Network Intrusion Detection System (NIDS) CI extension class
Summarize
Summary of Network Intrusion Detection System (NIDS) CI extension class
The Network Intrusion Detection System (NIDS) [cmdbcinids] class in ServiceNow models passive network monitoring appliances and their discovered devices within the CMDB. Managed by a NIDS Manager, these sensors detect devices on the network and establish “detects::detected by” relationships between the NIDS records and the discovered configuration items (CIs). This extension is part of the CMDB CI Class Models app, specifically added in release 1.30.
Show less
Key Features
- Class Structure: The cmdbcinids class extends cmdbciidsnetwork to represent NIDS appliances that monitor network traffic.
- Extended Columns: New columns introduced for the NIDS class include:
- NIDS source ID: Identifier using the Correlation ID for the NIDS device.
- NIDS source name: Name of the NIDS device.
- Network type assignment: Designates whether the device is on an IT or OT network.
- NIDS assignment site: ISA site assigned to the NIDS, visible to users with ISA Admin role.
- Roles and Access Control: The NIDS Admin (cmdbnidsadmin) role grants full CRUD permissions on NIDS OT records and access to the NIDS application menu.
- Relationship Management: The system builds relationships between NIDS devices and detected CIs, enabling visibility into device discovery and monitoring lineage.
Key Outcomes
- CIs detected by NIDS sensors are enriched with metadata such as location, company, related users, and user groups, improving asset context and governance.
- For devices on OT networks, the system automatically creates corresponding OT device records (cmdbotentity), assigns NIDS zones, and if Industrial Process Manager is present, assigns the NIDS site, enhancing operational technology asset management.
- Life cycle stage and status values are used to track sensor learning modes, ensuring accuracy in detection validation:
- “Learning Mode” status indicates ongoing sensor training and unsuccessful validation.
- “In Use” status indicates successful validation and operational readiness.
The Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class builds the relationships between passive network monitoring appliances, and the devices on the network that it discovers. A NIDS Manager manages the NIDS sensors that detect the devices and builds "detects::detected by” relationships between the NIDS records (parent) and the CIs it discovers (child).
This topic lists the relevant classes that the CMDB CI Class Models store app adds or updates. See the class columns table for further details about the columns added for each class.
See the CMDB CI Class Models release notes.
Request apps on the Store
Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Network Intrusion Detection System (NIDS) schema structure
Classes
This section lists the classes that the CMDB CI Class Models store app adds or updates.See the class columns table for further details about the columns added for each class.
| Class | Extends | Description |
|---|---|---|
| Network Intrusion Detection System (NIDS) (cmdb_ci_nids) | cmdb_ci_ids_network | NIDS is an intrusion detection system within the network that examines the traffic from all devices on the network. NIDS scanners build relationships between the OT network scanning appliances, and the OT devices on the network. An NIDS Manager manages the NIDS sensors. |
Class columns
CMDB CI Class Models: Release 1.30 adds the following columns to the Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class.
| Column label | Column name | Description |
|---|---|---|
| NIDS source ID | Correlation_id | Identifier of the NIDS device. Uses the assigned Correlation ID for the NIDS as its nids_source_id. |
| NIDS source name | nids_source_name | Name of the NIDS device. |
| Network type assignment | network_type_assignment | Designates if the device is on an IT or OT network. |
| NIDS assignment site | isa_entity_site | ISA site assigned to the NIDS. This information is available when the logged in user has an assigned ISA Admin role. |
Roles and Access Control Logic (ACLs)
The NIDS Admin (cmdb_nids_admin) role is associated with the Network Intrusion Detection System (NIDS) [cmdb_ci_nids] class: Can create, read, update, and delete Network IDS (NDIS) OT records. To view the Network IDS Application selection on the application menu, you must have this role.
Key relationship structure
For each CMDB CI record with a “Detected by” relationship with an NIDS record, a ServiceNow Operational Technology Certified Service Graph Connector does the following:
- Assigns the following NIDS-related metadata values to the CI:
- Location
- Company
- Related users (Owned by, Managed by, Supported by, Assigned to)
- Related user groups (Approval group, Managed by Group, Support group, Change group)
- If the NIDS network type is set to OT, it assigns the following NIDS-related metadata values
to the CI:
- Creates an OT device (cmdb_ot_entity) record for the CI, using the cmdb_ot_entity reference on the CI.
- Assigns the NIDS assignment zone to the OT device record.
- If the Industrial Process Manager is installed, assign the NIDS assignment site to the OT device record.
- Life Cycle Stage and Life Cycle Stage Status values for the CI are used to capture
the learning mode of a sensor.
- If Life Cycle Stage is Operational and Life Cycle Stage Status is Learning Mode, then validation is unsuccessful.
- If Life Cycle Stage Status is In Use, validation is successful.