SBOM + service maps in the ServiceNow CMDB

Two capabilities that make the ServiceNow CMDB answer questions it could not before — both live on the demo instance.

1. A build’s SBOM, queryable in the CMDB

Before, a build’s software bill of materials reached ServiceNow only as a zip attached to the Change Request. Now each component is a real cmdb_sw_component_install row — filterable, and correlated to the build and the Application Service.

The catch that made this interesting: cmdb_sw_component_install lives in the CMDB Data Foundation scope, which write-guards the Table API even for an admin (an insert returns “ACL Exception Insert Failed”). The solution is a server-side GlideRecord insert inside a Scripted REST resource — not subject to that row ACL — so CI POSTs the parsed CycloneDX and the resource writes the rows.

CI (syft CycloneDX) ──► servicenow-sbom-components.sh
   parse · classify direct/transitive · dedupe by purl · cap
        │  POST /api/calit/sarc_sbom/ingest
        ▼
Scripted REST resource (server-side GlideRecord)
        ▼
cmdb_sw_component_install   { u_component_name, version, u_purl, u_license,
                              u_scope, u_commit_sha, installed_on -> App Service }

Query cmdb_sw_component_install by u_commit_sha for a build’s components, or by u_purl across builds — “which releases ship this package/version?” — the question you could not ask before.

2. Service maps that populate themselves

Application Service membership used to be hand-wired cmdb_rel_ci relationships. Now a service’s members come from a CI query over attributes SARC already writes (environment, the podtato/karc name convention) — add a pod, it matches the query, it joins the map on the next sync.

Service	Query	Members (live)
SARC	all SARC CIs	113
SARC dev	+ environment=dev	2
SARC qa / SARC prod	+ environment=qa/prod	fills as those CIs sync

scripts/ci/servicenow-service-membership.sh re-runs the query and writes svc_ci_assoc — run it on each CMDB sync and the maps stay current. This is the plugin-free, reliable route: the demo instance lacks ServiceNow’s tag-based / query-service plugins, and per-CI tagging is blocked by a “Prevent Duplicate Label Entries” business rule, so SARC drives the population itself.

The two together

The SBOM rows resolve installed_on to the same Application Services the query populates — so a service’s map and its software bill of materials line up in one CMDB. Full detail: docs/ci/servicenow/sbom-cmdb.md and docs/ci/servicenow/query-based-services.md.