AI Service Graph Connector for Snowflake

The AI Service Graph Connector for Snowflake enables you to discover and import AI assets from your Snowflake environment into ServiceNow AI Control Tower.

The connector integrates with your Snowflake account to catalog AI systems, agents, models, and prompts. Usage data is automatically collected and populated into the AI Control Tower value dashboard, providing comprehensive visibility and governance of your AI operations.

Key capabilities:

• Automated discovery of Cortex agents and models.
• Fine-tuning job monitoring and metadata capture.
• AI asset lineage and dependency tracking.
• Usage analytics and session monitoring.
• Integration with ServiceNow CMDB for comprehensive asset management.
• Support for multi-account Snowflake deployments.

Download apps from the Store

Visit the ServiceNow store website to download the AI Service Graph Connector for Snowflake application.

Supported ServiceNow versions

Release	Status
Australia	Supported
Zurich	Supported

User Roles

You must have one of the following roles assigned.

Required Roles
sn_ai_disc.discovery_admin
sn_cmdb_int_util.sgc_admin

ServiceNow Prerequisites

Complete the following setup steps once when configuring the connector for the first time.

Note:

Updating data source access and clear cache is a prerequisite that needs to be completed only once, when setting up a new instance for the first time.

Update Data Source Access

The connector requires write permissions to the Data Source table to create data sources.

To enable data source creation:

1. Select Global from the application picker.
2. Navigate to Application Access.
3. Select the Can create, Can update, and Can delete check boxes.
4. Select Update.
5. Switch to the connector application scope.

Clear cache

Clear the cached data for the Data Source and Tables.

To clear the cache:

1. Navigate to System Definition > Background Scripts.
2. Enter the following script in the Run Script text box:

   GlideTableManager.invalidateTable('sys_data_source');
   GlideCacheManager.flushTable('sys_data_source');
   GlideTableManager.invalidateTable('sys_db_object');
   GlideCacheManager.flushTable('sys_db_object');
   

3. Select Run Script.
   Note:

   The script might take several minutes to complete. After completion, switch to the connector application scope.
4. After completion, switch to the connector application scope.

Snowflake Prerequisites

To configure a Snowflake service user for Key-Pair Authentication instead of a Programmatic Access Token (PAT), generate an RSA key pair and assign the public key to a Snowflake user profile.

Verify that the user's Authentication Policy allows key-pair connections.

Complete the following configuration steps in your Snowflake environment before creating a connection.

Network Configuration

Note:

The outbound integration IP addresses for your ServiceNow instance must be allowed in your Snowflake network policies. See How to find IP address and datacenter information for your instance [KB0538621] article in the Now Support Knowledge Base to find the Source address used for integrations into customer network IP address range.

Account Identifier Format

Note:

The Snowflake Statements API requires account identifiers in LDF (Lowercase-Digit-Hyphen) format in the connection URL. Account identifiers with uppercase letters or special characters must be converted to lowercase or replaced with the account locator.

We should always use the following format for connection url:

• https://<account_identifier>.snowflakecomputing.com
• If account identifier contains uppercase letters or special characters, use your account locator in connection URL as follows https://<account_locator>.snowflakecomputing.com

If your account identifier contains uppercase letters or special characters, use your account locator (for example, xy12345) instead. Your account locator is always LDF-safe.

Service Account and Role Configuration

Create a dedicated service account in Snowflake with least-privilege access. The connector requires specific permissions to query Cortex agents, models, and observability data.

Create a Role with Required Privileges

Create role for the connector and grant the following privileges:

Core Discovery Access:

• GRANT USAGE ON DATABASE <database_name>
• GRANT USAGE ON SCHEMA <schema_name>

Cortex access

• GRANT MANAGE ACCOUNTS
• GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER

Create a Service Account

Create a service account user and assign the connector role:

• CREATE USER <service_account_name> TYPE=SERVICE
• GRANT ROLE <connector_role> TO USER <service_account_name>
• ALTER USER <service_account_name> SET DEFAULT_WAREHOUSE = <warehouse_name>

Configure JWT Key-Pair Authentication

The connector uses JWT key-pair authentication to securely connect to Snowflake.

For detailed steps on generating RSA key pairs and configuring key-pair authentication in Snowflake, see Configuring Keystore for Snowflake Keypair authentication [KB2834688] article in the Now Support Knowledge Base.

Data Mapping

The connector maps Snowflake AI assets to ServiceNow CMDB tables and custom tables for comprehensive asset management.

Data Source	Import Set Table	Target Table(s)
SG-Snowflake Agents	sn_ai_disc_sgc_sno_sgc_snowflake_agents	cmdb_ci_function_ai cmdb_ci_ai_model_deployment cmdb_ai_model_product_model cmdb_ai_dataset_product_model cmdb_ai_prompt_product_model cmdb_ai_system_component_product_model alm_ai_model_digital_asset alm_ai_dataset_digital_asset alm_ai_system_digital_asset cmdb_ci_ai_model_deployment cmdb_rel_ci sn_ai_disc_ai_lineage sn_ai_disc_ai_tool sn_ai_disc_ai_prompt sn_ai_disc_ai_usage sn_ent_ai_system_subcomponent_m2m
SG-Snowflake Usage	sn_ai_disc_sgc_sno_sgc_snowflake_usage	sn_ai_disc_ai_usage