ServiceNow Discovery

ServiceNow Discovery automatically scans a company's network, finds IT devices and applications, and creates or updates their CI records in the CMDB — without anyone manually entering data. Discovery replaces the error-prone, time-consuming process of manually maintaining an IT asset inventory. It keeps the CMDB accurate by running on a schedule and continuously reconciling what it finds against what already exists.

The Discovery Problem It Solves

WITHOUT Discovery:
IT inventory spreadsheet updated manually
  → Someone buys 20 new laptops
  → Spreadsheet not updated for 3 weeks
  → Finance runs an asset audit
  → Spreadsheet is wrong
  → Nobody knows what the company actually owns
  → CMDB becomes unreliable, teams stop trusting it

WITH Discovery:
Discovery runs every night
  → Scans the network
  → Finds the 20 new laptops
  → Creates CI records in the CMDB automatically
  → CMDB always reflects reality

How Discovery Works: The Four Phases

Phase 1: Scan

Discovery sends probe signals (pings and port scans) to IP address ranges defined in its configuration. Every IP address that responds gets flagged as a live device. This phase builds a list of active hosts without yet knowing what those hosts are.

Phase 2: Classify

Discovery probes each live host to determine its type — Windows server, Linux server, network switch, printer, VMware host, etc. It uses operating system fingerprinting and banner responses from open ports to classify the device accurately.

Phase 3: Identify

Discovery checks whether the discovered device already exists in the CMDB by matching on identifiers like serial number, hostname, or MAC address. If a match exists, Discovery updates the existing CI record. If no match exists, Discovery creates a new CI record. This prevents duplicate records for the same physical device.

Phase 4: Explore

Discovery logs into classified devices (using stored credentials) and collects detailed configuration data — CPU specs, RAM, disk capacity, installed software, running processes, network interfaces, and relationships to other systems. This data populates the CI's fields and relationship records in the CMDB.

Discovery Phases:
Network IP Range: 10.0.0.0/24
       │
       ▼
Phase 1 SCAN: 10.0.0.1 responds ✓, 10.0.0.5 responds ✓, ...
       │
       ▼
Phase 2 CLASSIFY: 10.0.0.1 = Windows Server 2022
                  10.0.0.5 = Cisco Switch
       │
       ▼
Phase 3 IDENTIFY: 10.0.0.1 → matches PROD-WEB-01 (existing CI, update it)
                  10.0.0.5 → no match (create new CI)
       │
       ▼
Phase 4 EXPLORE: PROD-WEB-01 → CPU: 16 cores, RAM: 64GB, IIS running,
                                connects to PROD-DB-01 via port 1433

MID Server: The Discovery Agent

Discovery does not run directly from the ServiceNow cloud instance. It runs through a MID Server — a lightweight Java application installed on a server inside the company's network. The MID Server acts as a bridge:

ServiceNow Cloud ←→ MID Server (inside company network) ←→ Network Devices
                    (has network access to scan internal IPs)

The MID Server receives discovery instructions from ServiceNow, executes the scans and probes within the internal network, and sends results back to ServiceNow for processing. Most organizations deploy multiple MID Servers for redundancy and to cover multiple network segments.

Discovery Credentials

To explore devices (Phase 4), Discovery needs authentication credentials. Administrators store credentials in ServiceNow's Credential store — Windows domain credentials, SSH keys for Linux, SNMP community strings for network devices, and VMware API credentials for virtual infrastructure. Discovery retrieves these credentials securely and uses them to log into devices during exploration.

IP Address Ranges and Schedules

Administrators define which IP ranges Discovery scans and how often. A typical setup runs Discovery nightly at 2:00 AM to minimize impact on production systems. Critical infrastructure scans might run every few hours. IP ranges exclude printers and personal devices to keep the CMDB focused on IT-managed assets.

Discovery vs. Service Mapping

Discovery finds individual devices and creates CIs. Service Mapping goes further — it traces the connections between CIs to map complete application service dependencies. Where Discovery says "here is a web server," Service Mapping says "this web server belongs to the Customer Portal service, connects to this database, sits behind this load balancer, and runs on these three physical hosts." Service Mapping builds the relationship layer that makes the CMDB truly useful for impact analysis.