CIS-EM Questions and Answers

CI Remediations

CI Relation Types

CI Identifiers

Process to CI Type Mapping

CI Class Manager

{"CPU":100}

{"CPU":100,’Status":3}

{"CPU":"100","Status":3}

{"CPU":"100"}

Icinga

Sensu

SolarWinds

Nagios

Zabbix

Alert management rules

Event action rules

Event rules

Scheduled jobs

Java and Groovy scripts

ServiceNow Event Management Alerts, Incidents, Problems, and changes are automatically correlated with CIs and Business Services that can be visualized in Business Service maps.

ServiceNow Event Management manages relationships between alerts and related incidents to maintain an end-to-end event management lifecycle.

ServiceNow Event Management provides a business-centric platform and single system of record for service monitoring and remediation results, to better control and manage performance and availability.

ServiceNow Event Management provides state-of-the-art performance monitoring capabilities across a wide array of different types of infrastructures.

ServiceNow Event Management utilizes the power of integration with leading monitoring systems to automatically create actionable alerts.

In the Flow Designer remediation subflow

In Service Operations Workspace

In the alert management rule's approvals related list

In the alert management rule's playbook

ServiceNow is installed within your datacenter providing you complete control

All applications are built on the Oracle database standard, providing uniformity across products

All applications that are built by ServiceNow utilize the same data model and code base

ServiceNow runs on supported Windows servers and is managed through Windows Update

A single table houses all data elements within ServiceNow

ServiceNow utilizes the AWS MariaDB cloud database structure, providing a single system of record

Severity of -1/OK

Type of Clear

Resolution State of Closing

Resolution State of Clear

Severity of 0/Clear

Flapping

Closed

Reopen

Processed

5 seconds

30 seconds

60 seconds

120 seconds

The service is a manual service

The service is not set to operational

The service was created through Service Mapping

The service is a technical service

Metric_name

Message_key

Short_description

Additional_info

To automatically generate incidents from linked alerts

To manage user permissions across teams

To visualize tag-based alert groups

To update the CMDB dependency map

It is a connection point between a ServiceNow instance and the MID Server.

It contains probe records to be executed on the customer’s network.

It holds jobs that the MID Server needs to perform.

It is a connection point between a hardware CI on a customer’s network and the MID Server.

It contains records of CIs that the ServiceNow admin has submitted for entry into the CMDB.

Management, Instrumentation, and Discovery

Messaging, Integration, and Data

Monitoring, Insight, and Domain

Maintenance, Information, and Distribution

Alert management rules

Task rules

Event rules

Alert correlation rules

A business service

A technical service

An application service

A manual service

A scoped service

Filter out events on ServiceNow Instance for easier consolidation and aggregation.

Promote all events to alerts during initial implementation until you fully understand which should be ignored.

Filter out events at source rather than in the ServiceNow instance.

Base-line “normal-state” events to filter out background noise.

Ignore all non-critical events during initial implementation to streamline processing; add alerts over time as time and resources allow.

The process responsible for defining, analyzing, planning, measuring, and improving all aspects of the availability of IT services

The process responsible for ensuring the capacity of IT Services and IT infrastructure is able to deliver agreed upon service level targets in a cost-effective manner

The process responsible for recovery action and planning through machine learning

The process responsible for monitoring all abnormal occurrences throughout the IT infrastructure, allowing for normal operations, and detecting and escalating exception conditions

win-ces882ierw is one of your hottest Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately

win-ces882ierw is one of your hottest Configuration Items (CIs), but is currently experiencing a low probability of anomalies

win-ces882ierw is one of your customized list of monitored Configuration Items (CIs) that is currently experiencing a high probability of anomalies and should be checked immediately

win-ces882ierw is one of your customized list of monitored Configuration Items (CIs), but is currently experiencing a low probability of anomalies

event connectors

Alert management rules

Metric policies

Log data inputs

em_event table

System log module

Event Mangement dashboard

State management logs module

Source Instance

Metric Name

Node

Resource

Every 120 seconds

Every 5 seconds

Every 40 seconds

Every 60 seconds

Every 10 seconds

The support agent does not have the evt_mgmt_user role.

The support agent only has the evt_mgmt_admin role.

The support agent has the evt_mgmt_operator role, but not the evt_mgmt_user role.

The support agent has the evt_mgmt_user role, but not the evt_mgmt_operator role.

Ready

Ignored

Error

Processing

Event Rules

Message Key

Alert Priority

Severity

CI Name, DNS, IP, MAC Address

System class name, FQDN, IP or MAC address

CI name, FQDN, SSH public host keys

CI Name, FQDN, IP, MAC Address

The CMDB is a series of tables that contain only key hardware components located in critical paths within your platform that must be managed.

The CMDB is a dynamic list that tracks both the CIs within your platform and the relationship between those items.

All CIs stored in the CMDB must have an assigned IP address within your infrastructure.

A CI is any component within your infrastructure that needs to be managed in order to deliver Services.