logo

NJP

New App: Data Discovery - Search Your ServiceNow Tables for Data by Patterns

Import · May 09, 2023 · video

foreign [Music] it's Justin thank you for watching and welcome to my house that's Justin's house in this video I'm going to show you one of the new servicenow applications that was dropped in the Q2 May 2023 store release from the service now I've got up my previous SSH episode but real quickly here we're going to search and find the one of the ones that I was able to get my hands on inside of my PDI and that was Data Discovery you can see here data Discovery so data Discovery getting you the ability or giving you the ability to discover sensitive use data using out of the box data patterns or by creating custom reject pattern regex patterns to act on so let's take a look at the store this is a little graphic for this is what it looks like we're on version 1.0.0 it came out again on May the 4th and so I got this installed in my instance and what first threw me off when I searched for data discovery which you can see there um at the top I don't know why that just went away let's try that again there we go my highlight tool data Discovery was that this reference to Classic I was like well is this a new app or is this not a new app so what I did is I went poking around in studio pulled up the application and I was like okay the application menus on this actually say classic so I'm in the right application you can see it there um data patterns all data patterns Discovery classic and finding so I know I'm in the right place now what I didn't want to do was do this without you guys now what I haven't done is actually practice this I wanted to discover this with you I'm trying to do that more and so basically what I'm going to do I took a look at the Active data patterns there weren't any then I took a look at all data patterns we see we've got a credit card for AMEX Diners Club Discovery MasterCard and visa and they're using some red deck so you can see right here same for email and social security number and Us phone number for those of you that aren't in the US social security number is kind of our government issued ID number for taxes and for um retirement stuff so social security number is something you want to sure that's not somewhere unprotected in your instance so I was like okay email is something that is relevant so let's go and add an active data pattern for email I was like well maybe I should set up a Target table first because I don't know what I'm doing it oh and by the way there is no documentation for this so if you go over to the release notes there's the release notes in the documentation site but that's it there's no actual information on how to use this or discover this if you do find it leave me a note in the comments below because I couldn't find it and I spent all day in the documentation site but anyways it looks like a pretty straightforward app we'll find out here in a second so new table I'm going to add two tables I'm going to add my Store applications so my Store applications and the version history they shouldn't have email addresses in them so that should be a good test of whether this is actually finding stuff or not so I'm just going to search for a store app and I should be able to see my table that has Store applications so I hit submit okay that's interesting um it just puts it in a table and then I'm gonna go grab it for my Store applications there's a version history table associated with each store application um so I can keep track of the version history on that so I'm going to search for version history Here We Go version history and make that one of the tables that it searches okay so I've got two target tables now let's go set that active data pattern um I'm going to hit edit I guess and okay cool edit and I'm going to choose email and save that let's actually go look at that data pattern so you can see the regex expression that I would not have been able to come with with on my own for that so that thank goodness that that's an out of the box data pattern um so that's it and then I think next is to go run the job so let's go to data Discovery job yeah oh well this is interesting okay like I said having practice we'll set up a new job since one doesn't seem to exist third time's a charm hopefully so let's go ahead and create another demo for YouTube this is what happens you don't practice and we'll call those three won't leave that alone and then we'll do 16 uh not 16. Justin come on 3 13 35 because it's 16 34 right now and we'll get it till 1340. um and that's on Pacific time will open backed up schedule the job and uh and then I should be able to go while that's it take about a minute here to kick off but go to schedule jobs like I was trying to do before and look at today's scheduled jobs and we'll scroll down to 13.35 get to okay there's 34. there it is Data Discovery okay what's data Discovery Okay so we've got data Discovery you have to run once record cannot be found well that's interesting it's gone did it just delete itself after it ran because this 1335 let's just check 1336. yeah it's not there okay interesting it just disappeared you saw that recorded live we'll get back to number three um it did it completed and summary total patterns use one total column scan a total row scan 7306 two tables zero matches found and it ran in 661 milliseconds um it's because Zero Records that must be why I have no data Discovery findings which is cool um that's good I don't have email addresses potentially in either of those tables which is good but what I do know is in those tables and it's not out of the box are ticket numbers I've seen people I've seen vendors put in stories and problems including servicenow into their ticket numbers so let's take a look at what I mean if you look at the stories we'll just search for stories here uh Agile development stories um they've got Str Y and then seven different numbers after that uh same for uh we'll just do incident real quick as an example if I look at incident um we'll go to all there's usually three three letters and then seven numbers so one two three letters one two one two one two three four five six seven numbers I got that right zeros are throwing me off so four zeros five six seven yeah seven numbers another one I see often is problems so search for a problem e problem all and then I should see prb and then seven numbers right so that's a pattern um I actually don't know how to do rejects so we're gonna cheat here uh let me hide my bookmarks on that screen over there before I drag this over and then now we'll pull this up I'm on chat GPT and shout out to Michael Herron who is a previous guest on my channel showed me how to do this uh give me the regex or regular expression I guess I could say four three letters followed by seven numbers and hopefully chat DPT gives me something I can work with yes it does okay look at that I never would have come up with that on my own um overlooking a season teaching me that little tilde is or the carrot asserts the start of the search string A to Z matches the three numbers and then the D represents exactly seven numbers and it starts at the end of the string that's a really helpful expansion so I'm going to copy that code thank you open Ai and chat DPT for that and we're gonna go to date of discovery where we were before we look at data patterns I'm going to create my own data pattern and I'll just call this ticket number and we'll put in the and you know for the description maybe I'll steal that from uh chapter TBT yes uh three exactly three letters upper or lower followed by exactly seven numbers that's the description because that's what I want we'll go ahead and submit that oh I see a test button Okay cool so I'll save that oh this would be fun can I test this I can test it um okay we'll put in a bunch of text I'll just put in um what chat TPT gave me so put in that string here and then in the middle of the string I'll just put in um a story number s-t-r-y no I think it's three three oh let's go let's go prb prb and then one two three four five six seven I have seven numbers I'll test it and it was not discovered oh so that's interesting it didn't work prb one two three four five six seven numbers hmm so what is it what does it want there I thought it was regex well that's interesting to know I can test when I'm doing this and let's go back here look at let's look at um email and we'll is there there's no tests items read only based on its protection policy probably because I made it right oh wrong app no I'm in the data Discovery application so it's not that so I can't test this one and test a credit card only so the out of the box looks like a read-only my ticket number is not working um let's get rid of the capital capitals and lower I'm just going to do all caps and Then followed by three numbers and hit update I'm just going to compare mine's formatted a little bit differently from this man I wish I had some instructions on how I should be doing this but let's see they're looking for on this one credit card numbers starts with let's see if we can learn from what they're doing um by the description credit card number starts with 34 or 37 so slash B 47 zero through nine and then it was 13 numbers long slash B so that's the pattern there seems to do the slash B okay let's change mine up a bit and let's do the carrot will change that to slash B and that's three characters and we'll do the slash B and then let's put that lowercase A through Z back in like it was there and that kind of matches the pattern that they're doing there if I'm figuring this out right so let's go ahead and test it we'll test it we'll copy in that paste again we'll copy and paste in that text again and then let's put a problem number in the middle prb uh one two three four five six seven test it it was discovered all right so Justin there's a little bit of rejects I guess all right so that's good it was discovered uh we'll cancel that now I've got a new pattern now let's make a um I've already set up the target tables so that's good I need to activate that data pattern select the active data patterns we'll edit that we'll leave email in let's add the ticket number hit save and let's schedule new jobs so we've got a data Discovery job we'll do demo for YouTube four it's gonna be a lot of editing on this one to make this not for long all right 1641 we'll do this at 13.42 see if I could do it in time 13 and we'll do 47 at the stop time oh it's 42 again so we'll change this to 43 clock just flipped you can't see it it's in the upper right hand corner and we'll do 48 just give it a five minute window to actually run hit submit open it back up and hit schedule and that should schedule that job to run here in about a minute okay guys I just ran it updated right in front of me uh we gotta stay completed and if you look there in the middle use two total patterns scan date columns uh 7 306 rows two tables 18 matches found took 730 milliseconds so lightning fast there on the speed but the difference is I actually have some results so let's refresh the list down here and good I've got release notes is where it found it I was expecting that in the release notes table it found the ticket number 18 scan 4779 rows and got a percentage of matching rows at 0.38 percent and let's open up that entry all right so down below here there's the record number I mean the dictionary entry which I clicked on the table the data pattern so let's use the little I button I don't want to use this classify button yet until I know what I'm doing so I'll open the record okay there's the discovery job total row scan card data pattern total row scan count data pattern percentage of matching rows data pattern match count and I guess I can say classified or ignored okay um so let's go ahead and check the box and hit classify what happens the following tables columns will be associated with the selected data classes and as a result will be subject to all the rules and restrictions applicable to the corresponding data classes and what can I put in here there's nothing to select I can select a data classification of confidential internal person identifiable public or restricted let's call this public okay it puts it in that box there that's why I couldn't click on anything so now I can click on it hit X okay we'll put it back so I'm classifying that table is public hit classify and we'll go ahead and reload again I'm learning this with you I haven't done this before and that's it so that's done and I guess I would run that as many times as I need to define the different data in those different tables but let's see I haven't explored all of data Discovery yet let's check out did anything happen with my dashboard which is the only thing I guess I could go look at findings which we know I got the one finding but let's go take a look at the dashboard the dashboard when I first clicked on it was empty there was nothing on it hopefully now that I've done some stuff yep of course it has some information I've got my four different jobs that as I was learning how to use this but it did take me too long discover data patterns take a number uh they discover findings by status and discovered tables which is going to be the total data pattern match count and and there's the table name is this long and you can't read it in the legend there and then it found in the column as the release notes column for that table and 0.38 of the rows which 18 of them match that pattern so that is the new data Discovery app uh by Justin I learned it with you as I was going I'll edit out all the long stuff but I hope you found this video helpful if you did please like Please Subscribe or share with somebody who you think might be interested in scanning their environment looking for patterns of data um to see if it needs to be classified and managed right so now you know it's there now you got to do something take an action that's it don't forget to always be learning [Music] thank you

View original source

https://www.youtube.com/watch?v=A9qbXmhNRZ8