Event Sources
About 10% of the CIS-EM exam — see all 5 domains.
The smallest domain: how specific monitoring tools feed Event Management.
Connectors and connector instances
A connector definition is the template describing how to talk to a given source type; a connector instance is a configured copy pointing at a specific server with its credentials and schedule. Connector instances run on a MID Server. ServiceNow ships connector definitions for common monitors, and you can build custom ones.
Representative sources
- Microsoft SCOM (System Center Operations Manager) — a pull connector instance collects alerts/events from SCOM, typically using PowerShell on the MID Server's Windows host. SCOM has both an event connector and a separate metric connector for Operational Intelligence.
- SolarWinds — a connector instance collects events from the SolarWinds monitor; configured with the SolarWinds host, credentials, and polling schedule.
- Other supported sources — Nagios, Zabbix, SCOM, SolarWinds, and many more, plus generic REST/web service ingestion for anything without a packaged connector, and email-based event ingestion in some cases.
Operational Intelligence / Metric Intelligence (metric-based sources)
Beyond discrete events, Event Management ingests metrics (time-series data such as CPU, memory, latency). The MID Server's Operational Intelligence extension pulls raw metrics, the platform learns each metric's normal bound/baseline, and anomaly detection flags deviations. Anomalies are scored 0–10, mapped onto the five severity levels and visualized in the Metric Explorer and Anomaly Map. Anomalies can generate alerts just like events, enabling detection before a static threshold is crossed.
Health Log Analytics (log-based sources)
Health Log Analytics (HLA) ingests machine-generated log data in real time, learns normal log patterns, and detects anomalous log behavior (new error signatures, sudden volume spikes). HLA triages related issues, helps identify root cause, and can generate alerts that flow into the same Event Management alert lifecycle — extending AIOps coverage from metrics and events to logs.
Sample questions from this domain
Three of the 26 in this domain, with the reasoning. The full set is in the question bank.
Which of the following is an example of an event source for Event Management?
- A. The Service Catalog request form
- B. The survey designer
- C. A third-party infrastructure monitoring tool sending events via a connector ✓
- D. The knowledge base feedback widget
Why: A third-party monitoring tool sending events through a connector is a classic event source. The Service Catalog form, knowledge feedback widget, and survey designer do not generate monitoring events.
Which integration style lets a monitoring tool send events directly to ServiceNow without the MID Server polling it?
- A. A pull connector on a schedule
- B. A CMDB import set only
- C. A Discovery schedule
- D. A push integration to the Event Management inbound REST endpoint ✓
Why: A push integration sends events directly to the inbound REST endpoint without MID Server polling. A pull connector polls on a schedule, Discovery schedules find CIs, and a CMDB import set loads CI data rather than events.
Which event source type requires a MID Server to reach an on-premises tool that cannot send outbound traffic to the cloud?
- A. An email-based source
- B. A pull connector executed by the MID Server ✓
- C. A manual UI entry
- D. A direct push from the tool to the instance
Why: When an on-prem tool cannot push outbound, a pull connector run by the MID Server collects its events. A direct push is impossible if the tool cannot send outbound, and email or manual UI entry are not standard scalable event sources for this scenario.