Day 31: DDIS Final and Lessons Learned

in

Diving into ServiceNow’s instance scan has definitely grown my thinking. This has been a fun project overall. For the finale I am bundling several extra checks I have developed, as well as some lessons learned and thoughts about Instance Scan.

Lessons Learned

  1. It’s hard to check for properties if the exist and if they have a certain value within the same check. Might need to create a custom filter script to perform this check in a repeatable fashion. The other issue is - how can you create and link a finding if there is no relevant matching record? Would be nice to have a sort of best practice for how to handle this situation.

  2. Script only checks have a major weakness where they don’t scale past 10k elements. GlideRecord just kind of eventually shuts down and doesn’t loop for that many elements. There should be some built in checks for scalability to check for those large tables, that if there are more than 10k records to break it through in 10k chunks. GlideAggregate doesn’t scale past 100k elements typically either, but there shouldn’t be many config tables with more thank 100k records…

  3. Denoting multiple different kinds of client scripts vs server scripts. For example, with client scripts, we should check client scripts/catalog client scripts, portal client script, UI pages, UI macros, and more. Server side scripts should also check flow scripts actions, workflow scripts, etc. It would be very nice if there was an added capability for Instance Scan to toggle client/server side checks.

  4. Similar to number 3, is that Script lint checks only apply to script fields, and not special places like Flow scripts which are not stored in a script field. Hopefully ServiceNow can fix this in a later update.

  5. Don’t do an Insert and Stay on a Read Only OOB instance check… Because then the copy is also read only - and is especially hard to delete. I did find a workaround, where you to edit an XML, and manually trick a delete operation when loading an update set to delete it though.

Download Instance Scan Bundle Update Set

DecemberDailyInstanceScan v1 sys_remote_update_set_8ca37b9a2fc425107caa93acf699b665.xml

Includes all 37 developed checks:

  • 11 Managability

  • 11 Performance

  • 5 Security

  • 10 User Experience