Output Format

Each asset is wrapped in the common plugin result envelope:

{
  "result_type": "scan",
  "plugin_id": "servicenow-plugin",
  "plugin_version": "1.0.0",
  "data": {
    "type": "symkey",
    "timestamp": "2026-07-29T14:30:00Z",
    "urn": "urn:symkey:id:sys_kmf_module_crypto_spec:0123456789abcdef0123456789abcdef",
    "url": "https://your-instance.service-now.com/sys_kmf_module_crypto_spec.do?sys_id=0123456789abcdef0123456789abcdef",
    "extra": {
      "algorithm": "AES 256 GCM",
      "key_alias": "example_key",
      "key_type": "Symmetric Key Encryption Key",
      "name": "example_key",
      "origin": "servicenow",
      "platform_type": "servicenow",
      "sys_id": "0123456789abcdef0123456789abcdef",
      "table": "sys_kmf_module_crypto_spec"
    }
  }
}

Asset Types

  • cert: X.509 certificate
  • pubkey: Public or asymmetric key
  • privkey: Private key metadata
  • symkey: Symmetric or HMAC key metadata
  • secret: Secret or credential metadata

Certificate Handling

When a valid X.509 PEM block is present, the plugin normalizes it and provides it to the common certificate formatter. Certificate-intrinsic properties such as subject, issuer, validity, algorithm, key size, and fingerprints are not duplicated in extra when they can be derived from the certificate.

If a record has the corroborating certificate metadata combinations described above but its PEM cannot be parsed, the plugin preserves the record as metadata-only and uses a SHA-256 fallback identifier. Validity dates are parsed and included after classification, but do not qualify a record as a certificate by themselves. Raw invalid certificate content is not emitted.

Key and Secret Handling

Private, symmetric, and secret values are never emitted. Results contain only identifiers, status, dates, descriptions, direct record URLs, and allowlisted metadata such as algorithm, key type, key alias, purpose, origin, and credential type.

When a key references a certificate record, the relationship may be represented as linked_cert_sys_id; the certificate PEM is not copied into the key result.

Security

  • Use a dedicated, read-only ServiceNow integration account.
  • Protect configuration files because they contain a password.
  • Never place real credentials in repository examples, logs, or documentation.
  • Restrict outbound access to the intended ServiceNow instance.
  • Use HTTPS for production ServiceNow instances.
  • Review table and field ACLs regularly.
  • The plugin filters known password, token, private-key, key-material, and PEM value fields from extra.

Limitations

  • Dynamic discovery depends on readable and accurate sys_dictionary metadata.
  • Custom field names that do not resemble known certificate, key, or secret patterns may not be discovered automatically.
  • Explicitly selected tables still need dictionary metadata so the plugin can classify them.
  • Key classification depends on the readable metadata available in each record. Key records with insufficient type evidence are skipped.
  • ServiceNow ACL behavior and table names vary by instance and installed applications.
  • Offset pagination and display-value resolution can be expensive on very large tables.
  • Deleted records are not returned by the Table API and therefore cannot be represented by incremental scans.
  • The module currently has no ServiceNow mock server or plugin-specific Go test files.

Troubleshooting

Authentication Fails

Symptoms: HTTP 401 or a failed test result.

  • Verify instanceUrl, username, and password.
  • Confirm the integration account is active and not locked.
  • Test the same credentials with a one-record Table API request.

Table Discovery Fails

Symptoms: sys_dictionary errors or no discovered tables.

  • Grant read access to sys_dictionary and its name and element fields.
  • Confirm Table API access is enabled.
  • Try an explicit tables list to narrow the scope.
  • Check whether ACLs hide custom dictionary records from the integration account.

A Table Is Skipped or the Scan Is Partial

Symptoms: Page errors in logs; no final state result.

  • Grant read access to /api/now/table/{table}.
  • Check table and field ACLs for the integration account.
  • Verify the table exists in the target instance.
  • Retry the scan with a smaller explicit table list.

The missing state result is intentional after a partial scan: the previous watermark must be retained and retried.

No Assets Are Emitted

  • Confirm candidate fields contain non-empty values.
  • Check that field names provide certificate-, key-, or secret-specific evidence.
  • For secrets, masked values, placeholders, dates, and sys_id references are intentionally ignored.
  • For keys, ensure fields such as key_type, algorithm, key_alias, key_usage, or key material indicators are populated.

Incremental Scan Returns Repeated Records

A record exactly on the previous watermark can appear again because the lower boundary uses >=. This is intentional and safer than missing records at ServiceNow's timestamp precision. Downstream inventory should reconcile results by URN.

Incremental Scan Returns a State Error

state.lastScanDate must be an RFC3339 timestamp, for example:

2026-07-29T14:30:00Z

Building and Validation

From the plugin directory:

make build

Run the available repository targets:

make test
make integration-test
make lint
make lint-full

The lint targets require golangci-lint and the repository lint configuration. This module currently contains no plugin-specific test files or mock server, so test targets primarily validate that the package builds unless tests are added.

References

Support

Contact: support@entrust.com