Before
Security and IT teams queried four platforms separately, normalized hostnames manually, and compared asset lists to find missing CMDB records or security agents. They then created and routed tickets for each category of discrepancy, with the process typically running weekly and leaving gaps unresolved for several days.
How it works
- Collect and normalize the daily inventories from Intune, CrowdStrike, Qualys, and the ServiceNow CMDB.
- Compare the inventories, apply approved exclusions, and classify assets missing from the CMDB, EDR, or Qualys coverage.
- Create only the necessary ServiceNow incidents and route Qualys gaps according to whether the device is known to Entra or Intune.
Workflow details
- Scheduled inventory collection: Every day at 06:00 Europe/Paris, the workflow retrieves managed devices from Intune, CrowdStrike host details, Qualys assets with an agent, and computer configuration items from the ServiceNow CMDB.
- Hostname normalization and reconciliation: It normalizes hostnames across the four inventories and compares the resulting asset sets to detect devices absent from the CMDB, missing CrowdStrike EDR coverage, or missing a Qualys agent.
- Exception handling and enrichment: Before preparing remediation, the workflow retrieves approved exclusions and previously accepted discrepancies. An AI processing stage organizes the findings into structured categories, counts the affected assets, and generates incident-ready descriptions.
- Remediation routing: Assets missing a Qualys agent are separated according to whether a corresponding Intune or Entra device identity is available. Known devices are prepared for the configured deployment path, while devices not known to Entra are identified for manual agent deployment.
- ServiceNow handoff: Conditional checks create incidents only for categories with findings, covering CMDB discrepancies, missing CrowdStrike sensors, and Qualys agent gaps. The result is a documented, categorized handoff for IT and security teams.
What changed
The reconciliation now runs daily and performs the cross-platform checks automatically before an analyst reviews the queue. Findings are grouped into conditional ServiceNow incidents, while approved discrepancies remain available for filtering in later runs.
Work removed
Querying four tools separately, normalizing hostnames, comparing inventory lists, checking approved exclusions, identifying each coverage gap, grouping findings by category, and drafting the corresponding ServiceNow incident descriptions.
Expected outcome
The workflow is expected to remove approximately 15–30 minutes of daily cross-tool comparison and provide consistent coverage of CMDB, EDR, and Qualys discrepancies.
