Discovery Pattern Design

Patterns are the modern engine of horizontal Discovery. Where the legacy approach used a long chain of probes and sensors, a pattern is a declarative, ordered set of operations that the MID Server executes to find data, parse it, and populate Configuration Items (CIs). You author and edit patterns in the Pattern Designer, a low-code editor. Understanding what a pattern is made of and how it runs is the single most testable skill on the exam.

Anatomy of a pattern

A discovery pattern is built from three structural pieces:

• Identification section — runs first. Its job is to collect just enough data to identify the primary CI (for example, the host) and create or match it in the CMDB through the Identification and Reconciliation Engine (IRE). The identification section determines whether you have found a real, uniquely identifiable device before you invest effort exploring it.
• Connection section(s) — describe how the pattern reaches a related CI or service and follows relationships outward (for example, from a load balancer to the application servers behind it, or from a running process to the database it connects to). Connection sections are how traffic-based and relationship-based discovery extends from one CI to its neighbors.
• Operations — the ordered, executable steps inside a section.

Operations and parsing strategies

Each pattern is a sequence of operations. Common operation types you must recognize:

• Set Parameter Value — assign or compute a variable used later in the pattern.
• Parse Variable / Parse File — extract structured data from raw command output or a file.
• Get Process / Get TCP Connections — pull running processes and their network connections (the backbone of application discovery).
• WMI Query, SNMP Query, SQL Query, HTTP(S) GET/REST — protocol-specific data collection steps.
• Create CI / Create Relation — populate the CMDB with a CI or a relationship between CIs.
• Match / Merge / Transform Table — manipulate the in-pattern data tables that operations read from and write to.

When you extract data from raw text, you choose a parsing strategy. The main strategies tested are:

• Delimited text — split each line on a delimiter (space, comma, tab) into columns.
• Key/value pairs — pull name = value style output.
• Regular expression (regex) — capture groups from semi-structured text. The most flexible and the most common source of pattern bugs.
• XML / JSON / table — parse structured payloads directly into pattern variables.

Most operations write their results into a temporary variable (a pattern variable or a temporary table). Later operations read from those variables. Tracing the flow of a variable from the operation that fills it to the operation that consumes it is the core troubleshooting skill.

Authoring and debugging in Pattern Designer

• Use Debug mode to run a pattern step-by-step against a chosen target and credential, inspecting the value of every variable after each operation. This is how you isolate which operation produced a wrong or empty value.
• Pattern steps run top to bottom; reordering operations changes behavior. An identification step that depends on a variable must come after the operation that sets it.
• Extensions let you enhance a pattern (add new exploration logic) without altering its identification section, so you do not change how the primary CI is matched.
• Patterns are versioned and can be associated with CI types; the right pattern runs based on what classification determined the device to be.

Pattern vs. probe-based discovery

• Probes/sensors (legacy/classic) are still used in the early phases (port scanning, classification), but identification and exploration of most CI classes is pattern-driven today.
• A pattern executes entirely on the MID Server and returns results in a single payload, which is generally more efficient than many round-trips of probes and sensors.

What to drill for Domain 1: the three sections (identification / connection / operations); the order of operations and variable flow; parsing strategies and when to use each; how to use Debug to find the failing step; extensions vs. editing identification; and how a connection section follows relationships to neighboring CIs.