--- sourceDocument: Zurich Enable AI sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/intelligent-experiences Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Enable AI ft:clusterId : - platai bundleId : - platai workflow : - Platform --- # Snowflake # AI Service Graph Connector for Snowflake {#ariaid-title1} * Release version: Zurich * * Updated May 1, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read The AI Service Graph Connector for Snowflake enables you to discover and import AI assets from your Snowflake environment into ServiceNow AI Control Tower. The connector integrates with your Snowflake account to catalog AI systems, agents, models, and prompts. Usage data is automatically collected and populated into the AI Control Tower value dashboard, providing comprehensive visibility and governance of your AI operations. Key capabilities: * Automated discovery of Cortex agents and models. * Fine-tuning job monitoring and metadata capture. * AI asset lineage and dependency tracking. * Usage analytics and session monitoring. * Integration with ServiceNow CMDB for comprehensive asset management. * Support for multi-account Snowflake deployments. {#ai-service-graph-connector-for-snowflake__ul_ols_zrs_mjc} ## Download apps from the Store {#ai-service-graph-connector-for-snowflake__section_wds_dhj_m3c} Visit the ServiceNow store website to download the [AI Service Graph Connector for Snowflake](https://store.servicenow.com/store/app/d637f5ab47e84f90d0e19fe1516d43e2) application. ## Supported ServiceNow versions {#ai-service-graph-connector-for-snowflake__section_czc_fhj_m3c} {#ai-service-graph-connector-for-snowflake__table_iqv_hss_mjc__entry__2} | Release | Status | |-|-| | Australia | Supported | | Zurich | Supported | [ ] {#ai-service-graph-connector-for-snowflake__table_iqv_hss_mjc} ## User Roles {#ai-service-graph-connector-for-snowflake__section_c33_hhj_m3c} You must have one of the following roles assigned. {#ai-service-graph-connector-for-snowflake__section_c33_hhj_m3c__entry__1} | Required Roles | |-| | sn_ai_disc.discovery_admin | | sn_cmdb_int_util.sgc_admin | [ ] ## ServiceNow Prerequisites {#ai-service-graph-connector-for-snowflake__section_lck_s4k_cjc} Complete the following setup steps once when configuring the connector for the first time. Note: Updating data source access and clear cache is a prerequisite that needs to be completed only once, when setting up a new instance for the first time. Update Data Source Access: The connector requires write permissions to the Data Source table to create data sources. To enable data source creation: 1. Select Global from the application picker. 2. Navigate to Application Access. 3. Select the Can create, Can update, and Can delete check boxes. 4. Select Update. 5. Switch to the connector application scope. {#ai-service-graph-connector-for-snowflake__ol_sgt_yts_mjc} Clear the cached data for the Data Source and Tables. To clear the cache: 1. Navigate to System DefinitionBackground Scripts. 2. Enter the following script in the Run Script text box: GlideTableManager.invalidateTable('sys_data_source'); GlideCacheManager.flushTable('sys_data_source'); GlideTableManager.invalidateTable('sys_db_object'); GlideCacheManager.flushTable('sys_db_object'); 3. Select Run Script. Note: The script might take several minutes to complete. After completion, switch to the connector application scope. {#ai-service-graph-connector-for-snowflake__ol_hbc_mq2_wjc} ## Snowflake Prerequisites {#ai-service-graph-connector-for-snowflake__section_g1c_pvs_mjc} Complete the following configuration steps in your Snowflake environment before creating a connection. To set up a Snowflake service user with Key-Pair Authentication in place of a Programmatic Access Token (PAT), generate an RSA key pair, associate the public key with the Snowflake user profile, and verify that the user's [Authentication Policy](https://docs.snowflake.com/en/user-guide/key-pair-auth) permits key-pair connections. Network Configuration Note: The outbound integration IP addresses for your ServiceNow instance must be allowed in your Snowflake network policies. See [How to find IP address and datacenter information for your instance \[KB0538621\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB0538621) article in the Now Support Knowledge Base to find the Source address used for integrations into customer network IP address range. Snowflake Connection URL Format Note: The Snowflake Statements API requires account identifiers in LDF (Lowercase-Digit-Hyphen) format in the connection URL. Account identifiers with uppercase letters or special characters must be converted to lowercase or replaced with the account locator. When configuring a connection to Snowflake, use the following URL format:{#ai-service-graph-connector-for-snowflake__section_g1c_pvs_mjc__entry__2} | Format | URL | |-|-| | Standard Format | https://\.snowflakecomputing.com | | Account Identifier with Uppercase Letters or Special Characters. Note: If your account identifier contains uppercase letters or special characters, use your account locator instead. | https://\.snowflakecomputing.com | [Table 1. URL Format Table] Examples: * Standard account identifier: https://xy12345.snowflakecomputing.com * Account identifier with special characters:https://abc-def_123.snowflakecomputing.com → use locator instead → https://xy98765.snowflakecloudcomputing.com Finding Your Account LocatorYour account locator is an alphanumeric string (without special characters) provided by Snowflake. If you need to find this value, check your Snowflake account documentation or reach out to your Snowflake administrator for assistance. ## Service Account and Role Configuration {#ai-service-graph-connector-for-snowflake__section_p24_vws_mjc} Create a dedicated service account in Snowflake with least-privilege access. The connector requires specific permissions to query Cortex agents, models, and observability data. Create a Role with Required Privileges Create role for the connector and grant the following privileges: Core Discovery Access: * GRANT USAGE ON DATABASE \ * GRANT USAGE ON SCHEMA \ {#ai-service-graph-connector-for-snowflake__ul_apq_1xs_mjc} Cortex access Cortex access: * GRANT MANAGE ACCOUNTS * GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER {#ai-service-graph-connector-for-snowflake__ul_v5g_jxs_mjc} Create a Service Account Create a service account user and assign the connector role: * CREATE USER \ TYPE=SERVICE * GRANT ROLE \ TO USER \ * ALTER USER \ SET DEFAULT_WAREHOUSE = \ {#ai-service-graph-connector-for-snowflake__ul_tbm_4xs_mjc} Configure JWT Key-Pair Authentication The connector uses JWT key-pair authentication to securely connect to Snowflake. For detailed steps on generating RSA key pairs and configuring key-pair authentication in Snowflake, see [Configuring Keystore for Snowflake Keypair authentication \[KB2834688\]](https://hi.service-now.com/kb_view.do?sysparm_article=KB2834688) article in the Now Support Knowledge Base. ## Data Mapping {#ai-service-graph-connector-for-snowflake__section_nv4_lmr_djc} The connector maps Snowflake AI assets to ServiceNow CMDB tables and custom tables for comprehensive asset management. |-|-|-| | Data Source | Import Set Table | Target Table(s) | | SG-Snowflake Agents | sn_ai_disc_sgc_sno_sgc_snowflake_agents | cmdb_ci_function_ai cmdb_ci_ai_model_deployment cmdb_ai_model_product_model cmdb_ai_dataset_product_model cmdb_ai_prompt_product_model cmdb_ai_system_component_product_model alm_ai_model_digital_asset alm_ai_dataset_digital_asset alm_ai_system_digital_asset cmdb_ci_ai_model_deployment cmdb_rel_ci sn_ai_disc_ai_lineage sn_ai_disc_ai_tool sn_ai_disc_ai_prompt sn_ai_disc_ai_usage sn_ent_ai_system_subcomponent_m2m | | SG-Snowflake Usage | sn_ai_disc_sgc_sno_sgc_snowflake_usage | sn_ai_disc_ai_usage | [ ] *[\>]: and then