Discovery Configuration

This domain is the operational plumbing: how Discovery is scheduled, which MID Server runs it, what credentials it uses, and how the four-phase horizontal flow actually executes.

The horizontal discovery flow — PCIE

Memorize the four phases in order. A useful mnemonic is PCIE: Port scan (Scanning) → Classification → Identification → Exploration.

1. Scanning (Port scan / Shazzam) — the Shazzam probe sweeps the target IP range and fires port probes to detect which TCP/UDP ports are open and which protocols are alive. The result tells Discovery what kind of conversation each device can have (SSH, SNMP, WMI/WinRM, HTTP, etc.).
2. Classification — based on the open ports and a probe (for example, an SNMP, SSH, or WMI classification query), Discovery decides the device's broad type: Windows server, Linux server, network gear, storage, etc. Classification picks the right downstream identifier/pattern.
3. Identification — Discovery collects the attributes needed to uniquely identify the device and hands them to the IRE to create or match the CI in the CMDB (avoiding duplicates). Identification answers "is this CI already in the CMDB, and which record is it?"
4. Exploration — now that the CI is known, the pattern (or probes) gathers the full detail: installed software, running processes, network connections, disks, services, and relationships to other CIs.

A failure in an early phase cascades: nothing identifies if classification picked the wrong type, and nothing explores if identification failed.

Discovery Schedules

A Discovery Schedule is the record that tells Discovery what to scan, when, and how. Key fields and choices:

• Discover (what to find): IP addresses, Networks, CIs, Cloud resources, Configuration items, etc.
• MID Server selection method — Auto-select MID Server (let the platform choose based on IP ranges/capabilities/applications) or specify one explicitly.
• Schedule / Run — periodic (daily, weekly), run on a recurring window, or on demand / Discover Now.
• Max run time and concurrency controls to limit load.
• IP range source — a static range, a network discovery, or a Discovery Behavior.

Discovery Behaviors

A Discovery Behavior maps port probes / functionality to specific MID Servers for a given range. Behaviors are how you handle segmented networks: you tell Discovery "use this MID Server (with these capabilities) to reach that part of the network." Behaviors are attached to a schedule (often via an IP-range-based schedule) to control which MID Server performs which phase against which subnet.

MID Server — selection, clusters, capabilities

The MID Server is the Java application installed inside the customer network that does all the actual probing; the instance never talks to target devices directly.

• Selection — Discovery chooses a MID Server by matching the target's IP against the MID Server's configured IP ranges, then filtering by Applications (e.g., Discovery, Service Mapping) and Capabilities. Explicit selection on the schedule overrides auto-selection.
• Capabilities — declare which protocols/functions a MID Server may perform (e.g., specific IP ranges, protocols). Used to route work to the right MID Server.
• Clusters — group MID Servers for load balancing (work spread across members) or failover (a standby takes over if one fails). Clusters provide resilience and scale in large environments.
• Validation — a MID Server must be Up and Validated before it can be used; check connectivity and that required ports outbound to the instance (HTTPS/443) are open.

Credentials

Discovery needs credentials to log into targets. You manage them on the instance (or in an external vault) and they are pushed encrypted to the MID Server.

• Credential types: SSH (key or password) for Unix/Linux, Windows (for WMI/WinRM/PowerShell), SNMP (community string v1/v2c or USM for v3), VMware/vCenter, cloud (AWS/Azure/GCP service credentials), JDBC/SQL, and more.
• Credential affinity — once a credential succeeds against a device/IP, Discovery records that pairing so it tries the known-good credential first next time, instead of cycling through every credential. This speeds up runs and reduces lockouts.
• Least privilege — prefer credentials with only the rights Discovery needs. ServiceNow documents SSH commands that do not require a privileged (root/sudo) user versus those that do; design credentials to grant only what the required commands demand.

What to drill for Domain 2: the PCIE phase order and what each phase outputs; Shazzam/port probes; how MID Server auto-selection works (IP range → application → capability); clusters for load balancing vs. failover; behaviors mapping work to MID Servers per subnet; credential types per platform; and credential affinity.