Skip to content
SARC

ServiceNow CMDB demo — SBOM, self-assembling service maps, tags

One pipeline run doesn’t just deploy — it makes the ServiceNow CMDB answer questions it couldn’t before.

What’s running, as a live service map — and exactly what software is inside each build. All in the CMDB, all queryable.

Three capabilities, all live on the demo instance and driven by just demo-cmdb-*:

1. A build’s SBOM, queryable in the CMDB

Section titled “1. A build’s SBOM, queryable in the CMDB”

Every component of a build is a first-class cmdb_sw_component_install row — version, license, scope (direct/transitive), installed_on = the App Service. Not a zip stapled to the change request.

Terminal window
just demo-cmdb-seed     # POST a realistic podtato-head SBOM
# ServiceNow: cmdb_sw_component_install  filter u_commit_sha = demo-<today>

The audit question you couldn’t ask before — filter by u_purl CONTAINS openssl: “which builds and services ship OpenSSL 3.0.2?” The Log4Shell question, answered from the CMDB.

That table is write-guarded even for admins; SARC writes it from a server-side Scripted REST resource (/api/calit/sarc_sbom/ingest), which the ACL doesn’t block. Same call the servicenow:cr:sbom-components pipeline job makes.

2. A service map that assembles itself

Section titled “2. A service map that assembles itself”

The SARC Application Service has 113 member CIs with no hand-wired relationships — membership is a query over attributes the pipeline already stamps (environment, name). Add a workload, it joins the map on the next sync.

Terminal window
just demo-cmdb-membership   # re-run the query -> refresh the service map

The demo instance lacks ServiceNow’s tag/query-service plugin, so SARC drives the population itself via svc_ci_assoc — reliable and plugin-free.

3. Every CI tagged for slicing

Section titled “3. Every CI tagged for slicing”

Every SARC CI carries karc and karc-<env> — filter the CI list by Tag = karc-dev for just the dev CIs, or karc for all 113.

Terminal window
just demo-cmdb-tags     # (re)apply the tags, paced + idempotent

The end-to-end proof

Section titled “The end-to-end proof”
Terminal window
just demo-cmdb-live     # push log4j 2.14.1 to the scoped endpoint, live on stage
# refresh cmdb_sw_component_install filtered by u_purl CONTAINS log4j -> it's there

Run it

Section titled “Run it”
Terminal window
just demo-cmdb-status       # SARC members / karc tags / SBOM rows
just demo-cmdb-urls         # exact ServiceNow deep-links to open
just demo-cmdb-seed         # stage the SBOM
just demo-cmdb-membership   # refresh the self-assembling map
just demo-cmdb-live         # the vulnerable-component beat
just demo-cmdb-reset        # cleanup

Full presenter runbook (narration, timing, cautions): docs/ci/servicenow/CMDB-DEMO.md.

Fits the wider story

Section titled “Fits the wider story”

Pairs with Kosli ∥ Fides (same build, two compliance ledgers) and the drift demo (just demo-drift dev aws): one pipeline feeds compliance, drift control, and a CMDB you can actually query.