-msdefender-classes__section_vkx_22s_zxb}

The following attributes in the Software Instance \[cmdb_software_instance\] table are populated by collected data when the SAM application isn't installed:{#sgc-cmdb-msdefender-classes__table_wkx_22s_zxb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Installed on | installed_on |
| Name | name |
[ ]

{#sgc-cmdb-msdefender-classes__table_wkx_22s_zxb}{#sgc-cmdb-msdefender-classes__table_xkx_22s_zxb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Software Instance \[cmdb_software_instance\] | Reference | Server \[cmdb_ci_server\] |
[Table 5. Relationship created for Software Instance]

{#sgc-cmdb-msdefender-classes__table_xkx_22s_zxb}

## Windows Server \[cmdb_ci_win_server\] {#sgc-cmdb-msdefender-classes__section_t5m_fkx_dfc}

The following attributes in the Windows Server \[cmdb_ci_win_server\] table are populated by collected data when the SAM application isn't installed:{#sgc-cmdb-msdefender-classes__table_kjz_jkx_dfc__entry__2}

| Attribute label | Attribute name |
|-|-|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
[ ]

{#sgc-cmdb-msdefender-classes__table_kjz_jkx_dfc}{#sgc-cmdb-msdefender-classes__table_krf_kkx_dfc__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Windows Server \[cmdb_ci_win_server\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Windows Server \[cmdb_ci_win_server\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Windows Server \[cmdb_ci_win_server\] | Reference | SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] |
| Windows Server \[cmdb_ci_win_server\] | Reference | Software Installation \[cmdb_sam_sw_install\] |
[Table 6. Relationships created for Windows Server]

{#sgc-cmdb-msdefender-classes__table_krf_kkx_dfc}