> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-data-from-servicenow-cmdb.md). # Ingest Data from ServiceNow CMDB {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} {% hint style="info" %} ### Note This data source is only available in your tenant if the tenant was activated before October 1, 2025 with an active Cortex XDR Pro per GB license. {% endhint %} To receive data from the ServiceNow CMDB database, you must first configure data collection from ServiceNow CMDB. ServiceNow CMDB is a logical representations of assets, services, and the relationships between them that comprise the infrastructure of an organization. It is built as a series of connected tables that contain all the assets and business services controlled by a company and its configurations. You can configure the Collection Integration settings in Cortex XDR for the ServiceNow CMDB database, which includes selecting the specific tables containing the data that you want to collect, in the ServiceNow CMDB Collector. You can select from the list of default tables and also specify custom tables. By default, the ServiceNow CMDB Collector is configured to collect data from the following tables, which you can always change depending on your system requirements. * `cmdb_ci` * `cmdb_ci_computer` * `cmdb_rel_ci` * `cmdb_ci_application_software` As soon as Cortex XDR begins receiving data, the app automatically creates a ServiceNow CMDB dataset for each table using the format `servicenow_cmdb__raw`. You can then use XQL Search queries to view the data and create new Correlation Rules. You can only configure a single ServiceNow CMDB Collector, which is automatically configured every 6 hours to reload the data from the configured tables and replace the existing data. You can always use the **Sync Now** option to reload the data and replace the existing data whenever you want. Complete the following task before you begin configuring Cortex XDR to receive data from ServiceNow CMDB. * Create a ServiceNow CMDB user with SNOW credentials, who is designated to access the tables from ServiceNow CMDB for data collection in Cortex XDR. Record the credentials for this user as you will need them when configuring the ServiceNow CMDB Collector in Cortex XDR. Configure Cortex XDR to receive data from ServiceNow CMDB: 1. Select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**. 2. In the **ServiceNow CMDB** configuration, click **Add Instance**. 3. Set the following parameters. * **Domain**: Specify your ServiceNow CMDB domain URL. * **User Name**: Specify the username for your ServiceNow CMDB user designated in Cortex XDR. * **Password**: Specify the password for your ServiceNow CMDB user designated in Cortex XDR. * **Tables**: You can do any of the following actions to configure the tables whose data is collected from ServiceNow CMDB. * Select the tables from the list of default ServiceNow CMDB tables that you want to collect from. After each table selection, select ![blue-arrow.png](/files/t2ipS9RoF3rs1stLzkrY) to add the table to the tables already listed below for data collection. * Specify any custom tables that you want to configure for data collection. * From the default list of tables already configured, you can delete any of them by hovering over the table and selecting the **X** icon. 4. Click **Test** to validate access, and then click **Enable**. Once events start to come in, a green check mark appears underneath the **ServiceNow CMDB** Collector configuration with the data and time that the data was last synced. 5. (Optional) Manage your ServiceNow CMDB Collector. After you enable the ServiceNow CMDB Collector, you can make additional changes as needed. To modify a configuration, select any of the following options: * **Edit** the ServiceNow CMDB Collector settings. * **Disable** the ServiceNow CMDB Collector. * **Delete** the ServiceNow CMDB Collector. * **Sync Now** to get the latest data from the tables configured. The data is replaced automatically every 6 hours, but you can always get the latest data as needed. 6. After Cortex XDR begins receiving data from ServiceNow CMDB, you can use the XQL Search to search for logs in the new datasets, where each dataset name is based on the table name using the format `servicenow_cmdb_
_raw`. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-data-from-servicenow-cmdb.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.