---
sourceDocument: Brazil ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/servicenow-platform

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Target CMDB classes

# CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint

The Service Graph Connector for Microsoft Defender Endpoint integrates security data into ServiceNow's CMDB by periodically importing information from machines protected by Microsoft Defender for Endpoint.
The collected data populates various CMDB tables that extend from the base Configuration Item \[cmdbci\] table, enabling enhanced asset visibility and relationship mapping within your ServiceNow environment.
Show full answer Show less  

## CMDB Classes and Attributes Populated

The integration targets several key CMDB classes, each populated with specific attributes derived from Defender Endpoint data:

* **Computer \[cmdbcicomputer\]**: Attributes such as discovery source, install status, name, operating system, and OS version.
* **IP Address \[cmdbciipaddress\]**: Includes install status, IP address, IP version, name, and NIC.
* **Network Adapter \[cmdbcinetworkadapter\]**: Attributes like discovery source, install status, MAC address, and name.
* **SG-Defender Machines Related \[sndefenderintegsgdefendermachinesrelated\]**: Captures security-specific details including agent version, device ID, exposure level, health status, onboarding status, and more.
* **Software \[cmdbcispkg\]**: Populated when Software Asset Management (SAM) is not installed, with attributes such as key, name, and version.
* **Software Installation \[cmdbsamswinstall\]**: Populated when SAM is installed, including discovery source, display name, and version.
* **Software Instance \[cmdbsoftwareinstance\]**: When SAM is not installed, includes installed on and name attributes.
* **Windows Server \[cmdbciwinserver\]**: Attributes include class, discovery source, install status, name, OS, and OS version.

## Key Relationships Established

The connector creates important relationships between these classes to accurately represent infrastructure and software dependencies:

* **Computer** owns IP Address and Network Adapter; references related Defender machines and software installations.
* **IP Address** references Network Adapter.
* **Network Adapter** references Server, Computer, and related Defender machines.
* **Software** references Software Instance and Software Installation.
* **Software Instance** references Server and Windows Server.
* **Windows Server** owns Network Adapter and IP Address; references related Defender machines and software installations.

## Practical Benefits for ServiceNow Customers

By leveraging this connector, you can expect automated synchronization of Defender Endpoint data into your CMDB, enriching your asset records with up-to-date security and configuration information. This enhances your ability to manage IT assets, improve security posture, and maintain accurate service mappings. The detailed relationships help visualize dependencies, facilitating impact analysis and informed decision-making.  
When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item \[cmdb_ci\] table.

## Computer \[cmdb_ci_computer\] {#sgc-cmdb-msdefender-classes__section_ryj_rym_dfc}

The following attributes in the Computer \[cmdb_ci_computer\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_imw_tym_dfc__entry__2}

| Attribute label | Attribute name |
|-|-|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
[ ]

{#sgc-cmdb-msdefender-classes__table_imw_tym_dfc}{#sgc-cmdb-msdefender-classes__table_chc_5ym_dfc__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Computer \[cmdb_ci_computer\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Computer \[cmdb_ci_computer\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Computer \[cmdb_ci_computer\] | Reference | SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] |
| Computer \[cmdb_ci_computer\] | Reference | Software Installation \[cmdb_sam_sw_install\] |
[Table 1. Relationships created for Computer]

{#sgc-cmdb-msdefender-classes__table_chc_5ym_dfc}

## IP Address \[cmdb_ci_ip_address\] {#sgc-cmdb-msdefender-classes__section_c3g_zkg_fxb}

The following attributes in the IP Address \[cmdb_ci_ip_address\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_exf_hl1_4wb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Install Status | install_status |
| IP Address | ip_address |
| IP version | ip_version |
| Name | name |
| Nic | nic |
[ ]

{#sgc-cmdb-msdefender-classes__table_exf_hl1_4wb}{#sgc-cmdb-msdefender-classes__table_clf_l35_tqb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| IP Address \[cmdb_ci_ip_address\] | Reference | Network Adapter \[cmdb_ci_network_adapter\] |
[Table 2. Relationship created for IP Address]

{#sgc-cmdb-msdefender-classes__table_clf_l35_tqb}

## Network Adapter \[cmdb_ci_network_adapter\] {#sgc-cmdb-msdefender-classes__section_gy2_yx5_tzb}

The following attributes in the Network Adapter \[cmdb_ci_network_adapter\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_hy2_yx5_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Discovery source | discovery_source |
| Install Status | install_status |
| MAC Address | mac_address |
| Name | name |
[ ]

{#sgc-cmdb-msdefender-classes__table_hy2_yx5_tzb}{#sgc-cmdb-msdefender-classes__table_iy2_yx5_tzb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Network Adapter \[cmdb_ci_network_adapter\] | Reference | Server \[cmdb_ci_server\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Reference | Computer \[cmdb_ci_computer\] |
[Table 3. Relationships created for Network Adapter]

{#sgc-cmdb-msdefender-classes__table_iy2_yx5_tzb}

## SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] {#sgc-cmdb-msdefender-classes__section_ulw_455_tzb}

The following attributes in the SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] table are populated by collected data:{#sgc-cmdb-msdefender-classes__table_vlw_455_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Agent Version | agent_version |
| Device Id | device_id |
| Exposure Level | exposure_level |
| First Seen | first_seen_date |
| Health Status | health_status |
| IsAadJoined | isaadjoined |
| Last Reported | last_reported |
| Managed by | managed_by |
| Onboarding Status | onboarding_status |
[ ]

{#sgc-cmdb-msdefender-classes__table_vlw_455_tzb}

## Software \[cmdb_ci_spkg\] {#sgc-cmdb-msdefender-classes__section_bfg_zlg_fxb}

The following attributes in the Software \[cmdb_ci_spkg\] table are populated by collected data when the Software Asset Management (SAM) application isn't installed:{#sgc-cmdb-msdefender-classes__table_rhv_1wh_k5b__entry__2}

| Attribute label | Attribute name |
|-|-|
| Key | key |
| Name | name |
| Version | version |
[ ]

{#sgc-cmdb-msdefender-classes__table_rhv_1wh_k5b}{#sgc-cmdb-msdefender-classes__table_grm_dhj_k5b__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Software \[cmdb_ci_spkg\] | Reference | Software Instance \[cmdb_software_instance\] |
[Table 4. Relationship created for Software]

{#sgc-cmdb-msdefender-classes__table_grm_dhj_k5b}

## Software Installation \[cmdb_sam_sw_install\] {#sgc-cmdb-msdefender-classes__section_eqb_zgs_zxb}

The following attributes in the Software Installation \[cmdb_sam_sw_install\] table are populated by collected data when the SAM application is installed:{#sgc-cmdb-msdefender-classes__table_dgd_lx5_tzb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Discovery source | discovery_source |
| Display name | display_name |
| Version | version |
[ ]

{#sgc-cmdb-msdefender-classes__table_dgd_lx5_tzb}

## Software Instance \[cmdb_software_instance\] {#sgc-cmdb-msdefender-classes__section_vkx_22s_zxb}

The following attributes in the Software Instance \[cmdb_software_instance\] table are populated by collected data when the SAM application isn't installed:{#sgc-cmdb-msdefender-classes__table_wkx_22s_zxb__entry__2}

| Attribute label | Attribute name |
|-|-|
| Installed on | installed_on |
| Name | name |
[ ]

{#sgc-cmdb-msdefender-classes__table_wkx_22s_zxb}{#sgc-cmdb-msdefender-classes__table_xkx_22s_zxb__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Software Instance \[cmdb_software_instance\] | Reference | Server \[cmdb_ci_server\] |
[Table 5. Relationship created for Software Instance]

{#sgc-cmdb-msdefender-classes__table_xkx_22s_zxb}

## Windows Server \[cmdb_ci_win_server\] {#sgc-cmdb-msdefender-classes__section_t5m_fkx_dfc}

The following attributes in the Windows Server \[cmdb_ci_win_server\] table are populated by collected data when the SAM application isn't installed:{#sgc-cmdb-msdefender-classes__table_kjz_jkx_dfc__entry__2}

| Attribute label | Attribute name |
|-|-|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
[ ]

{#sgc-cmdb-msdefender-classes__table_kjz_jkx_dfc}{#sgc-cmdb-msdefender-classes__table_krf_kkx_dfc__entry__3}

| Parent class | Relationship type | Child class |
|-|-|-|
| Windows Server \[cmdb_ci_win_server\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Windows Server \[cmdb_ci_win_server\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Windows Server \[cmdb_ci_win_server\] | Reference | SG-Defender Machines Related \[sn_defender_integ_sg_defender_machines_related\] |
| Windows Server \[cmdb_ci_win_server\] | Reference | Software Installation \[cmdb_sam_sw_install\] |
[Table 6. Relationships created for Windows Server]

{#sgc-cmdb-msdefender-classes__table_krf_kkx_dfc}