CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint
reference brazil Updated Sep 10, 2026 2 min read sgc-cmdb-msdefender-classes.md
When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item [cmdb_ci] table.
Computer [cmdb_ci_computer]
The following attributes in the Computer [cmdb_ci_computer] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
| Parent class | Relationship type | Child class |
|---|---|---|
| Computer [cmdb_ci_computer] | Owns::Owned by | IP Address [cmdb_ci_ip_address] |
| Computer [cmdb_ci_computer] | Owns::Owned by | Network Adapter [cmdb_ci_network_adapter] |
| Computer [cmdb_ci_computer] | Reference | SG-Defender Machines Related [sn_defender_integ_sg_defender_machines_related] |
| Computer [cmdb_ci_computer] | Reference | Software Installation [cmdb_sam_sw_install] |
IP Address [cmdb_ci_ip_address]
The following attributes in the IP Address [cmdb_ci_ip_address] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Install Status | install_status |
| IP Address | ip_address |
| IP version | ip_version |
| Name | name |
| Nic | nic |
| Parent class | Relationship type | Child class |
|---|---|---|
| IP Address [cmdb_ci_ip_address] | Reference | Network Adapter [cmdb_ci_network_adapter] |
Network Adapter [cmdb_ci_network_adapter]
The following attributes in the Network Adapter [cmdb_ci_network_adapter] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Discovery source | discovery_source |
| Install Status | install_status |
| MAC Address | mac_address |
| Name | name |
| Parent class | Relationship type | Child class |
|---|---|---|
| Network Adapter [cmdb_ci_network_adapter] | Reference | Server [cmdb_ci_server] |
| Network Adapter [cmdb_ci_network_adapter] | Reference | Computer [cmdb_ci_computer] |
SG-Defender Machines Related [sn_defender_integ_sg_defender_machines_related]
The following attributes in the SG-Defender Machines Related [sn_defender_integ_sg_defender_machines_related] table are populated by collected data:
| Attribute label | Attribute name |
|---|---|
| Agent Version | agent_version |
| Device Id | device_id |
| Exposure Level | exposure_level |
| First Seen | first_seen_date |
| Health Status | health_status |
| IsAadJoined | isaadjoined |
| Last Reported | last_reported |
| Managed by | managed_by |
| Onboarding Status | onboarding_status |
Software [cmdb_ci_spkg]
The following attributes in the Software [cmdb_ci_spkg] table are populated by collected data when the Software Asset Management (SAM) application isn't installed:
| Attribute label | Attribute name |
|---|---|
| Key | key |
| Name | name |
| Version | version |
| Parent class | Relationship type | Child class |
|---|---|---|
| Software [cmdb_ci_spkg] | Reference | Software Instance [cmdb_software_instance] |
Software Installation [cmdb_sam_sw_install]
The following attributes in the Software Installation [cmdb_sam_sw_install] table are populated by collected data when the SAM application is installed:
| Attribute label | Attribute name |
|---|---|
| Discovery source | discovery_source |
| Display name | display_name |
| Version | version |
Software Instance [cmdb_software_instance]
The following attributes in the Software Instance [cmdb_software_instance] table are populated by collected data when the SAM application isn't installed:
| Attribute label | Attribute name |
|---|---|
| Installed on | installed_on |
| Name | name |
| Parent class | Relationship type | Child class |
|---|---|---|
| Software Instance [cmdb_software_instance] | Reference | Server [cmdb_ci_server] |
Windows Server [cmdb_ci_win_server]
The following attributes in the Windows Server [cmdb_ci_win_server] table are populated by collected data when the SAM application isn't installed:
| Attribute label | Attribute name |
|---|---|
| Class | sys_class_name |
| Discovery source | discovery_source |
| Install Status | install_status |
| Name | name |
| Operating System | os |
| OS Version | os_version |
| Parent class | Relationship type | Child class |
|---|---|---|
| Windows Server [cmdb_ci_win_server] | Owns::Owned by | Network Adapter [cmdb_ci_network_adapter] |
| Windows Server [cmdb_ci_win_server] | Owns::Owned by | IP Address [cmdb_ci_ip_address] |
| Windows Server [cmdb_ci_win_server] | Reference | SG-Defender Machines Related [sn_defender_integ_sg_defender_machines_related] |
| Windows Server [cmdb_ci_win_server] | Reference | Software Installation [cmdb_sam_sw_install] |
144 lines · 5.9 KB
--- title: CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint description: When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. locale: en-US canonical_url: https://www.servicenow.com/docs/r/servicenow-platform/service-graph-connectors/sgc-cmdb-msdefender-classes.html release: brazil product: Service Graph Connectors classification: service-graph-connectors topic_type: reference last_updated: "2026-09-10" reading_time_minutes: 2 breadcrumb: [Microsoft Defender for Endpoint, Service Graph Connectors, Integrating third-party data into CMDB, Configuration Management, Extend ServiceNow AI Platform capabilities] --- # CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. ## Computer \[cmdb\_ci\_computer\] The following attributes in the Computer \[cmdb\_ci\_computer\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Class|sys\_class\_name| |Discovery source|discovery\_source| |Install Status|install\_status| |Name|name| |Operating System|os| |OS Version|os\_version| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Computer \[cmdb\_ci\_computer\]|Owns::Owned by|IP Address \[cmdb\_ci\_ip\_address\]| |Computer \[cmdb\_ci\_computer\]|Owns::Owned by|Network Adapter \[cmdb\_ci\_network\_adapter\]| |Computer \[cmdb\_ci\_computer\]|Reference|SG-Defender Machines Related \[sn\_defender\_integ\_sg\_defender\_machines\_related\]| |Computer \[cmdb\_ci\_computer\]|Reference|Software Installation \[cmdb\_sam\_sw\_install\]| ## IP Address \[cmdb\_ci\_ip\_address\] The following attributes in the IP Address \[cmdb\_ci\_ip\_address\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Install Status|install\_status| |IP Address|ip\_address| |IP version|ip\_version| |Name|name| |Nic|nic| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |IP Address \[cmdb\_ci\_ip\_address\]|Reference|Network Adapter \[cmdb\_ci\_network\_adapter\]| ## Network Adapter \[cmdb\_ci\_network\_adapter\] The following attributes in the Network Adapter \[cmdb\_ci\_network\_adapter\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Discovery source|discovery\_source| |Install Status|install\_status| |MAC Address|mac\_address| |Name|name| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Network Adapter \[cmdb\_ci\_network\_adapter\]|Reference|Server \[cmdb\_ci\_server\]| |Network Adapter \[cmdb\_ci\_network\_adapter\]|Reference|Computer \[cmdb\_ci\_computer\]| ## SG-Defender Machines Related \[sn\_defender\_integ\_sg\_defender\_machines\_related\] The following attributes in the SG-Defender Machines Related \[sn\_defender\_integ\_sg\_defender\_machines\_related\] table are populated by collected data: |Attribute label|Attribute name| |---------------|--------------| |Agent Version|agent\_version| |Device Id|device\_id| |Exposure Level|exposure\_level| |First Seen|first\_seen\_date| |Health Status|health\_status| |IsAadJoined|isaadjoined| |Last Reported|last\_reported| |Managed by|managed\_by| |Onboarding Status|onboarding\_status| ## Software \[cmdb\_ci\_spkg\] The following attributes in the Software \[cmdb\_ci\_spkg\] table are populated by collected data when the Software Asset Management \(SAM\) application isn't installed: |Attribute label|Attribute name| |---------------|--------------| |Key|key| |Name|name| |Version|version| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Software \[cmdb\_ci\_spkg\]|Reference|Software Instance \[cmdb\_software\_instance\]| ## Software Installation \[cmdb\_sam\_sw\_install\] The following attributes in the Software Installation \[cmdb\_sam\_sw\_install\] table are populated by collected data when the SAM application is installed: |Attribute label|Attribute name| |---------------|--------------| |Discovery source|discovery\_source| |Display name|display\_name| |Version|version| ## Software Instance \[cmdb\_software\_instance\] The following attributes in the Software Instance \[cmdb\_software\_instance\] table are populated by collected data when the SAM application isn't installed: |Attribute label|Attribute name| |---------------|--------------| |Installed on|installed\_on| |Name|name| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Software Instance \[cmdb\_software\_instance\]|Reference|Server \[cmdb\_ci\_server\]| ## Windows Server \[cmdb\_ci\_win\_server\] The following attributes in the Windows Server \[cmdb\_ci\_win\_server\] table are populated by collected data when the SAM application isn't installed: |Attribute label|Attribute name| |---------------|--------------| |Class|sys\_class\_name| |Discovery source|discovery\_source| |Install Status|install\_status| |Name|name| |Operating System|os| |OS Version|os\_version| |Parent class|Relationship type|Child class| |------------|-----------------|-----------| |Windows Server \[cmdb\_ci\_win\_server\]|Owns::Owned by|Network Adapter \[cmdb\_ci\_network\_adapter\]| |Windows Server \[cmdb\_ci\_win\_server\]|Owns::Owned by|IP Address \[cmdb\_ci\_ip\_address\]| |Windows Server \[cmdb\_ci\_win\_server\]|Reference|SG-Defender Machines Related \[sn\_defender\_integ\_sg\_defender\_machines\_related\]| |Windows Server \[cmdb\_ci\_win\_server\]|Reference|Software Installation \[cmdb\_sam\_sw\_install\]|
| title | CMDB classes targeted in Service Graph Connector for Microsoft Defender Endpoint |
| description | When you complete setting up the connection, you can configure the integration to pull data periodically from machines utilizing the Microsoft Defender for Endpoint security solution. The data is saved in tables that extend from the Configuration item \[cmdb\_ci\] table. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/servicenow-platform/service-graph-connectors/sgc-cmdb-msdefender-classes.html |
| release | brazil |
| product | Service Graph Connectors |
| classification | service-graph-connectors |
| topic_type | reference |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Microsoft Defender for EndpointService Graph ConnectorsIntegrating third-party data into CMDBConfiguration ManagementExtend ServiceNow AI Platform capabilities |