4.1,4.2: Table Administration

Question 1

Lists and Forms

Answer 1

Lists and Forms provide a user-friendly interface for managing tables, records, and fields.

Question 1

ServiceNow Infrastructure

Answer 1

Everything in ServiceNow is built on a relational database accessible through the ServiceNow Platform.
Lists and Forms provide a user-friendly interface for
The ServiceNow infrastructure includes tables, records, and fields.
Tables contain records. Records correspond to rows in a table. A field is an individual column of data. The value is the data where the field and record intersect.

Question 2

Data in ServiceNow i s stored and managed according to a database structure that administrators can view and configure:

Answer 2

• Tables are a dat a st ruct ure or dat abase component , w hich cont ain records
• Records are t he dat a st ored in t ables, w hich cont ain fields
• Fields are indiv idual pieces of dat a w i t hin a record
• Values are indiv idual dat a element s t hat can be accessed t hrough a field in a record. 134

Question 3

The System Dictionary contains the definition for each and every table and field in the database.

Answer 3

Nav igate t o Al l > System Defi nition > Di cti onary t o access t he syst em dict ionary t o modify t able and field at t ributes. 134

Question 4

Adm ini st rators can use these tools for viewing and modifying the database structure:

Answer 4

*T abl es module: Provides a li st of al l t ables in t he dat abase.
*T abl es & Col umns modul e: Provides a li st of al l exist ing t ables, w ith columns, column at t ributes, and indexes.
NOTE: Tables can be creat ed t hrough eit her of t hese modules.
Schema map: Prov ides a graphical represent at ion o f t he relat ionships bet w een t ables.
Data dictionary tables: Cont ains addi t ional information t hat defines dat abase element s. 134

Question 5

Table Components

Answer 5

A table is a collection of records in the database.
*A record corresponds to a row in a table
(e.g., info about a single user)
*A Field corresponds to a column in a table (e.g., User ID or email)
*A Value is where the field and record intersect
(e.g., Paris, Rome, Miami, etc)135

Question 6

Records

Answer 6

Records are identified by a 32-character, globally unique ID, called a sys_id .
Record numbers can be automatically increment ed, and t he number format per t able in t he system can be changed by visiting the All > System Definition > Number Maintenance application. 135

Question 7

Field Attributes

Answer 7

Each field has three key attributes: a label, a name, and a value. *Field Label
The label is a user-friendly term which allows people to identify the field in the user interface.
*Field Name
The field name is a system-friendly unique term that the system uses to identify the field.
*Field Data
The values are actual data entered into the field.

Question 8

Field Label, Name, Data

Answer 8

Field data represent an individual item of data on a record, such as this user’s name, Alejandro Mascall , or his location, Frankfurt. In some cases, the value may be null (empty).
The field name is a unique term that does not always match a field’s label. For example, notice that the field name “city” is the system-friendly field name in the sys_user table that corresponds to the user-friendly field label “Location”.
The field names shown in this example are first_name, last_name, and city. They correspond to the field labels, First Name, Last Name, and Location. 136

Question 9

Reference fields

Answer 9

are identified with the reference lookup icon (ikona lupy).
The reference lookup icon opens a dialog box for locating a record to reference, presented as a list of the referenced (target) table.
If a record is specified in the reference field on the source table, you can select the reference icon to preview the referenced record (on the target table).

Question 10

A reference field

Answer 10

stores a unique system identifier (known as the sys_id) of a record on another table which is what establishes the reference relationship. For example, the Caller field on the Incident table is a reference to a record on the User [ sys_user] table.
*When you define a reference field, the system creates a relationship between the two tables. Adding a reference field to a form makes the other fields in the referenced table available to the form. Wildcard searches can be used in reference fields.
*NOTE: A reference field can refer only to records from one other table. To add a field that can refer to records on any table, use the Document ID element type.
*Administrators can create new reference fields and configure several options for reference fields. 137

Question 11

Table Relationships

Answer 11

Tables can be related to each other in various ways.
*One-to-Many
*Many-to-Many
*Database Views
*Extensions

Question 12

One-to-Many

Answer 12

Request->Requested Item1,Requested Item2.
Within a table, a field can hold a reference to a record on another table.

Question 13

Many-to-Many

Answer 13

Role A, Group A, Role B, Group B, Group Roles.
Two or more tables that can be related in a bi-directional relationship.

Question 14

Database Views

Answer 14

CMDB CI, Uptime Metrics.
Tables that can be joined using the Database Views plugin.

Question 15

Extensions

Answer 15

Incident Table-Extended table, Task table-Parent table.
A table that extends another table.

Question 16

One-to-Many : There are t hree one-to-many relat ionship fields:

Answer 16

1. Refer ence Fi el ds - Allow s a user t o select a reco rd on a t able defined by t he reference field. Example: Cal ler field on t he Incident t able allows a user t o select any record on User t able.
2. Gl i de Li st - Allow s a user t o select mul t iple records on a t able defined by t he glide l i st . Example: The Wat chli st field on t he Incident t able allows t he user t o select any record or records on t he User t able.
3. Document ID Fi el ds - Allow s a user t o select a record on any t able in t he inst ance. Example: Document field on t he Translat ed Text t able. 138

Question 17

Many-to-Many :

Answer 17

Tw o or more tables can be related in a bi-di rectional relationship, so t hat t he relat ed records are v i sible from bot h t ables in a relat ed li st . Think ahead! Your dat a model i s important. Plan so t hat you get t he model right t he fi rst t ime. A common example of a many-t o-many relat ionship i s one bet w een st udent s and classes. A st udent can regi st er for many classes, and a class can include many st udent s. If you are w orking w ith many -to-many relat ionships in Serv iceNow, you may find sys_collect ions.li st and sys_m2m .l ist useful .

Question 18

Database Views :

Answer 18

A dat abase v iew defines t able joins for reporting purposes. For example, a dat abase v iew can join t he Incident t able t o t he Met ric Defini t ion and Met ric Inst ance t ables. Thi s v iew can be used t o report on incident met rics and may include fields from any of t hese t hree t ables. The dat a in t he v i rt ual t able creat ed by a dat abase v iew i s read - only. Creat e Dat abase View s by nav igat ing t o System Defi nition > Database Vi ews.
138

Question 19

Extensions:

Answer 19

The extended table includes unique fields plus al l o f t he fields and t heir propert ies from t he parent t able.

Question 20

Table Relationships: Extended Tables

Answer 20

Tables can extend other tables, creating parent and child tables.
A table that extends (is an extension of) another table is a child class The table from which it extends is the parent class.
A child table inherits the fields of its parent (in this case, Number and Location) and allows creation of fields unique to the child class (Caller).

Question 21

Extending a table:

Answer 21

• Links the new t able to the extending table.
• Creat es syst em fields in t he new t able.
• Creates one or more database tables t o store the parent and child classes. The number of t ables t he syst em creat es depends upon t he ext ension model select ed during t able creat ion. 139

Question 22

Table Types: Base Tables

Answer 22

A parent class that is not an extension of another table is called a base table (base class).
Child Base Child Child Task
The task table is such a table, making it a parent, a base, and core table.

Question 22

Understanding Base vs . Core Tables:

Answer 22

A Cor e T abl e i s a t able t hat exi st s in t he Serv iceNow base syst em . In o t her w o rds, co re t abl es come WITH t he syst em , t hey are t here from t he st art . Thi s i s probabl y t he easi est di st inct ion o f t hi s t able t ype. I f i t i s a t able t hat comes w i th Serv iceNow, i t’ s a co re t abl e. But i t i s impo rtant t o u nderst and t hat a co re t able can al so be a parent t able (e.g. , Task ), a child t able (e.g. , Incident ) o r a base table (e.g. , Task ). 140

Question 22

Base Table

Answer 22

is a table that serves as a “base” from which other tables may extend. From t he base t abl e, you can est abli sh parent /chi ld relat ionships in t he dat abase. The child (ext ended) t able includes unique fi elds PLUS al l o f t he fi elds and propert i es w hich w ere inheri t ed from t he parent t abl e. In t he prev ious exampl e, t he Incident t able (a child) o f t he Task t able (parent ), inheri t ed t he fi elds Number and Locat ion from t he parent and t hen added i t s ow n unique fi eld Call er. What makes a base tabl e di ffer ent f r om a cor e tabl e i s that the base tabl e i s not an extens i on of another table (i t has no par ent ). A base t able can al so be considered a parent and/o r a co re t able depending on t he ci rcum st ances. 140

Question 22

In the Task table example above, the Task t able is:

Answer 22

(a) a core table because i t comes w i t h t he Serv iceNow base syst em (b) a base tabl e because i t ’ s no t ext ended from any o t her t able (no parent o f i t s ow n), and (c) a par ent table because i t has children (child classes of Incident , Problem, and Change Request ) 140

Answer 23

Depi ct ed in t he image, w e see t hat t he Task t able i s no t onl y a par ent table (because i t has children—Incident , Problem , and Change Request ), but i t i s al so a base tabl e because t he t ask t able i t sel f i s not ext ended (not an ext ension/chi ld of any ot her t abl e), AND t he Task t able i s al so a cor e tabl e because i t i s part of t he Serv iceNow base syst em . The Task t able is an int erest ing example o f how a table can be a base table, a parent table, and a core table. To ext end a t able, select t he t able t o ext end in t he Ext ends Table field on t he t able reco rd. Table ext ension is about deriv ing fields from one table to another and replicat ing records. It’s used for tables t hat contain similar data. How ever, this option is available only when you are creating a table, and not all tables are extensible. For more information, visit ServiceNow Product Documentation: Table administration 140

Question 24

Table Types: Core vs. Custom

Answer 24

*Tables that exist in the base system are called core tables.
*Tables created by admins or
developers are called custom tables.

Question 25

NOTE: When creating a new custom table

Answer 25

the table name is automatically populated based on the table label and a prefix. If t he table i s being created in a scoped application, t he name i s prefixed w i t h a namespace identifier: “ x_ ”, indicating that it is a part of an application. Otherwise, custom tables in the global application feature ” u_” as their prefix, and then the table name.
***Scoped apps are sandboxed from the system at large and utilize a restrict ed API to minimize/prevent damage t o anything outside of their ‘scope’ aka sandbox. Global apps are everything else, it ’s the default scope and has access to all parts of the system and therefore can cause damage/impact beyond t heir intent .
NOT E: Custom tables may be subject to additional licensing fees. CMDB tables can be extended ad infinitum at no charge.

Question 26

The Schema Map

Answer 26

provides a graphical representation of other tables related to a specific table.
Relationships can be filtered by extension or reference classes by checking the appropriate boxes at the top of the map. *The Schema Map is available to users with personalize_ dictionary or admin roles.

Answer 27

Tables with blue bars, including Problem and Change Phase, are t ables t hat extend t he Task t able.
Demonst rated w it h t he Problem t able, you can use t he Schema Map t o ident ify w hich columns (fields) originate on t he Problem t able, and w hich columns are inheri t ed from t he Task t able. Addi t ionally, you can see w hat field t ype t hey are.
Tables w i t h red bars, including Locat ion and User, are t ables t hat are r efer enced by t he Task t able.
A series of fi l t ers at t he t op of t he Schema Map allow you t o show /hide t ables based on cri t eria such as w het her t hey are referenced by t he Task t able, reference t he Task t able, are ext ended by t he Task t able, or ext end t he Task t able.
The Tables window on t he far right o f t he screen prov ides a summary o f al l t he tables present ed and t heir relationships. 142

Question 28

Note: Custom tables in the Global scope

Answer 28

begin with a u_prefix. It is considered good practice to rename new custom tables with meaningful names. In the example above, the name was changed to u_cmdb_ci_hardware_hhd because it is easier to type and search on HHD than Holographic Handheld. Custom tables in an Application Scope, like Service Operations Workspace: Core, will begin with x_prefix 145

Question 29

User Permissions Summary

Answer 29

*User
Authentication/ Login->Users, Groups, Roles
*Application and Modules Access->Governed by Roles
*Database Access->Tables (Records and Fields),
Governed by Global System Properties,
Governed by Access Control Rules

Question 30

3 security modules typically used by t he System Administrator:

Answer 30

• Al l > System Proper ties > Security
• Al l > System Security > Access Control (ACL)
• Al l > System Security > High Security Settings

Question 31

Elevate Role

Answer 31

The base system admin can elevate to a privileged role to access features of High Security Settings.
To elevate roles: 1.Open the user menu 2.Select Elevate role
3.Select an elevated role and click Update
4. Notice the elevated role
Elevated privileges end when you end your session, which includes “Impersonate user” — not just on log out or session time out 153

Answer 32

There may al so be times when a System Administrator needs an elevated role to accomplish higher-security tasks. Elevated roles grant modification access, allowing users to modify the Access Control List (ACL) which restricts access to data by requiring users to pass a set of requirements before they can interact with the data. To end the elevated role, uncheck the box for the selected role and select Update.
An elevated privilege role lasts only for the duration of your user session. Session timeout, logout , or Impersonate user removes the role.
NOTE: When elevated privileges are activated, an upward facing arrow will appear next to your avatar.
BEST PRACTICE: Not all admins should have the security_adm in role.
There are other elevated roles. In this example, you see the security_ admin role. However, during the class you will also see scenarios where the workplace_adm in role appears.
153

Question 33

Access control

Answer 33

is a security rule defined to restrict the permissions of a user from viewing and interacting with data.
It is executed when attempting to access any ServiceNow table and may be set at the:

Question 34

Access control rules restrict ServiceNow-specific and CRUD operations

Answer 34

Create, Read, Update (Write), Delete

Question 35

In addition to restricting CRUD operations, Access Control rules can restrict ServiceNow - specific operations on tables and fields. Additional ServiceNow operation examples include:

Answer 35

*execute: user cannot execute scripts on a record or UI page
*Edit_ ci_relations: user cannot define rela ionships between Configuration Item [cmdb_ ci] tables
*Save_ as_ template: controls the field that should be saved when a template is created
*Report_ on: user cannot create reports on the object
*Personalize_choices: user cannot right-click a choice list field and select Configure Choices

Question 36

The Access Control List (ACL)

Answer 36

contains an instance’s Access Control rules. Users with the appropriate admin permissions can add and modify rules and their definitions.

Question 37

the security_admin role has …

Answer 37

In t he base system , only the default System Administrator has the security_admin role. For others that are granted the admin role, they would also need to be granted the security_ adm in role to be able to maintain ACLs.155

Question 38

System Created Access Controls

Answer 38

To view the Access Controls associated with a table:
* Using the Filter Navigator, type:

<table>.CONFIG
* Click the Access Controls tab
When a custom table is created, the system creates four access control rules by default (create, delete, read, write).
A role is also created by default and associated with the access control rules.
{With System-created Access Controls, it is rare to have a table with no access control rules.
When a table is created, access controls are automatically created. In lab 3.1, the table, u_cmdb_ci_ hardware_ infinity, was created. In addition to the table, the following were created:
* u_infinity_ user role
* Table Access Control Rules * create * delete * read * write}156
</table>

Question 39

Access Control Definition: Permission Requirements

Answer 39

Each Access Control rule specifies:
* A valid operation - a valid action the system can take (CRUD)
* The object being secured (e.g., table, table AND field)
* The permissions required to access the object * Roles * Conditional Expressions * Scripts 157

Question 40

Access Control Definition: 3 Rule Types

Answer 40

1.table.–None–No specific field selected - this rule applies to the whole table including all its records.
2.table.field This rule applies to only one field on a record and in this case, the Caller field on an incident record.
3.table.* Wildcard – this rule applies to every field on a record without a table.field rule.

Example: Think of a house. house.–None–is the whole house. house.field is a specific room in the house. house.* is all the other rooms not defined with a house.field rule.
158

Question 41

Access Control Definition: Rule Types

Answer 41

To illustrate, when creating the rule and deciding the type (table. –none–, table. field, or table.*),we’re really referring to the field opt ions on the object . When you select –None–, not ice the name of the access control . Notice that the read, create, write, and delete operations with no restrictions on the table appear as “ u_cmdb_ci_hardware_hhd”, showing there i s no restriction on any fields. Compare this with the rule that was created using the table. field designation restricting the Asset tag field. Not ice that the name of the rule reflect s the field “u_cmdb_ci_hardware_hhd.asset. tag.
By looking at the rule name, you can see there is a restriction specific to the Asset tag field. When we create a rule with no restrictions, the –none–is a bit misleading. It really means you’ re selecting “nothing” and thereby not creating any restrictions on the table. When you create a restriction on the field, using either a specific field name or a wildcard, the name will change to reflect the restrict ion you’ve created.
159

Question 42

Using the Wildcard

Answer 42

It is important to understand the difference in behavior when choosing to use the wildcard (*) access control. 160

Question 43

How does this work? In the first example (With *):

Answer 43

• The None Access Control (which appears as just sys_user) granted all rows and all fields to both the table_admin and table_user roles.
• The .* Access Control granted all rows and all fields to the table_admin role. It seems redundant to have this Access Control because the table_admin role already had access to all rows and all fields. The purpose of this Access Control is to deny access to all other roles, even roles granted permission by the None Access Control.
• The .home_phone Access Control explicitly gives the table_user role access to the home_phone field, even though table_user was denied access to home_phone by the * Access Control . Why? Because field-specific Access Controls take precedence over .* Access Control s. 160

Question 44

How does this work? In the second example (Without *):

Answer 44

• The None Access Control (which appears as just sys_user) granted all rows and all fields to both table_admin and table_user roles.
• The .home_phone Access Control granted home_phone access to the table_admin role. Giving home_phone expl icitly to table_admin removed home_phone access from table_user, even though the table_user role was granted home_phone access by the None Access Control. 160

Question 45

Table Access Control Evaluation
Record ACL rules are processed in the following order:

Answer 45

When a session requests data, the system looks for matching access control rules.
1. Match the object against table ACL rules - most specific to most general.
2. Match the object against field ACL rules - most specific to most general.
A user must pass both table and field ACL rules to access a record object. 161

Question 46

chyba text 161 pod obr

Question 47

Who can elevate to a privileged role?

Answer 47

Note: The base system admin can elevate to a privileged role to have access to the features of High Security Settings. If you grant additional users the admin role, they cannot elevate to a privileged role.
Note: With the elevated security_admin role, you can now create access controls.