The ServiceNow Discovery plugin supports the following types of credentials: 

Dynamic Table Discovery

When tables is omitted or empty, the plugin queries sys_dictionary for field names associated with certificates, keys, and secrets. It groups those fields by table and classifies each table according to the evidence in its schema.

The plugin skips system, history, audit, import, logging, and other known non-asset tables. A discovered table may be classified for more than one asset type.

Explicit Table Selection

When tables is provided, the plugin uses sys_dictionary to classify only those tables. A requested table that cannot be found or classified is skipped and reported in the plugin log.

Explicit selection is useful when:

  • The ServiceNow account has access to a known set of custom tables
  • A large instance should be scanned in smaller groups
  • Automatic discovery returns tables that are outside the intended inventory scope

Record Classification

A record is emitted only when it contains type-specific evidence:

  • A certificate requires a certificate PEM or corroborating certificate metadata. Metadata-only records must contain at least one of these combinations: identity (subject, common name, or subject alternative names) with issuer; identity with serial number; issuer with serial number; or fingerprint/thumbprint with identity, issuer, or serial number. A single generic field or validity date is not sufficient evidence.
  • A key requires a non-empty key-specific field whose name indicates private or public key material, a key store or trust store, encryption or signing key material, or a key alias. After that evidence gate is satisfied, the plugin uses key_type, direct key-material field presence, algorithm, purpose, usage, alias, and name to distinguish private, asymmetric/public, symmetric, and HMAC keys. Records that pass the evidence gate but lack enough type information are skipped.
  • A secret requires an exact secret-related field name with an actionable value. Empty values, ServiceNow sys_id references, dates, placeholders, and masked values are rejected.

One record can produce multiple results when it contains independent evidence for multiple asset types. URNs are deduplicated within each scan.

Prerequisites

  • Go 1.25.7 or later to build the plugin
  • A reachable ServiceNow instance with the Table API enabled
  • A dedicated ServiceNow account with read-only access to the required metadata and asset tables
  • Network access to the ServiceNow instance over HTTPS

Authentication

The plugin uses HTTP Basic authentication with the configured ServiceNow username and password. Use a dedicated integration account and store its password through the plugin runner's protected configuration mechanism.

The plugin does not persist credentials and does not include them in scan output.