diff --git a/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/README.md b/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/README.md new file mode 100644 index 0000000000..25b8764c0a --- /dev/null +++ b/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/README.md @@ -0,0 +1,9 @@ +This ServiceNow business rule script is designed to detect configuration drift in a Configuration Item (CI) by comparing its current state to the most recent baseline record stored in the cmdb_baseline table. + +What it Does – In Simple Terms: +Gets the latest baseline for the current CI. +Compares key fields (ram, cpu_count, os) between the current CI and the baseline. +If differences (a "drift") are found: +It logs the drift in a custom table (u_drift_log). +It triggers an event (ci.drift_detected) to possibly notify or take further action. +. diff --git a/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/code.js b/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/code.js new file mode 100644 index 0000000000..04a6edf5ae --- /dev/null +++ b/Specialized Areas/CMDB/Detect Configuration Drift Compare to Baseline/code.js @@ -0,0 +1,34 @@ +(function executeRule(current, previous) { + var baseline = new GlideRecord('cmdb_baseline'); + baseline.addQuery('ci', current.sys_id); + baseline.orderByDesc('sys_created_on'); + baseline.query(); + + if (baseline.next()) { + var drift = false; + var changes = []; + + if (baseline.ram != current.ram) { + drift = true; changes.push('RAM'); + } + + if (baseline.cpu_count != current.cpu_count) { + drift = true; changes.push('CPU'); + } + + if (baseline.os != current.os) { + drift = true; changes.push('OS'); + } + + if (drift) { + var log = new GlideRecord('u_drift_log'); + log.initialize(); + log.u_ci = current.sys_id; + log.u_detected_on = new GlideDateTime(); + log.u_drift_fields = changes.join(', '); + log.insert(); + + gs.eventQueue('ci.drift_detected', current, changes.join(', ')); + } + } +})(current, previous);