ServiceNow Discovery is an automated network scanning tool that finds and catalogs all the devices, applications, and services running on your network without requiring software agents on each machine. IT operations teams, system administrators, and asset managers use Discovery to solve the age-old problem of not knowing what is actually running in their environment - from servers and databases to printers and network switches that were set up years ago and forgotten about. Discovery feeds directly into ServiceNow's Configuration Management Database, automatically creating and updating records for everything it finds. Once Discovery is running, your incident management becomes more accurate because technicians can see exactly what systems are affected, your security team knows what assets need patching, and your procurement team can make informed decisions based on actual hardware inventories rather than outdated spreadsheets.
Key Capabilities
Automatic Device Detection
Discovery scans IP address ranges and automatically identifies servers, workstations, network equipment, and other devices without installing any software on them. It saves IT teams from manually tracking down and cataloging hundreds or thousands of assets that change constantly.
Application and Service Mapping
The system identifies what software is running on each device, which services are active, and how applications connect to each other. This visibility helps troubleshoot outages faster and plan changes without breaking dependencies.
Real-time Configuration Updates
Discovery continuously monitors for changes like new servers being added, software updates, or configuration changes. Your CMDB stays current automatically instead of becoming outdated the moment someone manually updates it.
Smart Data Reconciliation
When Discovery finds devices that already exist in your CMDB from manual entry or other sources, it intelligently merges the information rather than creating duplicates. This prevents the chaos of multiple records for the same server.
Credential Management
Discovery securely stores and rotates the credentials needed to scan different types of systems, from Windows servers to Unix machines to network devices. IT teams can scan everything without sharing passwords or hardcoding credentials.
Custom Classification Rules
Teams can teach Discovery how to identify and categorize their specific hardware models, custom applications, or unique network configurations. This flexibility means Discovery works with any environment, not just standard setups.
How It Works
Discovery starts when an administrator defines IP address ranges to scan and schedules when the scanning should happen. The MID Server, which sits inside your network, begins probing devices using various protocols like SSH, WMI, and SNMP to gather information about what each device is and what is running on it. Discovery then uses pattern-based sensors to identify specific applications, services, and configuration details, classifying each item according to rules you have defined. Finally, the system reconciles all this discovered information with existing CMDB records, either updating current entries or creating new ones, giving you an accurate, real-time view of your entire IT infrastructure.
Who Uses It and How
Regional bank
Their IT team runs Discovery nightly across all branch office networks to automatically catalog ATMs, point-of-sale terminals, servers, and security cameras. When a branch reports network issues, technicians immediately know exactly what equipment is installed and can troubleshoot remotely.
Result: Reduced branch visit time by 60% because technicians arrive knowing exactly what hardware and software versions they will find.
Manufacturing company
Discovery scans their factory floor networks to identify industrial control systems, temperature sensors, and production line computers that rarely get documented manually. The system also tracks which versions of control software are running on each machine.
Result: Security team can now patch critical vulnerabilities in industrial systems that were previously unknown to IT.
University IT department
Discovery automatically finds new devices as students and faculty connect personal laptops, research equipment, and lab computers to the campus network. It identifies which devices belong to which departments and what software licensing may be required.
Result: Reduced software license violations by 80% through automatic detection of unauthorized installations.
Hospital network
Discovery catalogs medical devices, patient monitoring systems, and clinical workstations across multiple facilities, automatically identifying which systems contain patient data and need extra security monitoring.
Result: Achieved compliance audit readiness in weeks instead of months by having complete asset inventory with data classification.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation: What to Know
Discovery implementation requires collaboration between network, security, and ServiceNow teams because you need network access credentials, firewall rules for the MID Server, and decisions about which IP ranges to scan. A typical rollout takes 2-4 weeks for the initial setup and another month to tune the classification rules for your specific environment. You need an accurate network diagram and a list of service accounts with read access to your various systems before starting. Most implementations stall because teams try to scan everything at once instead of starting with a small, well-understood network segment and expanding gradually.
Common Use Cases
Preparing for a security audit
The security team needs a complete inventory of all systems and software versions before the auditors arrive next month. They run Discovery across all network segments to automatically catalog every device and identify systems running outdated software that needs immediate attention.
Planning a data center migration
The infrastructure team needs to know exactly what servers are running which applications before moving to the cloud. Discovery maps all the application dependencies and server configurations, giving them the detailed inventory needed to plan the migration without missing critical systems.
Tracking down an unknown device
Network monitoring shows suspicious traffic from an IP address that no one recognizes. The IT team checks Discovery results to see what device was found at that address, what operating system it runs, and what services are active, helping them quickly identify if it is a security threat.
Managing software license compliance
The procurement team gets a letter from Microsoft asking about license usage across the company. Discovery has been tracking all Windows installations and SQL Server instances automatically, so they can quickly generate an accurate report of what is actually installed versus what licenses they own.
Investigating a service outage
Users report that the customer portal is down, but the web servers appear to be running fine. Technicians use Discovery data to see which database servers and network devices the portal depends on, quickly identifying that a backend database cluster has failed.
Key Tables
cmdb_ci_computercmdb_ci_servercmdb_ci_network_gearcmdb_ci_service_discovereddiscovery_statuscmdb_rel_ciBest Practices
- ✓Start Discovery on a small, well-documented network segment so you can verify the results are accurate before expanding to your entire infrastructure.
- ✓Create service accounts specifically for Discovery scanning instead of using personal admin accounts that might get disabled when people change roles.
- ✓Schedule Discovery runs during off-peak hours and stagger them across different network segments to avoid overwhelming your network or the MID Server.
- ✓Set up alerts for when Discovery finds new device types you do not recognize, as this often indicates shadow IT or security issues.
- ✓Review and tune your classification patterns regularly, especially after major software deployments or infrastructure changes.
- ✓Document your credential strategy clearly because Discovery stops working when service account passwords expire or permissions change.
Common Pitfalls
Running Discovery against IP ranges that include printers, security cameras, and other devices that crash when scanned
Create exclusion lists for sensitive devices and use port scanning to identify device types before running full Discovery probes.
Discovery creates duplicate CMDB entries because the reconciliation rules are too strict or too loose
Start with conservative reconciliation rules that match on multiple attributes like hostname and MAC address, then adjust based on your results.
MID Server performance degrades because Discovery is scanning too many devices simultaneously
Reduce the number of concurrent probe processes and spread Discovery schedules across different times instead of running everything at midnight.
Discovery results show generic device names like 'Unknown Application' for your custom software
Create custom identification patterns for your specific applications and test them on known systems before deploying widely.
Network team blocks Discovery because the scanning looks like a security attack
Work with security and network teams upfront to whitelist the MID Server IP addresses and document the scanning patterns Discovery uses.
Frequently Asked Questions
What is the difference between Discovery and Asset Management?
Discovery automatically finds and catalogs IT infrastructure that is currently running on your network. Asset Management tracks the financial and lifecycle information about assets you own, including things that might be in storage or not yet deployed.
Do I need to install agents on every device for Discovery to work?
No, Discovery is completely agentless. It uses network protocols like SSH, WMI, and SNMP to gather information remotely. You just need the right credentials and network access from your MID Server.
How often should I run Discovery scans?
Most organizations run Discovery daily for critical infrastructure and weekly for less dynamic environments. The frequency depends on how often your environment changes and how current you need your CMDB to be for incident response.
What happens if Discovery finds devices that are already in my CMDB?
Discovery uses reconciliation rules to match found devices with existing CMDB records based on attributes like hostname, IP address, or serial number. It updates the existing record rather than creating a duplicate, though you control how strict or loose this matching is.
Can Discovery scan cloud infrastructure like AWS or Azure resources?
Yes, Discovery has specific patterns for major cloud providers that can identify virtual machines, databases, and other cloud services. You provide cloud credentials instead of network credentials, and Discovery uses the cloud APIs to gather information.
What permissions does Discovery need to scan my network effectively?
Discovery needs read-only access to the systems it scans, typically through service accounts with local admin rights on Windows, sudo access on Linux, and SNMP read community strings on network devices. The exact permissions depend on what information you want to collect.
How do I know if Discovery is working correctly?
Check the Discovery Status dashboard for scan results, failed connections, and devices that could not be classified. Compare a few Discovery results against what you know manually to verify accuracy, and watch for new devices appearing that your team did not install.
Related Modules
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue