Event Sources
About 10% of the CIS-EM exam — see all 5 domains.
The smallest domain: how specific monitoring tools feed Event Management.
Connectors and connector instances
A connector definition is the template describing how to talk to a given source type; a connector instance is a configured copy pointing at a specific server with its credentials and schedule. Connector instances run on a MID Server. ServiceNow ships connector definitions for common monitors, and you can build custom ones.
Representative sources
- Microsoft SCOM (System Center Operations Manager): a pull connector instance collects alerts/events from SCOM, typically using PowerShell on the MID Server's Windows host. SCOM has both an event connector and a separate metric connector for Operational Intelligence.
- SolarWinds: a connector instance collects events from the SolarWinds monitor; configured with the SolarWinds host, credentials, and polling schedule.
- Other supported sources: Nagios, Zabbix, SCOM, SolarWinds, and many more, plus generic REST/web service ingestion for anything without a packaged connector, and email-based event ingestion in some cases.
- SNMP traps: the SNMP trap collector is a MID Server extension that listens for traps and sends them to the instance, where Event Management processes them as events. Syslog arriving through a MID Server is a Health Log Analytics data input (for example Rsyslog), not an Event Management event listener.
- Push through a MID Server: the MID Web Server extension lets a MID Server accept events pushed over REST from tools that cannot reach the instance and forward them to the instance.
Operational Intelligence / Metric Intelligence (metric-based sources)
Beyond discrete events, Event Management ingests metrics (time-series data such as CPU, memory, latency). The MID Server's Operational Intelligence extension pulls raw metrics, the platform learns each metric's normal bound/baseline, and anomaly detection flags deviations. Anomalies are scored 0 to 10, mapped onto the five severity levels and visualized in the Metric Explorer and Anomaly Map. Anomalies can generate alerts just like events, enabling detection before a static threshold is crossed.
Health Log Analytics (log-based sources)
Health Log Analytics (HLA) ingests machine-generated log data in real time, learns normal log patterns, and detects anomalous log behavior (new error signatures, sudden volume spikes). HLA triages related issues, helps identify root cause, and can generate alerts that flow into the same Event Management alert lifecycle, extending AIOps coverage from metrics and events to logs.
Sample questions from this domain
Three of the 26 in this domain, with the reasoning. The full set is in the question bank.
Which of the following is an example of an event source for Event Management?
- A. A Discovery schedule that probes servers and updates their CI records each night
- B. A Service Mapping pattern that maps the application services running on each host
- C. A third-party infrastructure monitoring tool sending events via a connector ✓
- D. A Performance Analytics indicator that scores the open alert backlog each day
Why: A third-party monitoring tool that sends events through a connector is a classic event source: its events land in em_event for processing. Discovery schedules and Service Mapping patterns populate CI and service data in the CMDB, and Performance Analytics indicators report on data already in the instance; none of them generates monitoring events.
Which integration style lets a monitoring tool send events directly to ServiceNow without the MID Server polling it?
- A. A pull connector instance that a MID Server runs on a schedule
- B. A Discovery schedule that collects events while it probes the hosts
- C. A Metric Intelligence collector run by the MID Server extension
- D. A push integration to the Event Management inbound REST endpoint ✓
Why: In a push integration the monitoring tool itself sends events to the Event Management inbound REST endpoint (/api/global/em/jsonv2), so no MID Server polling is involved. A pull connector instance is run by a MID Server on a schedule, the Metric Intelligence extension on a MID Server collects metric data rather than receiving pushed events, and Discovery schedules populate the CMDB instead of collecting events.
Which event source type requires a MID Server to reach an on-premises tool that cannot send outbound traffic to the cloud?
- A. A push connector that sends to the instance
- B. A pull connector executed by the MID Server ✓
- C. An inbound email that the instance parses
- D. A webhook sent directly to the instance
Why: A tool that cannot send outbound traffic cannot push, so a MID Server inside the network runs a pull connector that queries the tool and forwards its events. A push connector, a direct webhook, and an email message all depend on the tool sending traffic out to the instance.