CMDB relationship mappings
Detects CMDB relationship mappings: CMDB or dependency-map wording with relationship edges (ServiceNow relationship types or A -> B edges) and populated CI fields. Topic wording alone is discovery-only.
- Type
- regex
- Engine
- boost_regex
- Confidence
- medium
- Confidence justification
- Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a relationship edge (ServiceNow relationship type such as Depends on::Used by, or an A -> B edge) or a populated CI field (CI name/ID/class, parent/child, sys_id, business/application service, support group, environment)), and 85 needs two distinct structures plus independent dependency-impact (upstream/downstream, impact analysis, server roles) evidence, so policies, blank forms and training text stay below 75.
- Detection quality
- Topic verified
- Jurisdictions
- global
- Regulations
- Security of Critical Infrastructure Act 2018 (Cth)
- Frameworks
- ISO 27001, NIST CSF
- Data categories
- security
- Scope
- wide
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported
Pattern
(?i)\b(?:CMDB(?:\s+(?:export|relationships?|map(?:ping)?))?|configuration\s+management\s+database|CI\s+relationships?|service\s+dependency\s+map(?:ping)?|dependency\s+map(?:ping)?|relationship\s+map(?:ping)?)\b
Corroborative evidence keywords
upstream, downstream, impact analysis, single point of failure, cmdb_ci, application server, database server, load balancer, production, discovery source, proprietary, intellectual property, trade secret, patent, copyright, trademark, confidential, invention, prototype, algorithm (+35 more)
Proximity: 300 characters
Should match
The CMDB is the source of truth for configuration items.— Discovery probe (65)CMDB relationship export payroll-web01 -> payroll-db01— Medium-tier probe (75) - one relationship edgeCMDB relationship export - Payroll business service CI name: payroll-web01 (class: Linux Server) payroll-web01 -> payroll-db01 Depends on::Used by: payroll-app -> payroll-web01 Support group: Enterprise Apps Impact analysis: payroll-db01 is a single point of failure for all downstream pay runs.— High-tier probe (85) - edges, CI fields and impact context
Should not match
unrelated generic text— No relevant phrase contextplaceholder value 12345— Random text should not matchPolicy statement: the CMDB must be updated for every production change.— Policy textCMDB relationship template CI name: ________ Parent CI: [insert]— Blank templateCourse module 3: CMDB relationship types include Depends on::Used by and Runs on::Runs.— Training framing
Known false positives
- ITSM product documentation lists relationship types. Mitigation: Guidance/training framing is excluded; 85 needs two edges plus populated CI fields.
References
- Information Security Manual (ISM)
- Emergency management (Department of Home Affairs)
- Disaster Assist
- APP Guidelines Chapter 11: APP 11 Security of personal information
- NIST SP 800-128: Guide for Security-Focused Configuration Management of Information Systems
- Security of Critical Infrastructure Act 2018 (Cth)