ITOM deep-dive · Lesson

Discovery

Quick answer

Discovery automatically finds what is on your network and populates the CMDB, servers, cloud resources, network gear, installed software, without manual data entry. It is agentless, running from a MID Server using credentials and standard protocols.

Key takeaways

The MID Server
The four phases
Agentless, credential-based
Horizontal vs top-down
Common mistakes

Discovery automatically finds what is on your network and populates the CMDB, servers, cloud resources, network gear, installed software, without manual data entry. It is agentless, running from a MID Server using credentials and standard protocols.

The MID Server

Discovery runs through a MID Server, a lightweight Java application you install inside your network that bridges to the instance. It executes the probes, holds no permanent data, and is the linchpin of every ITOM capability that reaches your infrastructure.

The four phases

Scan     --> is something at this IP?        (port/shazzam probe)
Classify --> what kind of device is it?       (match a classifier)
Identify --> new CI, or update an existing?   (via IRE)
Explore  --> gather detailed attributes       (probes + sensors)
                and relationships

Probe

A request sent to the target (SSH command, WMI query, SNMP get).

Sensor

Parses the probe result and writes CI data.

Pattern

The modern, low-code alternative to probes/sensors, Discovery increasingly uses patterns.

Credential

Stored securely; the MID Server uses it to authenticate to targets.

Agentless, credential-based

Discovery installs nothing on targets. It authenticates with stored credentials over SSH (Linux/Unix), WMI/PowerShell (Windows) and SNMP (network devices). Most Discovery failures are really credential or MID Server network reach problems, a device classifies but never explores because the credential can't log in.

Horizontal vs top-down

Discovery finds CIs horizontally (all the servers, everything on a subnet). Service Mapping works top-down from an entry point to connect those CIs into a business service. They are complementary halves of a complete CMDB.

Common mistakes

Insufficient or wrong credentials, so devices classify but never explore.
MID Server can't reach a network segment, silent gaps in the CMDB.
Running Discovery without IRE tuning, generating duplicate CIs.
Under-sized MID Server for the estate, so scans overrun.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

What runs the scans inside your network?
- A. The MID Server
- B. The browser
- C. A report
Show answer
A. The MID Server
The MID Server executes probes and sensors locally.
Which component parses collected data into CIs?
- A. Probes
- B. Sensors
- C. Schedules
Show answer
B. Sensors
Sensors parse probe output and write to the CMDB.
The first Discovery phase that finds live devices is:
- A. Explore
- B. Shazzam (port scan)
- C. Classify
Show answer
B. Shazzam (port scan)
Shazzam scans ports to find active devices.

Frequently asked questions

What does the term Discovery refer to in ServiceNow?

What is another point to note about Discovery?

Discovery finds CIs horizontally (all the servers, everything on a subnet).

What tends to go wrong with Discovery?

Insufficient or wrong credentials, so devices classify but never explore. MID Server can't reach a network segment, silent gaps in the CMDB. Running Discovery without IRE tuning, generating duplicate CIs.