How IRE Protects Your ServiceNow CMDB

IRE is the controlled entry point for CI data. Identification decides whether an incoming item matches an existing CI. Reconciliation then decides whether that source may update each attribute. This article turns those concepts into a practical onboarding and test plan.

Original CMDB learning diagramControlled CI data path

01Source payload

02IRE controls

03Trusted CMDB

Stage	Decision	Output
Classify	Which CI class?	Server
Identify	Existing CI match?	Match or create
Reconcile	May source update?	Protected attributes

Created for Learn Tech with Ravi. Training visual, not a copied product screenshot.

The problem IRE solves

Discovery, cloud connectors, SCCM and manual processes can describe the same server differently. Direct inserts may create multiple CIs, while uncontrolled updates allow a lower-quality source to overwrite trusted values.

Incoming source	Identifier available	Risk without control
Discovery	Serial number, name, IP	Duplicate when identifiers are missing
Cloud connector	Provider native ID	Same VM represented twice
Asset feed	Asset tag or serial number	Operational attributes overwritten

Processing sequence

01Classify the payload into the correct CI class.
02Evaluate identification rules in their configured order.
03Match one existing CI or create a CI when no match exists and creation is allowed.
04Apply reconciliation precedence for each incoming attribute.
05Process relationships and return object-level results or errors.

Practical note

IRE does not make poor source data trustworthy. Required identifiers, source ownership and exception monitoring remain governance responsibilities.

Configure identification

01Open CI Class Manager and select the target class, such as Server or Computer.
02Review inherited identification rules before creating another rule.
03Choose stable attributes that are present in the incoming source. Serial number plus serial number type is usually safer than name alone.
04Define ordered identifier entries only when there is a legitimate alternate matching strategy.
05Test payloads with complete, partial and conflicting identifiers in a non-production instance.

Do not make IP address the only identity of a long-lived server.
Do not create nearly identical rules on parent and child classes without checking inheritance.
Do not bypass IRE with direct GlideRecord inserts into CMDB classes.

Configure reconciliation

Create data source rules and precedence based on ownership, not convenience. A source with lower precedence can still populate an empty attribute depending on the configured reconciliation behaviour, but it should not overwrite a protected value owned by a stronger source.

Attribute group	Example authoritative source	Reason
OS and hardware facts	Discovery	Observed directly from infrastructure
Cloud-native identifiers	Cloud connector	Owned by the provider integration
Business owner and support context	Governed business feed	Owned outside infrastructure scan
Lifecycle status	Approved lifecycle process	Must not be reset by discovery

Practical payload pattern

Practical exampleValidate in a non-production instance

var payload = {
  items: [{
    className: 'cmdb_ci_server',
    values: {
      name: 'app-srv-01',
      serial_number: 'SN-90871',
      serial_number_type: 'system'
    }
  }]
};

var response = SNC.IdentificationEngineScriptableApi
  .createOrUpdateCI('My Trusted Source', JSON.stringify(payload));

gs.info(response);

Practical note

Run controlled tests and use an authorised source name configured in your environment. API availability and preferred integration method should be verified for your ServiceNow release and application scope.

Validation scenarios

Scenario	Expected result
Same serial number arrives again	Existing CI updates, no duplicate
Same name but different serial number	No false match based only on name
Lower-priority source changes protected field	Trusted value remains
Authoritative source changes protected field	Value updates
Required identifier missing	Clear partial/error result for investigation
Relationship references unknown endpoint	Relationship error is visible and monitored

Continue practical learning.

Explore more implementation-focused ServiceNow and architecture guides.

Explore more articles