ServiceNow CMDB Integration

The InsightCloudSec ServiceNow Configuration Management Database (CMDB) integration provides end-to-end integration for managing cloud asset inventory and cloud configurations, synchronizing InsightCloudSec resources with Configuration Items (CIs) in the CMDB using a ServiceNow Application. This integration allows dynamic creation, management, and deletion of CIs based on the status of cloud resources in InsightCloudSec, facilitating quick assessment and response to configuration and resource changes in your cloud environments. If you have any questions or trouble setting up or using the integration, contact support.

Prerequisites

• InsightCloudSec:
  • Domain administrator permissions
• ServiceNow:
  • System administrator permissions
  • Version Utah, Vancouver, or Washington
  • Global system properties:
    • glide.http.outbound.max_timeout.enabled = false
    • glide.outbound_http_log.override.level = all
    • glide.outbound_http.content.max_limit = 10000
    • glide.outbound_http_log.override = true
  • Plugins installed:
    • CMDB CI Class Models (sn_cmdb_ci_class) - 1.53.0
    • Discovery and Service Mapping Patterns (sn_itom_pattern) - 1.10.1
    • Cloud Provisioning and Governance Core (com.snc.cloud.core)

Installation and Setup

Step 1: Install the InsightCloudSec CMDB Integration in ServiceNow

Before ServiceNow can begin ingesting InsightCloudSec resources into your CMDB, you first need to download and install the Rapid7 InsightCloudSec CMDB Integration.

To download and install the InsightCloudSec CMDB Integration:

1. Login to ServiceNow.
2. Open the ServiceNow store.
3. Using the search field, type InsightCloudSec.
4. Click the Rapid7 InsightCloudSec CMDB Integration card.
5. Click Get, then provide the HI credentials for your ServiceNow instance.
6. Once the integration has been added, open your ServiceNow instance and navigate to Applications > All Available Applications > All.
7. Using the search field, type InsightCloudSec.
8. Click Install in the Rapid7 InsightCloudSec CMDB Integration application listing.

Step 2: Create the InsightCloudSec CMDB Integration Users

After installing the integration, it is best practice to create at least one user to interface and manage the corresponding ServiceNow application. Follow the instructions using ServiceNow's documentation to create a user and assign a role to the user. At the very least, we recommend creating an Application Admin user that is assigned the x_r7_rapid7_ics_cm.ics_admin, cmdb_read, workflow_admin roles.

Step 3: Configure the InsightCloudSec CMDB Integration

Using the new Application Admin user you created in the previous step, you'll need to configure authentication to InsightCloudSec and application properties as necessary.

To configure authentication:

1. Login to ServiceNow as your new Application Admin user.
2. Navigate to Rapid7 InsightCloudSec CMDB Integration > Configuration.
3. Provide a unique Name for the configuration.
4. For the Token, provide a portal-generated API key for the InsightCloudSec endpoint. To generate an API key, click the provided link in ServiceNow.
5. For the Host, provide the URL for your InsightCloudSec instance.
6. Click Update.

To configure application properties:

1. Navigate to Rapid7 InsightCloudSec CMDB Integration > System Properties.
2. Update the properties as necessary, then click Save.

Step 4: Activate InsightCloudSec Schedulers and Data Imports

After successfully downloading, installing, and configuring the integration, you have to activate all the corresponding scheduled import jobs to begin ingesting InsightCloudSec resources into your CMDB. For more information on managing and cancelling ServiceNow jobs like Resource Import, Resource Type Import, Scope Import, and Resource Soft Delete, review the ServiceNow documentation.

To activate InsightCloudSec schedulers:

1. In your ServiceNow instance, navigate to System Definition > Scheduled Jobs.
2. Add the Application column to the list view.
3. Using the search field in the Application column, type Rapid7 InsightCloudSec CMDB Integration. The list should filter to only display the jobs associated with the Rapid7 InsightCloudSec CMDB Integration.
4. Update all of the jobs' Active column to true.

To activate InsightCloudSec data imports:

1. In your ServiceNow instance, navigate to System Definition > Scheduled Imports.
2. Add the Application column to the list view.
3. Using the search field in the Application column, type Rapid7 InsightCloudSec CMDB Integration. The list should filter to only display the jobs associated with the Rapid7 InsightCloudSec CMDB Integration.
4. Update all of the jobs' Active column to true.

Using the Integration

After the schedulers and data imports have successfully completed, you can view all imported resources from the Rapid7 InsightCloudSec CMDB Integration > Resources page. Click any resource to review details in read-only mode. You can also navigate to CMDB records directly through list view by clicking on the name under the Configuration Item column.

Troubleshooting

For assistance with troubleshooting the integration, we recommend reviewing the application process monitor and logs.

Process Monitor

The application provides a Process Monitor module under the Diagnostics menu for reviewing high-level metrics from past runs of the feature. This module generates a list of all the processes with a corresponding scheduled job name and descriptive logs with the total count and reason for a process failure. In ServiceNow, navigate to Rapid7 InsightCloudSec CMDB Integration > Diagnostics > Process Monitor to get started. For details on the various statuses that appear in the process monitor, review the Process Monitor Status Reference drop-down.

Application Logs

Application logs can be viewed from the integration itself or in the system log (if configured). Navigate to Rapid7 InsightCloudSec CMDB Integration > Application Logs to see only the application-specific logs. For more information on system logs, review the ServiceNow documentation.

IRE Errors

If you're noticing an excess amount of IRE errors in the Application logs, this may be because the length of the Account ID is more than the CMDB will allow.

To update the length of the Account ID:

1. Login to ServiceNow.
2. Navigate to the CMDB CI Cloud Service Account list.
3. Update the length of the Account ID column to 255.

If you can't change the length of the Account ID using the previous method, try navigating to System Definition > Scripts - Background and running the following script

text
1
var gr = new GlideRecord("sys_dictionary");
2
gr.addEncodedQuery("nameSTARTSWITHcmdb_ci_cloud_service_account^elementSTARTSWITHaccount_id");
3
gr.query();
4
if(gr.next()) {
5
  gr.max_length = 255;
6
  gr.setWorkflow(false);
7
  gr.update();
8
}