Configure overview security metrics

  • Release version: Zurich
  • Updated June 24, 2026
  • 4 minutes to read

    • If you have external AI agent data you want reflected in the Privileged AI agents metric, set up a Traceloop connection to the external AI server and perform other setup to make sure agent data appears in the metric. Or, set up a static connection for Amazon Web Services (AWS) or Azure.

    Before you begin

    Role required: AI Control Tower admin [sn_ai_observe.ai_observability_admin]

    About this task

    You can configure your data connection for the Privileged AI agents metric using trace-based analysis configuration which connects to any third-party AI system vendor. A trace-based configuration is more dynamic than a static analysis configuration.

    Or, you can configure your connection using the static analysis configuration, which is more deterministic than a trace-based configuration. Only Azure and AWS connections are supported.

    Static (metadata-based) analysis configuration (AWS and Azure only)

    Azure Foundry AI agents shown in the Privileged AI agents metric are agents whose project identities hold high-risk Azure roles (owner, contributor, or custom-defined roles). There are two default Azure privileged roles: owner and contributor. If you have other high-risk Azure roles, you can add them to a privileged role definitions list so that AI Control Tower can monitor and surface agent data tied to those roles in the Privileged AI agents metric.

    As a prerequisite, in Azure set up a connection alias named “Azure IAM for AICT-AISP” with credentials that have read access to Azure Management APIs.
    Note:
    The service principal used for the credential must have read access to query Azure role definitions and role assignments. Specifically, Microsoft.Authorization/roleAssignments/read and Microsoft.Authorization/roleDefinitions/read.
    You can also show AWS Bedrock AI agents in the Privileged AI agents metric. As prerequisites, you must have an AWS account configured for your instance, enable AiSP AWS IAM Privileged Policy Checker, and add its connection for AWS. Also, confirm the following are in place:
    • An active MID Server installed and configured in your ServiceNow instance.
    • Cloud credentials for authenticating ServiceNow to your cloud provider.
    • The AWS region where your AI agents are deployed.

    Procedure

    1. Navigate to All > AI Control Tower > Settings > Integrations > Traces.
    2. Select Add.
    3. Select your cloud provider, then select Continue.

      Supported cloud providers:

      • AWS AgentCore
      • Azure Foundry
    4. Fill in the trace connection fields.
      Table 1. Trace connection form fields
      Field Description
      Name Descriptive name for this trace connection. Used when reviewing collection status, troubleshooting, or managing multiple connections.
      Credential Cloud provider credentials for authenticating trace collection. If the credential does not appear in the list, verify it has been created in the ServiceNow Credentials module.
      Collection frequency (minutes) Interval, in minutes, at which the MID Server polls the cloud provider to collect new trace data. Collecting traces more frequently increases cost.
      MID Server MID Server that executes trace collection from the cloud provider. The MID Server must have a status of Active and be validated before proceeding.
      AWS region AWS region where your AI agents are deployed. Applies to AWS AgentCore connections only.
    5. Select Save.

    Trace-based analysis configuration (vendor-agnostic)

    Before you begin

    Role required: AI Control Tower admin [sn_ai_observe.ai_observability_admin]

    External AI systems require trace data so it can be shown in the Privileged AI agents metric. Unlike ServiceNow AI systems, which are automatically instrumented, external AI systems must be connected to send trace data to AI Control Tower.

    There are two ways to establish this connection:
    • SDK instrumentation: Instrument your AI agent code using the Traceloop SDK and authenticate with an API key. Use this method for any third-party AI agent framework that is not hosted on a supported cloud hyperscaler.
    • Hyperscaler trace connection: Connect directly to AWS, GCP, or Azure through cloud credentials and a MID Server. Use this method when your AI agents run on a supported cloud platform. No API key or code instrumentation is required.

    Procedure

    1. Configure a trace connection for your external AI system.
      For more information, see Configuring trace connections.
    2. Generate an API key to authenticate trace data requests from your external AI system.
      1. Navigate to All > Connections & Credentials > Credentials.
      2. Create credentials of type API Key Credentials.
        Fill out these fields and select Submit.
        Table 2. API Key form fields
        Field Description
        Name Traceloop API Key
        Applies to All MID servers
        Active Selected.
        Order 100
        API Key Header Authorization
        API Key Prefix Bearer
        API Key [Your Traceloop API key]
        Credential alias Locked.
      For more information, see API key credentials.
    3. Link the API key to your trace connection.
      1. Navigate to All > Connections & Credentials > Connections.
      2. From the connections list, select the Traceloop Warehouse connection.
        Fill out these fields and select Update.
        Table 3. HTTP(s) Connection form fields
        Field Description
        Name Traceloop Warehouse
        Active Selected.
        Credential Traceloop API Key (from step 2b)
        Domain global
        Connection alias sn_ai_security.Traceloop_API
        URL builder N/A
        Connection URL https://api.traceloop.com
        Use MID server N/A
        Connection timeout N/A

        The scheduled job will now automatically pull privileged AI agent data from the linked Traceloop environment.

      For more information, see Create an HTTP(s) connection.
    4. Configure the Traceloop SDK in your agent code by adding these ServiceNow attributes when initializing Traceloop.
      These are unique user-defined identifiers for tracking.
      Traceloop.init(
    app_name="your_agent_name",
    api_key=traceloop_api_key,
    resource_attributes={
        "sn.aict.system.id": "your_agent_system_id",
        "sn.aict.system.name": "your_agent_name",
        "sn.aict.system.version": "1.0.0",
        "sn.aict.system.source": "your_source"
    }
)
      For more information about configuring Traceloop in your agent, see Traceloop - Guardrails.
    5. Make sure that the AiSP AWS IAM Privileged Policy Checker AI skill is enabled.
      For more information, see Activate an AI skill.
    6. To add custom roles for Azure Foundry agents, navigate to All > AI Security and Privacy > Privileged Role Definitions.
      1. In the External Role ID field, enter the Azure role name of the custom role that your organization considers to be privileged.
      2. Select Update.
      Return to the AI Control Tower Security tab and refresh the page. Select the Overview tab and verify that Privileged AI agents metric is populated.