Network Intrusion Detection System (NIDS) CI extension class

  • Release version: Yokohama
  • Updated October 20, 2025
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Network Intrusion Detection System (NIDS) CI extension class

    The Network Intrusion Detection System (NIDS) [cmdbcinids] class in ServiceNow extends the CMDB to model passive network monitoring appliances and their detected devices. It enables the creation of "detects::detected by" relationships between NIDS sensors and discovered network devices, supporting comprehensive network visibility.

    Show full answer Show less

    The NIDS Manager oversees the sensors that detect devices and build these relationships. This class extension is part of the CMDB CI Class Models app, which adds extended class models, identification rules, and dependent relationships to the CMDB hierarchy. These extensions integrate with Discovery and Service Mapping Patterns to populate CIs and detect technologies and software.

    Key Features

    • New CMDB class: The cmdbcinids class extends cmdbciidsnetwork to represent network intrusion detection systems.
    • Class columns: Important attributes added include:
      • NIDS source ID (correlationid): Unique identifier for the NIDS device.
      • NIDS source name (nidssourcename): Name of the NIDS device.
      • Network type assignment (networktypeassignment): Designates whether the device operates on IT or OT networks.
      • NIDS assignment site (isaentitysite): Site assignment visible to users with ISA Admin role.
    • Role-based access control: The cmdbnidsadmin role grants create, read, update, and delete permissions on NIDS records and access to the Network IDS application menu.
    • Relationship management: The system builds “Detected by” relationships between NIDS records and discovered CIs, with metadata assignments including location, company, related users, and user groups.
    • OT network enhancements: For devices on OT networks, the system creates cmdbotentity records, assigns NIDS zones and site information, and integrates with the Industrial Process Manager if installed.
    • Life Cycle Stage validation: Life Cycle Stage and Status indicate sensor learning mode:
      • “Operational” with “Learning Mode” status means validation is unsuccessful.
      • “In Use” status indicates successful validation.

    Practical Benefits for ServiceNow Customers

    • Provides enhanced visibility into network security through structured representation of NIDS devices and their detected endpoints in the CMDB.
    • Enables automated relationship building between NIDS sensors and network devices, improving asset and security management.
    • Supports operational technology (OT) network asset tracking with specialized OT device records and metadata assignment.
    • Allows controlled access and management of NIDS data via dedicated roles and ACLs for security teams.
    • Integrates with Discovery and Service Mapping to enrich CMDB data and support comprehensive network and security operations.

    The Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class builds the relationships between passive network monitoring appliances, and the devices on the network that it discovers.​ A NIDS Manager manages the NIDS sensors that detect the devices and builds "detects::detected by” relationships between the NIDS records (parent) and the CIs it discovers (child).​

    The CMDB CI Class Models app adds class models that extend the CMDB class hierarchy, including class descriptions, identification rules, identifier entries, and, if applicable, dependent relationships. You can use the added classes just like any other CMDB class. Applications such as Discovery and Service Mapping Patterns can use the class extensions to populate CIs and discover technologies and software.

    This topic lists the relevant classes that the CMDB CI Class Models store app adds or updates. See the class columns table for further details about the columns added for each class.

    See the full release notes for all CMDB CI Class Models.

    Request apps on the Store

    Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

    Network Intrusion Detection System (NIDS) schema structure​

    NIDS schema structure.

    Classes

    This section lists the classes that the CMDB CI Class Models store app adds or updates.See the class columns table for further details about the columns added for each class.

    CMDB CI Class Models: Release 1.30 adds the following classes for the Network Intrusion Detection System (NIDS). For the list of classes in the base system, including classes that this app might extend, see CMDB tables descriptions.
    Class Extends Description
    Network Intrusion Detection System (NIDS) (cmdb_ci_nids) cmdb_ci_ids_network NIDS is an intrusion detection system within the network that examines the traffic from all devices on the network. NIDS scanners build relationships between the OT network scanning appliances, and the OT devices on the network.​ An NIDS Manager manages the NIDS sensors.​

    Class columns

    CMDB CI Class Models: Release 1.30 adds the following columns to the Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class.

    Table 1. Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class
    Column label Column name Description
    NIDS source ID Correlation_id Identifier of the NIDS device. Uses the assigned Correlation ID for the NIDS as its nids_source_id.
    NIDS source name nids_source_name Name of the NIDS device.
    Network type assignment network_type_assignment Designates if the device is on an IT or OT network.
    NIDS assignment site isa_entity_site ISA site assigned to the NIDS. This information is available when the logged in user has an assigned ISA Admin role.

    Roles and Access Control Logic (ACLs)

    The NIDS Admin (cmdb_nids_admin) role is associated with the Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class: Can create, read, update, and delete Network IDS (NDIS) OT records. To view the Network IDS Application selection on the application menu, you must have this role.

    Key relationship structure

    For each CMDB CI record with a “Detected by” relationship with an NIDS record, a ServiceNow Operational Technology Certified Service Graph Connector does the following:

    1. Assigns the following NIDS-related metadata values to the CI:
      1. Location
      2. Company
      3. Related users (Owned by, Managed by, Supported by, Assigned to)
      4. Related user groups (Approval group, Managed by Group, Support group, Change group)
    2. If the NIDS network type is set to OT, it assigns the following NIDS-related metadata values to the CI:
      1. Creates an OT device (cmdb_ot_entity) record for the CI, using the cmdb_ot_entity reference on the CI.
      2. Assigns the NIDS assignment zone to the OT device record.
      3. If the Industrial Process Manager is installed, assign the NIDS assignment site to the OT device record.
    3. Life Cycle Stage and Life Cycle Stage Status values for the CI are used to capture the learning mode of a sensor.
      • If Life Cycle Stage is Operational and Life Cycle Stage Status is Learning Mode, then validation is unsuccessful.
      • If Life Cycle Stage Status is In Use, validation is successful.