ServiceNow

Click here to follow the method for collecting logs via the API.

Overview:

These logs represent ServiceNow ITOM Discovery system log (syslog) events that capture the lifecycle of asynchronous Discovery sensor processing jobs executed by the platform’s internal scheduler. Specifically, this entry shows the completion (“End processing ASYNC”) of a Discovery MultiPage Sensors Pattern Launcher job, targeting a Windows server and processing page 22 of 26, indicating that the Discovery operation is segmented into multiple batches for scalability and efficiency. The logs provide detailed execution context, including the scheduler worker thread, the originating component (DiscoverySensorJob), the associated scheduled job record (sys_trigger), and a transaction identifier (_txid) for correlation across related events. Additionally, metadata such as the executing user (system), MID Server involvement (mid_server_user), and script reference (sys_script_include) helps trace execution flow and troubleshoot issues. From an operational and security perspective, these logs offer visibility into automated infrastructure discovery activities, job execution status (start/end), processing progress, and system behavior under scheduled workloads. They are particularly useful for identifying delays, failures, or anomalies in Discovery processes, validating that assets are being scanned and updated correctly in the CMDB, and correlating Discovery activity with network or endpoint events in broader monitoring and SIEM workflows.

Table name: servicenow_system_logs

Expected format

Logs are expected in JSON-format.

{"sequence": "", "sys_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "source_application_family": "", "level": "1", "source_package": "", "sys_created_on": "2020-01-01 00:00:00", "source": "HTTP Classify", "message": "No results returned from probe.", "sys_class_name": "discovery_log", "sys_created_by": "generic_service_user", "context_map": "{\"_system_id\":\"app.example.service-now.com:generic_instance\",\"caller\":\"com.example.SchedulerWorkerThread\",\"_logged_in_user\":\"generic.user\",\"job_name\":\"ASYNC: Discovery - Sensors HTTPClassyProbe (192.0.2.10) bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\"record_sys_id\":\"cccccccccccccccccccccccccccccccc\",\"_user\":\"generic.user\",\"_is_impersonating\":\"false\",\"table_name\":\"sys_trigger\",\"_txid\":\"dddddddddddd\",\"_session_id\":\"glide.scheduler.worker.0\"}"}

Overview:

These logs represent a ServiceNow session or authentication-related record, likely tied to session management within the platform. The entry captures the lifecycle of a session-like object associated with an entity (name) and includes security-relevant attributes such as a CSRF (Cross-Site Request Forgery) token, timestamps, and invalidation status. The presence of csrf_token indicates that the platform issued a token to protect against unauthorized request forgery during a user interaction, while fields like last_accessed, sys_created_on, and sys_updated_on provide a timeline of session activity. The invalidated field shows that the session or token was explicitly terminated shortly after creation, which could reflect normal session expiration, logout behavior, or security enforcement. Metadata such as sys_created_by, sys_updated_by, and sys_mod_count help track how the record was handled internally by the system. From a security and operational perspective, these logs provide insight into session lifecycle management, token issuance and revocation, and access control enforcement within the platform. They are useful for identifying abnormal session patterns, such as rapid creation and invalidation, potential misuse of session tokens, or automated access attempts, while also serving as an audit trail for authentication and web session security

Table name: servicenow_system_user_session

Expected format

Logs are expected in JSON format.

{"last_accessed": "2020-01-01 10:00:00", "data": "", "csrf_token": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "sys_mod_count": "0", "sys_updated_on": "2020-01-01 10:01:00", "sys_tags": "", "sys_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "sys_updated_by": "svc_integration_account", "sys_created_on": "2020-01-01 10:00:00", "name": "svc_integration_account", "id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "invalidated": "2020-01-01 10:01:00", "sys_created_by": "guest"}

Overview:

These logs represent a ServiceNow outbound HTTP transaction generated by an automated scheduled script that refreshes MultiSSO Identity Provider metadata. The event shows that the ServiceNow instance sent an HTTPS GET request to Microsoft Online’s federation metadata endpoint to retrieve a federation metadata XML document used for SAML/SSO configuration. The request was executed from a scheduler worker session, indicating this was an automated platform task rather than an interactive browser action. The response status was 200, meaning the remote endpoint successfully returned the requested metadata, with a response size of 14,237 bytes and a response time of 327 milliseconds. Fields such as transaction_id, transaction_name, source_table, and source_record help correlate this network call back to the scheduled automation that initiated it. The system_id identifies the ServiceNow application node that performed the request, while method, protocol, scheme, hostname, path, and url describe the outbound connection details. From an operational and security perspective, these logs provide visibility into external integrations, SSO metadata refresh activity, outbound web requests, response performance, and success or failure of identity-provider synchronization. This type of log is useful for troubleshooting SSO issues, validating metadata refresh behavior, monitoring dependencies on external identity platforms, and detecting unusual outbound requests from scheduled automation.

Table name: servicenow_system_outbound_http_logs

Expected format

Logs are expected in JSON format.

{"scheme": "https", "user_name": "generic_user", "response_body": "", "sys_updated_on": "2020-01-01 12:00:00", "path": "/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/federationmetadata/2007-06/federationmetadata.xml", "sys_id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "hostname": "idp.example.com", "protocol": "HTTP/1.1", "rst": "", "sys_updated_by": "generic_user", "source_record": {"link": "https://example.service-now.com/api/now/table/sysauto_script/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "value": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}, "sys_created_on": "2020-01-01 12:00:00", "transaction_name": "Refresh MultiSSO IDP Metadata - system", "sys_created_by": "generic_user", "request_query": "", "transaction_id": "cccccccccccccccccccccccccccccccc", "method": "GET", "mid_server": "", "response_status": "200", "system_id": "app.example.service-now.com:tenant001", "log_level": "Basic", "sys_mod_count": "0", "session_id": "glide.scheduler.worker.1", "sys_tags": "", "url": "https://idp.example.com/aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/federationmetadata/2007-06/federationmetadata.xml", "response_length": "14237", "sequence": "10001", "response_headers": "", "request_body": "", "request_length": "0", "rrt": "", "request_headers": "", "response_time": "327", "app_scope": "global", "source_table": "sysauto_script"}