Discovery Configuration
About 35% of the CIS-Discovery exam — see all 4 domains.
This domain is the operational plumbing: how Discovery is scheduled, which MID Server runs it, what credentials it uses, and how the four-phase horizontal flow actually executes.
The horizontal discovery flow: PCIE
Memorize the four phases in order. A useful mnemonic is PCIE: Port scan (Scanning) → Classification → Identification → Exploration.
- Scanning (Port scan / Shazzam): the Shazzam probe sweeps the target IP range and fires port probes to detect which TCP/UDP ports are open and which protocols are alive. The result tells Discovery what kind of conversation each device can have (SSH, SNMP, WMI/WinRM, HTTP, etc.).
- Classification: based on the open ports and a probe (for example, an SNMP, SSH, or WMI classification query), Discovery decides the device's broad type: Windows server, Linux server, network gear, storage, etc. Classification picks the right downstream identifier/pattern.
- Identification: Discovery collects the attributes needed to uniquely identify the device and hands them to the IRE to create or match the CI in the CMDB (avoiding duplicates). Identification answers "is this CI already in the CMDB, and which record is it?"
- Exploration: now that the CI is known, the pattern (or probes) gathers the full detail: installed software, running processes, network connections, disks, services, and relationships to other CIs.
A failure in an early phase cascades: nothing identifies if classification picked the wrong type, and nothing explores if identification failed.
Discovery Schedules
A Discovery Schedule is the record that tells Discovery what to scan, when, and how. Key fields and choices:
- Discover (what to find): Configuration items, IP addresses, Networks, Service, Serverless, Cloud application, Cloud resources or Certificates.
- MID Server selection method: Auto-Select MID Server (the platform chooses based on the Discovery or ALL supported application and the MID Server IP ranges), Specific MID Server, Specific MID Cluster, or Use Behavior.
- Schedule / Run: periodic (daily, weekly), run on a recurring window, or on demand / Discover Now.
- Max run time: stops a run that is still going when its window ends. (Concurrency is limited on the MID Server, for example by its worker thread settings, not on the schedule.)
- Discovery ranges: the IP ranges, IP lists or networks the schedule scans, plus any exclusions.
Discovery Behaviors
A Discovery Behavior maps port probes / functionality to specific MID Servers for a given range. Behaviors are how you handle segmented networks: you tell Discovery "use this MID Server to reach that part of the network." Each Discovery Functionality in a behavior lists its MID Servers directly, and a schedule set to Use Behavior applies it to control which MID Server performs which phase against which subnet.
MID Server: selection, clusters, capabilities
The MID Server is the Java application installed inside the customer network that does all the actual probing; the instance never talks to target devices directly.
- Selection: with Auto-Select, Discovery picks a MID Server whose supported Applications include Discovery (or ALL) and whose configured IP ranges cover the target. If none matches, the default MID Server for the application is the fallback. Auto-select ignores cluster membership. Specific MID Server, Specific MID Cluster or Use Behavior on the schedule overrides auto-selection.
- Capabilities: declare which protocols or functions a MID Server offers and are used by other applications (for example Orchestration). For Discovery auto-selection, capability is not applicable.
- Clusters: group MID Servers for load balancing (work spread across members, and members also take over a failed member's work) or failover (a standby takes over if one fails). To use a cluster for Discovery, set the schedule to Specific MID Cluster. Fail-over is not available when a MID Server fails while Shazzam is running under auto-selection.
- Validation: a MID Server must be Validated, and Discovery accepts MID Servers that are Up or Degraded; check connectivity and that required ports outbound to the instance (HTTPS/443) are open.
Credentials
Discovery needs credentials to log into targets. You manage them on the instance (or in an external vault) and they are pushed encrypted to the MID Server.
- Credential types: SSH (key or password) for Unix/Linux, Windows (for WMI/WinRM/PowerShell), SNMP (community string v1/v2c or USM for v3), VMware/vCenter, cloud (AWS/Azure/GCP service credentials), JDBC/SQL, and more.
- Credential affinity: once a credential succeeds against a device/IP, Discovery records that pairing so it tries the known-good credential first next time, instead of cycling through every credential. This speeds up runs and reduces lockouts. If the affinity credential stops working, Discovery tries all available credentials again until it creates a new affinity. Before any affinity exists, the credential Order field sets the sequence. Credentials have no IP range field; Applies to limits them to all or specific MID Servers.
- Least privilege: prefer credentials with only the rights Discovery needs. ServiceNow documents SSH commands that do not require a privileged (root/sudo) user versus those that do; design credentials to grant only what the required commands demand.
What to drill for Domain 2: the PCIE phase order and what each phase outputs; Shazzam/port probes; how MID Server auto-selection works (Discovery or ALL application plus IP range, default MID fallback, capability not applicable); clusters for load balancing vs. failover and Specific MID Cluster; behaviors mapping work to MID Servers per subnet; credential types per platform; and credential affinity.
Sample questions from this domain
Three of the 102 in this domain, with the reasoning. The full set is in the question bank.
In ServiceNow Discovery, which phase of the Probe-Classify-Identify-Explore sequence runs the Shazzam port scan to detect which ports are open on a target?
- A. Identify (IRE) phase
- B. Classify (classifier) phase
- C. Probe (Scan) phase ✓
- D. Explore (pattern) phase
Why: Shazzam is the port scan of the Probe (Scan) phase: it reports which ports are open, and the port probe that answered triggers the matching classifier. The Classify phase runs that classifier against ports Shazzam already found; it does not scan for them. The Identify phase sends identifier attributes to the IRE to match or create the CI, and the Explore phase runs the probes and patterns that collect detailed attributes. Neither of those phases performs port scanning.
What does the Classify phase of Discovery determine?
- A. The identifier attributes, such as serial number, that the IRE uses to match an existing CI
- B. The type of device or operating system so the correct identification logic/pattern can run ✓
- C. The open TCP ports on the target, so that the matching port probe can trigger the next phase
- D. The MID Server, chosen by its IP range, that will run the remaining probes against the target
Why: Classification runs the classifier triggered by the responding port (for example uname over SSH, or WMI queries) to determine the device or operating system type, which selects the identification and exploration logic that follows. Finding open ports is Shazzam's job in the scanning phase, before classification. Identifier attributes such as serial number are gathered for the IRE during identification. The MID Server is selected from the schedule settings before scanning starts, not by the Classify phase.
A Discovery Schedule is configured with a discover type of 'Configuration Items' and an IP range. What does the IP range primarily control?
- A. The set of target IP addresses the schedule will attempt to discover ✓
- B. The CMDB classes that the IRE is allowed to create for discovered devices
- C. The order in which credentials are tried against each discovered target
- D. The port probes that Shazzam runs against each address in the scanning phase
Why: A schedule's IP ranges (or networks) define which target addresses the run will scan and attempt to discover. The CI classes created depend on classification and the IRE, not the range. Credential try order comes from each credential's Order value and from credential affinity. Which port probes run is set by the active port probe definitions and any Discovery Behavior functionality, not by the range itself.