Automating Update Set scan for Instance Scan

Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

Hi there,

Instance Scan is one of the most recent additions of new applications within ServiceNow. A powerful application with which you can interrogate your instance, interrogate Process Records and Data with Scan Checks (which you can create yourself) which check for categories like Performance, Security, Upgradeabilyt, etcetera. You can choose to scan your whole instance, though also update sets, scoped applications, or individual artifacts.

In a previous article, I shared the coding needed for "automating the different Instance Scan scan types". Let's go a step further this time, a step further to actually automate scanning an Update Set!

Executing scans through script

To start of with, let's just copy/paste some scripting from the article mentioned in which I shared the coding needed for automating the different Instance Scan scan types. Concerning Update Sets this would be:

var scan = new sn_instance_scan.ScanInstance();
var result = scan.triggerUpdateSetScan(updatesetId);

Or if it concerns multiple Update Sets and/or a specific suite, using a Scan Combo record:

var comboId = new sn_instance_scan.ScanUtil().getOrCreateComboFromSuiteAndTargets('suite_sys_id', 'table_name', ['sys_id']);

var scan = new sn_instance_scan.ScanInstance();
var result = scan.triggerScanFromCombo(comboId);

Process

To trigger this code, we first need to have a brainstorming session about the process of starting the scan. What action should trigger scanning an Update Set? Is this for example when the state of an Update Set changes to "Complete"? Or if a story record moves to state "Ready for Testing"? Or maybe you are using Scrum Tasks? Are your stories on a different instance than your Update Sets? This will differ a lot per company, these are just a few examples of the different flavors out there.

At the end of the process, for automating the code mentioned in the previous paragraph, we could think of having an Event generated which could trigger a Flow or a Script Action. A Flow sounds most scalable and manageable, though a Script Action would be achievable within 1 minute. And does this really need to be that heavily scalable and manageable? For this article, let's go for an Event. And Event which only has a Story number as Parm1 (assuming your - In Progress - Update Sets contain the Story number), and the Event triggering a Script Action.

What you still need to think of after reading this article, how to have the Event generated. For example, if your Story is not on the same Instance, creating the Event through Integration Hub or a REST Call and using Web Service Import.

Event

We just need to have an Event generated in the sysevent table, with a proper name, and as Parm1 the Story number it concerns. To be able to tie the Event to a Flow or Script Action, we would need to add an Event Registry [sysevent_register] record. Let's go for:

Script Action

The Event Registry added can be selected when adding a new Script Action [sysevent_script_action]. Concerning the scripting, we would need to query for "In Progress" Update Sets which contain the Story number. We could simply script this, or generate the filter from a breadcrumb and copying the query. Read about this method in one of my older articles: "Utilizing the breadcrumb on lists to generate your query".

Basic scripting for this query - with the usage of Parm1 - would be something like:

var getUpdateSet = new GlideRecord('sys_update_set');
getUpdateSet.addEncodedQuery('nameLIKE' + event.parm1 + '^state=in progress');
getUpdateSet._query();

while(getUpdateSet._next()) {
}

Using a Scan Combo record, an Array of sys_ids is expected, so we need to add creating an Array and expanding it within the while loop. Doing so and adding the Scan Combo code earlier pasted, this could be our full script:

(function() {

	// Define variables
	var scan_suite_sysid = gs.getProperty('glide.scan.trigger_scan.scan_suite_sysid'),
		update_set_arr = [];
	
	// Query update set(s)
	var getUpdateSet = new GlideRecord('sys_update_set');
	getUpdateSet.addEncodedQuery('nameLIKE' + event.parm1 + '^state=in progress');
	getUpdateSet._query();

	while(getUpdateSet._next()) {
		update_set_arr.push(getUpdateSet.getUniqueValue());
	}

	// Trigger scan
	var comboId = new sn_instance_scan.ScanUtil().getOrCreateComboFromSuiteAndTargets(scan_suite_sysid, 'sys_update_set', update_set_arr),
		scan = new sn_instance_scan.ScanInstance(),
		result = scan.triggerScanFromCombo(comboId);

})();

For scan_suite_sysid I did use a System Property. In this case, the System Property simply holds the sys_id of the parent Scan Suite which I use.

Creating the Event

For this article, I created a Business Rule which is triggered on update of a story in production which changes to state "Ready for Testing". The Business Rule executing a REST Message to development to create a record in the sysevent table (you might consider using an Import Set table instead).

Result

When an Event with name "instance_scan.trigger_scan.update_set" is created, the Script Action will be triggered. The Script Action will query for the Story number which has been set as Parm1 for the Event and trigger a Suite against a Combo record representing the Update Set(s).

This is just an example of how you could achieve automate scanning Update Sets with Instance Scan. I won't say this is "the" way, it's just "a" way to accomplish this.

As mentioned, you do still need to think of how the Event will be generated. Also, do you require follow-up on this? For example, having a summary of the results/numbers communicated back added to the comments of the story, etcetera. I'm interested to hear what you all come up with!

---

And that's it, hope you like it.

Kind regards,

Mark Roethof

ServiceNow Technical Platform Architect @ Quint Technology

2x ServiceNow Developer MVP

2x ServiceNow Community MVP

---

LinkedIn