CMDB classes targeted in the Service Graph Connector for Microsoft Defender for IoT \(Azure\)
reference brazil Updated Sep 10, 2026 5 min read sgc-microsoft-d4iot-azure-classes.md
When you complete the guided setup, you can configure the integration to periodically pull data from a Service Graph Connector for Microsoft Defender for IoT (Azure) (Azure) project. The data is saved in tables that extend from the Configuration item [cmdb_ci] table.
Viewing class mappings
You can view the available class mappings for the Service Graph Connector for Microsoft Defender for IoT (Azure) by navigating to All > Service Graph for MSFT D4IoT (Azure) > Class Mappings. In the class mappings table, you can view the following attributes.
|
Field |
Description |
|---|---|
|
Source Class |
The device type from the source system (Azure). |
|
Target CMDB class |
The expected ServiceNow class for the CI. |
|
OT Device type |
The category type that the OT device is classified as. The device type is also the function that the device plays on the OT network. For example:An IT device, such as a server, can be converted to an OT device, and the function it plays on the network is an HMI. Therefore, its class is server and its device type is HMI. Note: In some cases, there are OT devices with no OT function or OT devices where the device type is unknown. For OT devices with no OT function, select No OT Function. For OT devices where the device type is unknown, select Unknown. |
|
Allow OS classification |
When set to True, if an operating system is found on the CI, the target is switched away from the target CMDB class to a ServiceNow class that matches its OS. |
|
Active |
When checked, the class mapping is set to Active. |
The following attributes in the Computer [cmdb_ci_computer] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Most recent discovery | last_discovered |
| Operating System | os |
| OS Address Width (bits) | os_address_width |
| OS Domain | os_domain |
| OS Version | os_version |
External system metadata [cmdb_key_value_v2]
The following attributes in the External system metadata [cmdb_key_value_v2] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Discovery source | discovery_source |
| Key | key |
| Source key | source_key |
| String value | string_value |
| URL value | url_value |
| Value type | value_type |
Hardware [cmdb_ci_hardware]
The following attributes in the Hardware [cmdb_ci_hardware] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Class | sys_class_name |
| Model number | model_number |
| Most recent discovery | last_discovered |
| Location | location |
| Model ID | model_id |
| Manufacturer | manufacturer |
| First discovered | first_discovered |
| Owned by | owned_by |
| Approval group | change_control |
| Managed By Group | managed_by_group |
| Managed by | managed_by |
| Name | name |
| Company | company |
| Support group | support_group |
| Change Group | assignment_group |
| Assigned to | assigned_to |
| Supported by | supported_by |
| Parent class | Relationship type | Child class |
|---|---|---|
| Hardware [cmdb_ci_hardware] | Owns::Owned by | IP Address [cmdb_ci_ip_address] |
| Hardware [cmdb_ci_hardware] | Owns::Owned by | Network Adapter [cmdb_ci_network_adapter] |
| Hardware [cmdb_ci_hardware] | Reference | External system metadata [cmdb_key_value_v2] |
| Hardware [cmdb_ci_hardware] | Reference | OT Device [cmdb_ot_entity] |
IP Address [cmdb_ci_ip_address]
The following attributes in the IP Address [cmdb_ci_ip_address] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| IP Address | ip_address |
| IP version | ip_version |
| Owned By Configuration Item | owned_by_cmdb_ci |
| Parent class | Relationship type | Child class |
|---|---|---|
| IP Address [cmdb_ci_ip_address] | Reference | Network Intrusion Detection System [cmdb_ci_nids] |
| IP Address [cmdb_ci_ip_address] | Reference | Hardware [cmdb_ci_hardware] |
Network Adapter [cmdb_ci_network_adapter]
The following attributes in the Network Adapter [cmdb_ci_network_adapter] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| MAC Address | mac_address |
| Name | name |
| Discovery source | discovery_source |
| Parent class | Relationship type | Child class |
|---|---|---|
| Network Adapter [cmdb_ci_network_adapter] | Reference | Network Intrusion Detection System [cmdb_ci_nids] |
| Network Adapter [cmdb_ci_network_adapter] | Reference | Hardware [cmdb_ci_hardware] |
Network Intrusion Detection System [cmdb_ci_nids]
The following attributes in the Network Intrusion Detection System [cmdb_ci_nids] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| First discovered | first_discovered |
| NIDS source name | source_name |
| Life Cycle Stage | life_cycle_stage |
| Life Cycle Stage Status | life_cycle_stage_status |
| Name | name |
| Correlation ID | correlation_id |
| Firmware version | firmware_version |
| Fully qualified domain name | fqdn |
| NIDS assignment zone | zone |
| NIDS manager connection state | connection_state |
| Validated | validated |
| Manufacturer | manufacturer |
| Parent class | Relationship type | Child class |
|---|---|---|
| Network Intrusion Detection System [cmdb_ci_nids] | Detects::Detected by | Hardware [cmdb_ci_hardware] |
| Network Intrusion Detection System [cmdb_ci_nids] | Owns::Owned by | IP Address [cmdb_ci_ip_address] |
| Network Intrusion Detection System [cmdb_ci_nids] | Owns::Owned by | Network Adapter [cmdb_ci_network_adapter] |
Operational Technology (OT) [cmdb_ci_ot]
The following attributes in the Operational Technology (OT) [cmdb_ci_ot] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Most recent discovery | last_discovered |
OT Control Module [cmdb_ci_ot_control_module]
The following attributes in the OT Control Module [cmdb_ci_ot_control_module] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Vendor | vendor |
| Support group | support_group |
| Serial number | serial_number |
| Class | sys_class_name |
| First discovered | first_discovered |
| Approval group | change_control |
| Managed by | managed_by |
| Managed By Group | managed_by_group |
| Change Group | assignment_group |
| Company | company |
| Rack number | rack_number |
| Slot number | slot_number |
| Location | location |
| Name | name |
| Firmware version | firmware_version |
| Most recent discovery | last_discovered |
| Assigned to | assigned_to |
| Owned by | owned_by |
| Supported by | supported_by |
| Model ID | model_id |
| Parent class | Relationship type | Child class |
|---|---|---|
| OT Control Module [cmdb_ci_ot_control_module] | Reference | OT Device [cmdb_ot_entity] |
OT Control System [cmdb_ci_ot_control]
The following attributes in the OT Control System [cmdb_ci_ot_control] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Has module | has_module |
| Most recent discovery | last_discovered |
| Parent class | Relationship type | Child class |
|---|---|---|
| OT Control System [cmdb_ci_ot_control] | Owns::Owned by | OT Control Module [cmdb_ci_ot_control_module] |
OT Device [cmdb_ot_entity]
The following attributes in the OT Device [cmdb_ot_entity] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| ISA entity site | isa_entity_site |
| OT discovery source ID | ot_correlation_id |
| Device criticality | business_criticality |
| Purdue level | purdue_level |
| Zone | zone |
| OT device type | ot_asset_type |
| IRE criterion attribute | ire_criterion_attribute |
PLC [cmdb_ci_ot_plc]
The following attributes in the PLC [cmdb_ci_ot_plc] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Most recent discovery | last_discovered |
| Switch position | switch_position |
| Switch remote | switch_remote_mode |
Serial Number [cmdb_serial_number]
The following attributes in the Serial Number [cmdb_serial_number] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Serial Number | serial_number |
| Serial Number Type | serial_number_type |
| Valid | valid |
| Parent class | Relationship type | Child class |
|---|---|---|
| Serial Number [cmdb_serial_number] | Reference | Hardware [cmdb_ci_hardware] |
| Network Adapter [cmdb_ci_network_adapter] | Reference | Hardware [cmdb_ci_hardware] |
Parent Topic:Service Graph Connector for Microsoft Defender for IoT (Azure)
278 lines · 10.1 KB
--- title: CMDB classes targeted in the Service Graph Connector for Microsoft Defender for IoT \(Azure\) description: When you complete the guided setup, you can configure the integration to periodically pull data from a Service Graph Connector for Microsoft Defender for IoT \(Azure\) \(Azure\) project. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. locale: en-US canonical_url: https://www.servicenow.com/docs/r/operational-technology/operational-technology-manager/sgc-microsoft-d4iot-azure-classes.html release: brazil product: Operational Technology Manager classification: operational-technology-manager topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 5 breadcrumb: [Service Graph Connector for Microsoft Defender for IoT \(Azure\), Integrate, Operational Technology Manager, Operational Technology] --- # CMDB classes targeted in the Service Graph Connector for Microsoft Defender for IoT \(Azure\) When you complete the guided setup, you can configure the integration to periodically pull data from a Service Graph Connector for Microsoft Defender for IoT \(Azure\) \(Azure\) project. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. ## Viewing class mappings You can view the available class mappings for the Service Graph Connector for Microsoft Defender for IoT \(Azure\) by navigating to **All** > **Service Graph for MSFT D4IoT \(Azure\)** > **Class Mappings**. In the class mappings table, you can view the following attributes. <table id="table_b2z_zgx_cdc"><thead><tr><th> Field </th><th> Description </th></tr></thead><tbody><tr><td> Source Class </td><td> The device type from the source system \(Azure\). </td></tr><tr><td> Target CMDB class </td><td> The expected ServiceNow class for the CI. </td></tr><tr><td> OT Device type </td><td> The category type that the OT device is classified as. The device type is also the function that the device plays on the OT network. For example:An IT device, such as a server, can be converted to an OT device, and the function it plays on the network is an HMI. Therefore, its class is **server** and its device type is **HMI**. **Note:** In some cases, there are OT devices with no OT function or OT devices where the device type is unknown. For OT devices with no OT function, select **No OT Function**. For OT devices where the device type is unknown, select **Unknown**. </td></tr><tr><td> Allow OS classification </td><td> When set to **True**, if an operating system is found on the CI, the target is switched away from the target CMDB class to a ServiceNow class that matches its OS. </td></tr><tr><td> Active </td><td> When checked, the class mapping is set to **Active**. </td></tr></tbody> </table>## Computer \[cmdb\_ci\_computer\] The following attributes in the Computer \[cmdb\_ci\_computer\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Most recent discovery|last\_discovered| |Operating System|os| |OS Address Width \(bits\)|os\_address\_width| |OS Domain|os\_domain| |OS Version|os\_version| ## External system metadata \[cmdb\_key\_value\_v2\] The following attributes in the External system metadata \[cmdb\_key\_value\_v2\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Discovery source|discovery\_source| |Key|key| |Source key|source\_key| |String value|string\_value| |URL value|url\_value| |Value type|value\_type| ## Hardware \[cmdb\_ci\_hardware\] The following attributes in the Hardware \[cmdb\_ci\_hardware\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Class|sys\_class\_name| |Model number|model\_number| |Most recent discovery|last\_discovered| |Location|location| |Model ID|model\_id| |Manufacturer|manufacturer| |First discovered|first\_discovered| |Owned by|owned\_by| |Approval group|change\_control| |Managed By Group|managed\_by\_group| |Managed by|managed\_by| |Name|name| |Company|company| |Support group|support\_group| |Change Group|assignment\_group| |Assigned to|assigned\_to| |Supported by|supported\_by| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Hardware \[cmdb\_ci\_hardware\]|Owns::Owned by|IP Address \[cmdb\_ci\_ip\_address\]| |Hardware \[cmdb\_ci\_hardware\]|Owns::Owned by|Network Adapter \[cmdb\_ci\_network\_adapter\]| |Hardware \[cmdb\_ci\_hardware\]|Reference|External system metadata \[cmdb\_key\_value\_v2\]| |Hardware \[cmdb\_ci\_hardware\]|Reference|OT Device \[cmdb\_ot\_entity\]| ## IP Address \[cmdb\_ci\_ip\_address\] The following attributes in the IP Address \[cmdb\_ci\_ip\_address\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |IP Address|ip\_address| |IP version|ip\_version| |Owned By Configuration Item|owned\_by\_cmdb\_ci| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |IP Address \[cmdb\_ci\_ip\_address\]|Reference|Network Intrusion Detection System \[cmdb\_ci\_nids\]| |IP Address \[cmdb\_ci\_ip\_address\]|Reference|Hardware \[cmdb\_ci\_hardware\]| ## Network Adapter \[cmdb\_ci\_network\_adapter\] The following attributes in the Network Adapter \[cmdb\_ci\_network\_adapter\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |MAC Address|mac\_address| |Name|name| |Discovery source|discovery\_source| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Network Adapter \[cmdb\_ci\_network\_adapter\]|Reference|Network Intrusion Detection System \[cmdb\_ci\_nids\]| |Network Adapter \[cmdb\_ci\_network\_adapter\]|Reference|Hardware \[cmdb\_ci\_hardware\]| ## Network Intrusion Detection System \[cmdb\_ci\_nids\] The following attributes in the Network Intrusion Detection System \[cmdb\_ci\_nids\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |First discovered|first\_discovered| |NIDS source name|source\_name| |Life Cycle Stage|life\_cycle\_stage| |Life Cycle Stage Status|life\_cycle\_stage\_status| |Name|name| |Correlation ID|correlation\_id| |Firmware version|firmware\_version| |Fully qualified domain name|fqdn| |NIDS assignment zone|zone| |NIDS manager connection state|connection\_state| |Validated|validated| |Manufacturer|manufacturer| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Network Intrusion Detection System \[cmdb\_ci\_nids\]|Detects::Detected by|Hardware \[cmdb\_ci\_hardware\]| |Network Intrusion Detection System \[cmdb\_ci\_nids\]|Owns::Owned by|IP Address \[cmdb\_ci\_ip\_address\]| |Network Intrusion Detection System \[cmdb\_ci\_nids\]|Owns::Owned by|Network Adapter \[cmdb\_ci\_network\_adapter\]| ## Operational Technology \(OT\) \[cmdb\_ci\_ot\] The following attributes in the Operational Technology \(OT\) \[cmdb\_ci\_ot\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Most recent discovery|last\_discovered| ## OT Control Module \[cmdb\_ci\_ot\_control\_module\] The following attributes in the OT Control Module \[cmdb\_ci\_ot\_control\_module\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Vendor|vendor| |Support group|support\_group| |Serial number|serial\_number| |Class|sys\_class\_name| |First discovered|first\_discovered| |Approval group|change\_control| |Managed by|managed\_by| |Managed By Group|managed\_by\_group| |Change Group|assignment\_group| |Company|company| |Rack number|rack\_number| |Slot number|slot\_number| |Location|location| |Name|name| |Firmware version|firmware\_version| |Most recent discovery|last\_discovered| |Assigned to|assigned\_to| |Owned by|owned\_by| |Supported by|supported\_by| |Model ID|model\_id| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |OT Control Module \[cmdb\_ci\_ot\_control\_module\]|Reference|OT Device \[cmdb\_ot\_entity\]| ## OT Control System \[cmdb\_ci\_ot\_control\] The following attributes in the OT Control System \[cmdb\_ci\_ot\_control\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Has module|has\_module| |Most recent discovery|last\_discovered| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |OT Control System \[cmdb\_ci\_ot\_control\]|Owns::Owned by|OT Control Module \[cmdb\_ci\_ot\_control\_module\]| ## OT Device \[cmdb\_ot\_entity\] The following attributes in the OT Device \[cmdb\_ot\_entity\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |ISA entity site|isa\_entity\_site| |OT discovery source ID|ot\_correlation\_id| |Device criticality|business\_criticality| |Purdue level|purdue\_level| |Zone|zone| |OT device type|ot\_asset\_type| |IRE criterion attribute|ire\_criterion\_attribute| ## PLC \[cmdb\_ci\_ot\_plc\] The following attributes in the PLC \[cmdb\_ci\_ot\_plc\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Most recent discovery|last\_discovered| |Switch position|switch\_position| |Switch remote|switch\_remote\_mode| ## Serial Number \[cmdb\_serial\_number\] The following attributes in the Serial Number \[cmdb\_serial\_number\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Serial Number|serial\_number| |Serial Number Type|serial\_number\_type| |Valid|valid| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Serial Number \[cmdb\_serial\_number\]|Reference|Hardware \[cmdb\_ci\_hardware\]| |Network Adapter \[cmdb\_ci\_network\_adapter\]|Reference|Hardware \[cmdb\_ci\_hardware\]| **Parent Topic:**[Service Graph Connector for Microsoft Defender for IoT \(Azure\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/operational-technology/operational-technology-manager/integration-sgc-microsoft-defender-iot-azure.md)
| title | CMDB classes targeted in the Service Graph Connector for Microsoft Defender for IoT \(Azure\) |
| description | When you complete the guided setup, you can configure the integration to periodically pull data from a Service Graph Connector for Microsoft Defender for IoT \(Azure\) \(Azure\) project. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/operational-technology/operational-technology-manager/sgc-microsoft-d4iot-azure-classes.html |
| release | brazil |
| product | Operational Technology Manager |
| classification | operational-technology-manager |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 5 |
| breadcrumb | Service Graph Connector for Microsoft Defender for IoT \(Azure\)IntegrateOperational Technology ManagerOperational Technology |