Discovery - Process Guide
Discovery - Process Guide
Process Guide
2
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Introduction
This guide provides a detailed explanation of how the Discovery process is configured within the
ServiceNow platform. Follow this process as closely as possible, regardless of the customer's
maturity level. ServiceNow encourages simple, lean processes reflected in the out-of-the-box
design.
Customers may add functionality to what is offered; however, this should only be in scenarios
where a required business outcome is gained that could not be achieved using an out-of-the-
box method. Following this approach should also ease upgrade paths and expand the
platform's use.
3
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Roles and Responsibilities
Discovery Administrator
Dedicated resource with technical expertise to work with implementation consultants to
configure and maintain the Discovery application. Responsible for the configuration and
maintenance of Discovery when implementation is complete. Working knowledge of
Networking, Systems Administration, and JavaScript and access to critical subject matter experts
with computing and networking expertise.
Responsible for:
• Configures and Maintains Discovery Application
• Works closely with Configuration Manager in the population of CMDB.
• Interfaces with Compute, Network, and Security teams to ensure access and permissions.
• Resolving discovery errors related to permissions and access.
• Assuring completion of scheduled discovery jobs
• Assisting in the validation and testing of Discovery after upgrades
• Reviewing the environment for changes and new requirements that may drive changes to
the Discovery solution.
• Assures downloads from the ServiceNow store occur monthly for CMDB Classes and
Discovery patterns.
• Add new schedules, IP ranges, and credentials for new devices and environments.
ServiceNow role required:
The discovery_admin role is required in ServiceNow.
In ServiceNow, a Discovery Administrator requires the [discovery_admin] role. The Discovery
Admin should also have the [itil] role to fulfil requests and view dashboards. Additionally, they
may need access to the CMDB Workspace.
Configuration Manager
The configuration manager executes the determined CMDB processes and maintains
governance with the various CI, product, or service owners. They partner with the CI owners to
ensure the data is kept healthy and provide gatekeeper alignment.
• Ensuring configuration management activities operate in line with service level targets
• Approve or reject CMDB requests for new CI selection and attribute determination
• Coordinates and interfaces between the configuration of other processes
• Review and analyze CMDB reports and configuration management and management
metrics and trends to proactively seek improvements
• Approve Verification and Audit request
• Provides communication to stakeholders on the health of the CMDB and population gaps by
CI/Service and Product Owners that update and maintain their assigned CMDB records
4
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
ServiceNow Role Required:
In ServiceNow, a configuration manager requires the [sn_cmdb_admin] role. Additional roles
include the [itil] role [app_service_admin] and [data_manager_admin] role. Adding [itil] role
allows access to CI Class Manager, fulfilling requests, updating, and deleting CIs. With the
additional role [data_manager_admin], the CMDB admin could access the Data Manager to
create or delete policies or assign tasks. Has access to search and read/write to CMDB records
and view CMDB Activity in the CMDB Workspace. The [admin] role is required to turn on CMDB
Health jobs. The Data Foundations dashboard requires [sn_cmdb_admin] role and the additional
role of [asset] or [admin] role. No additional roles are required for the CMDB Attestation to set up
schedule verification and data audits.
CI Analyst or Class Owner
The CI analyst is responsible for updating and managing the CI classes. The CMDB records note
a group of CI owners as the Managed by Group. They may also be subject matter experts who
help resolve Discovery errors on computing, networks, applications and databases, and cloud
resources. The CI Class owner may also be considered a Service or Product Owner.
Responsible for:
• Responsible for the CIs defined within the scope of their area – Compute, Network or
Application, Service or Product
• Assure automated data sources are populating discoverable attributes
• Creates and maintains CI queries, CMDB groups, and Dynamic CI groups using CMDB Query
Builder
• Ensures the CMDB is updated upon successful change implementation
• Collects and retains risk assessment and impact analysis information and defines how their
operational processes and secondary data sources feed into the CMDB.
• Requests Data Manager policies are configured to manage large amounts of duplicate,
stale, or orphaned CIs from the CMDB admin
• Executes assigned tasks related to data certification and CMDB maintenance regarding
data gaps.
ServiceNow Role Required:
The [itil] role is required in ServiceNow. It may require additional roles such as [asset] to view the
CMDB Data Foundations and the CMDB Health dashboard and utilize the playbooks to resolve
issues and data gaps found in the CMDB.
5
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Process Scope
The scope of Discovery includes populating the CMDB based on reoccurring discovery
schedules. CIs that are discoverable out-of-the-box can be found in the product
documentation. The Discovery implementation scope finds pre-determined CI Classes and
defines success at 80% of discovered devices of the actual inventory numbers. Discovery is an
ongoing maintenance and troubleshooting activity carried on past go-live.
Outside of the deployment process scope, Discovery has a process that determines how it
populates the CMDB.
6
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
High-Level Deployment Process
Based on identifiers, the discovery population into the CMDB places the devices in the correct
CMDB table with no additional out-of-box configuration.
7
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
For greenfield implementations, setting up the foundational data is considered "Crawl" as it is
referential data used on the CMDB record. Data about the locations is the most important as it is
referenced on the Discovery tables, and it populates the CMDB record with the device's
location.
The Walk phase of the CSDM data model is the technical and operational data it takes to
Manage technical infrastructures. Refer to the CMDB Process Guide. Some configuration items
listed below can be part of a crawl. This allows the "Walk" phase to be broken down into two
separate phases of work.
Leading practices recommend starting with these basic operational hardware devices for Day 1
Go Live for usage in Incident and Change management processes. As Service Mapping, Event
Management, and AI operations are implemented, consider adding other CI types.
Foundational Data (non-CMDB) Integration to platform
Company
Users
Locations
Support Groups
Approval Groups
CMDB Groups
Product Models
Contracts
Gather Credentials
Gathering credentials is a critical step in the Discovery process. Without credentials, Discovery
cannot gather information from target devices. Ensuring the security team is on board with
Discovery early in the process is paramount. Without approval and sign-off, Discovery projects
often stall or get bogged down as teams are reticent to provide necessary credentials. Invite
them to the Pre-Workshop Kickoff meeting. Understanding how ServiceNow security works is
important. Sharing the strong story around ServiceNow's cloud security with the security team
helps alleviate concerns and pave the path for buy-in. Use online resources from ServiceNow to
learn more and share these with the appropriate security parties. The supported credential types
can be found here.
8
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Plan MID Server Deployment
Planning MID server deployment is the next major phase of Discovery implementation. MID
servers should be close to the targets with the most available bandwidth and what you want to
discover. Refer to the ServiceNow docs page for the latest minimum requirements and
recommended configuration for MID Server hosts. Clustering MID servers is also generally
recommended and can improve performance, but the effectiveness of doing so depends on
the volume of CIs being discovered. Following the ITOM Guided Setup in your instance by your
Discovery Admin ensures accurate configuration.
Create Discovery Schedules
Planning the Discovery schedules is a crucial step in Discovery implementation. The Discovery
schedules determine what is discovered when the discovery runs, and which MID servers are
used. Defining schedules organizes networks and locations into defined jobs that run on pre-
determined schedules, which can be daily, weekly, or on demand. Staggering start times, MID
Server Clusters, and behaviors are all tools to help accomplish specific Discovery goals. The first
consideration is how many individual schedules are needed. One schedule per location is a
good rule of thumb.
Discover Data and Maintain
Discovering the data and populating the CMDB occurs as schedules are run. Numerous checks
should be run with the Configuration Management team to ensure the CMDB is populated with
a complete, correct data set. The CMDB Health Dashboard should be used to verify overall
health.
Maintaining Discovery entails daily, weekly, monthly, and yearly tasks. Reviewing error logs daily
and rectifying issues is the day-to-day activity using the CMDB dashboard. Working with the
Configuration team ensures critical tasks like updating or disposing of assets. Participating in
monthly CMDB reviews with the configuration team to ensure the overall data quality is an
essential step in the health maintenance of the CMDB.
9
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Discovery Application Process
Discovery internally has a process it goes through to discover the CIs. The MID Servers handle the
jobs that run to discover the CIs in a nightly run schedule on IP address ranges.
How Discovery is Initiated
Schedules – Discovery Analysts can configure schedules to initiate Discovery periodically. These
schedules have several Discovery-specific options to control the IP range(s) to scan.
Quick Discovery – Discovery Analysts can initiate the Discovery of a single IP address using the
provided UI Action on the discovery schedule form.
Scripts – Discovery can be initiated via the discovery scripting API, which allows it to be initiated
as part of other processes through workflows, business rules, or even external REST calls.
The MID Servers are configured per schedule. Datacenter #1 may use a different set of load
balanced MIDs, whereas Datacenter #2 can also use another set of MID Servers. Adding the
MID Servers to the schedules helps the schedules run concurrently, allowing the scheduled
process to be completed faster.
Discovery Lifecycle
As Discovery schedules run, they do so according to the lifecycle process below. Understanding
the lifecycle helps with troubleshooting any issues that occur during Discovery. The Discovery
process consists of the following 4 phases:
• Scan
• Classify
• Identify
• Explore
10
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Process Overview
Scan
In this phase, a Shazzam probe is launched for each network device. The probe scans for open
TCP ports on the network. This data determines device type based on activity on these ports.
Information collected during this phase determines the probes and sensors used during the next
phase (Classify). Industry standards protocols are used, much the same as monitoring systems.
Discovery uses SSH to discover Linux/Unix devices, SNMP for network gear and printers, and WMI
or WinRM to find Windows devices.
Classify
Classification probes and sensors are run during this phase to classify the device. Admin
credentials allow access to the device. If the credentials are not available, Discovery fails.
Specific probes are triggered at this phase based on the port information collected in the
previous phase. Information collected during this phase determines the device type and which
probes or patterns are triggered in the subsequent phases.
Identify
During this phase, Discovery determines the device type and launches additional probes/sensors
(or patterns) to collect information about the device. The CMDB identification and
Reconciliation Engine (IRE) is then used to find a matching device in the CMDB. The existing CI
record is updated if the Identifiers find a matching CI. A new CI is created if no matching CI is
found.
If multiple data sources are used along with Discovery, CMDB reconciliation and data
precedence rules can control attribute updates, preventing collisions and updates from
unauthorized sources.
11
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Explore
The explore phase is the final phase of the Discovery process. Additional device exploration is
done during this phase by launching additional probes/sensors. The Identify and Explore phases
are combined within a single pattern when using patterns.
Other Processes
Configuration Management
The configuration management system underpins all records and activities related to any CI. It
contains details of the infrastructure vital to services, CIs, and their relationships. As Discovery
creates and updates CIs, the configuration management process and governance should be
followed.
Change Management
Change management is the process responsible for facilitating the implementation of changes.
When changes are made to IT infrastructure and services, the Discovery process can be
leveraged to update and validate them.
Service Mapping
Service Mapping and Discovery go hand in hand. Once the CIs have been discovered and
populated into the database, non-discoverable CIs, like deployed versions of applications,
otherwise known as a system of CIs, that make up an Application Service, are also populated.
Service Mapping finds by port or processes the CIs that make up the entire Application Service.
Process Governance
Measurement
Key Performance Indicators (KPIs) evaluate the success of a particular activity in meeting the
critical success factors. Successfully managing KPIs can be either through repeatedly meeting
an objective (maintain) or progressing towards an objective (increase/decrease). The
Benchmarks feature gives you instant visibility into your key performance indicators (KPIs) and
trends, as well as comparative insight relative to the industry averages of your peers. You can
contrast your organization's performance with recognized industry standards and view a side-by-
side performance comparison with global benchmarks.
The Average Time to Resolve a Priority Incident for Discovery should improve when critical
business systems (systems with High Priority Incidents assigned against them) have their
monitoring systems integrated and CIs mapped through Discovery. In addition, when Service
Mapping is integrated, visibility into the health of these business services in real-time enables the
appropriate support teams to react faster to high-priority incidents.
12
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Dashboards and Reporting
Process KPIs
• Provide information on the process's effectiveness and the impact of continuous
improvement efforts.
• Represented as trend lines and tracked over time
• Monitored by the Process Owner
Item Purpose
Average time to resolve a high- Measure the effect of the Discovery process on time to resolve
priority incident incidents
Incident leveraging of CMDB Measure the ability to leverage the CMDB in the Incident
Management process.
Change leveraging of CMDB. Measure the ability to leverage the CMDB in the Change
Management process.
Operational Data
Active catalog items/requests requiring visibility, oversight, and management intervention are
best tracked on a dashboard or homepage monitored by the Service Desk and request
fulfillment team.
Item Purpose
Unidentified IP Count Indicates devices that are on the network, but Discovery is not
able to properly interrogate.
Active Discovery Errors List of errors in the active discovery schedules that need to be
resolved.
Newly Discovered Devices by Measures the number of new device CIs created by Discovery.
Device Type
Total Discovered Devices by Type Measures the number of device CIs that Discovery actively
updates.
Unrefreshed Devices by Type Measures the number of device CIs that Discovery is no longer
updating.
Newly Discovered Applications by Measures the number of new application CIs created by
Type Discovery.
Total Discovered Applications by Measures the number of application CIs that Discovery actively
Type updates.
13
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Item Purpose
Unrefreshed Applications by Type Measure the number of application CIs that Discovery is no
longer updating.
Important: Starting with the Vancouver release, the Discovery Home page is prepared for future
deprecation. The plugin for this application will be hidden and no longer be activated on new
instances but will continue to be supported. For details, see the Deprecation Process
[KB0867184] article in the Now Support Knowledge Base.
You can transition to the available Cloud Operations Workspace application starting with
the San Diego release. To use this application, enable the Cloud Operations
Workspace (sn_cloud_ops_ws) plugin from the ServiceNow Store.
14
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
MID Server Dashboard
A central place for MID Server users to monitor ongoing operations. This should be checked daily
or when issues occur as part of the daily operational processes. The dashboard consists of
reports and gauges that display information from the MID Server Status table. The dashboard
displays the following metrics:
Overview Tab
• Number of total MID servers by status, validation, and issues, pending upgrades, pending
jobs, processing jobs and by MID server capabilities.
15
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated. 
Image of Performance Tab on the MID Server Dashboard
Custom Tab
Add MID servers you want to view usage for in the list or by entering the name in the search.
Select 5 years at a time and select a timeframe.
16
©2024 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks and/or registered trademarks of
ServiceNow, Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective
companies with which they are associated.