--- title: What Is ServiceNow Discovery And How Does It Work? description: ServiceNow Discovery scans, classifies, identifies and explores. Here's what each phase does, what it needs from you, and where rollouts break. image: https://www.apexconfiguration.com/hubfs/AI-Generated%20Media/Images/Engineer%20With%20Laptop%20In%20Dark%20Data%20Centre%20Aisle.png --- [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png "APEX CONFIGURATION GROUP")](https://www.apexconfiguration.com/) [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png "APEX CONFIGURATION GROUP")](https://www.apexconfiguration.com/) - [Home](https://www.apexconfiguration.com) - ServiceNow - [ServiceNow CMDB](https://www.apexconfiguration.com/servicenow-cmdb) - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-health-check) - [CMDB Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - Maximising ServiceNow - [CMDB Health Dashboard](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) - [CMDB Dependency Mapping](https://www.apexconfiguration.com/cmdb-relationship-table) - [CMDB Configuration Items](https://www.apexconfiguration.com/cmdb-configuration-items) - [CMDB Workspace](https://www.apexconfiguration.com/cmdb-workspace-servicenow) - [CMDB Best Practice](https://www.apexconfiguration.com/cmdb-best-practices) - [ServiceNow Discovery](https://www.apexconfiguration.com/servicenow-discovery-setup) - [Service Mapping](https://www.apexconfiguration.com/servicenow-service-mapping) - About - [How We Help](https://www.apexconfiguration.com/about-apex) - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - Resources - [Blog](https://www.apexconfiguration.com/blog) - [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) - [Home](https://www.apexconfiguration.com) - ServiceNow - [ServiceNow CMDB](https://www.apexconfiguration.com/servicenow-cmdb) - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-health-check) - [CMDB Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - Maximising ServiceNow - [CMDB Health Dashboard](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) - [CMDB Dependency Mapping](https://www.apexconfiguration.com/cmdb-relationship-table) - [CMDB Configuration Items](https://www.apexconfiguration.com/cmdb-configuration-items) - [CMDB Workspace](https://www.apexconfiguration.com/cmdb-workspace-servicenow) - [CMDB Best Practice](https://www.apexconfiguration.com/cmdb-best-practices) - [ServiceNow Discovery](https://www.apexconfiguration.com/servicenow-discovery-setup) - [Service Mapping](https://www.apexconfiguration.com/servicenow-service-mapping) - About - [How We Help](https://www.apexconfiguration.com/about-apex) - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - Resources - [Blog](https://www.apexconfiguration.com/blog) - [Contact Us](https://www.apexconfiguration.com/contact-us) [Contact Us](https://www.apexconfiguration.com/contact-us) [tel:+442080588135](tel:+442080588135)[mailto:contact@apexconfiguration.com](mailto:contact@apexconfiguration.com) [CMDB](https://www.apexconfiguration.com/blog/tag/cmdb)[ServiceNow](https://www.apexconfiguration.com/blog/tag/servicenow) [ITOM](https://www.apexconfiguration.com/blog/tag/itom)[ServiceNow Discovery](https://www.apexconfiguration.com/blog/tag/servicenow-discovery) # What Is ServiceNow Discovery And How Does It Work? [![Warren O'Neill](https://www.apexconfiguration.com/hs-fs/hubfs/warren-oneill.webp?width=40&height=40&name=warren-oneill.webp)](https://www.apexconfiguration.com/blog/author/warren-oneill) by [Warren O'Neill](https://www.apexconfiguration.com/blog/author/warren-oneill) 5 min read Oct 14, 2026, 9:00:01 AM Last updated on 14 Oct 2026, 09:00:01 ServiceNow Discovery finds devices and software on your network and writes them into the configuration management database (CMDB) as configuration items (CIs). Each scan runs in four phases: scanning, classification, identification and exploration. A Management, Instrumentation and Discovery Server inside your network does the work and sends the results back to your instance. That's how ServiceNow Discovery works in outline. Whether it produces a trustworthy CMDB depends on the four things it needs from you: network ranges, credentials, schedules and identification rules. ## Key Takeaways - ServiceNow Discovery finds devices and software on your network and writes them into the CMDB as CIs. Each scan runs in four phases: scanning, classification, identification and exploration. - A failure at any phase stops the later ones. A device with no working credential gets a thin record, and a device that identifies badly becomes a duplicate with a very complete set of attributes. - A Management, Instrumentation and Discovery Server inside your network does the work and makes outbound connections to your instance. Where you place these servers decides what Discovery can reach. - Discovery produces only the CMDB its inputs allow. It needs network ranges, credentials, schedules and identification rules, and the identification rules are the input most projects leave at the default. - A completed schedule tells you the scan finished, not that the CMDB improved. Check how far a sample of addresses got, and group errors by message and range after every run. - Rollouts usually fail on ownership of the inputs, not on the technology. Give each input an owner, put changes through change management and roll out one range at a time. ## The four phases of a Discovery scan **Scanning.** Discovery sends a port scan across the network addresses in a schedule's ranges. An open port is the first evidence that something is there, and which ports answer hints at what it is. **Classification.** Based on the open ports, Discovery tries the matching protocol. Secure Shell suggests Unix or Linux, Windows Management Instrumentation suggests Windows, and Simple Network Management Protocol suggests network or storage kit. It logs in with the credentials you've supplied and works out which CI class the device belongs to. **Identification.** Discovery submits what it has found to the Identification and Reconciliation Engine. The engine decides whether this device is a CI you already hold or a new one. This is where duplicates are either prevented or created. **Exploration.** For identified devices, Discovery gathers the detail: hardware, operating system, installed software, running processes, network connections and the relationships between them. A failure at any phase stops the later ones. A device that classifies but has no working credential gets a thin record. A device that explores but identifies badly becomes a duplicate with a very complete set of attributes. ## What the Management, Instrumentation and Discovery Server does Your instance lives in ServiceNow's data centre. Your devices don't. The Management, Instrumentation and Discovery Server is a Java application you install on a host inside your network, and it makes outbound connections to the instance to collect its work. It runs the probes and patterns against your devices, then posts the results back. It holds no inbound listening port facing the instance, which is usually what gets it through a firewall review. Where you place these servers decides what Discovery can reach. One behind each firewall boundary, network segment or cloud region that blocks the others is the usual pattern. Placement is also where most early rollouts stall, because each server needs a host, a service account and firewall rules before a single address gets scanned. ## What Discovery needs from you before the first scan Discovery produces exactly the CMDB your inputs allow. Four inputs decide the result. | Input | What goes wrong without it | What to prepare | | --- | --- | --- | | Network ranges | Scans miss whole segments, or hit addresses they shouldn't | An owned list of ranges, with exclusions for sensitive kit | | Credentials | Devices classify but never explore | Read-only accounts per protocol, with owners and rotation | | Schedules | Scans run into change windows or busy periods | Agreed windows per range, and a maximum run time | | Identification rules | Every scan adds duplicates | Identifier entries tested against real payloads | The last row is the one most projects leave to the default settings. Our [identification rules article](https://www.apexconfiguration.com/blog/servicenow-identification-rules-how-cmdb-duplicate-prevention-really-works) covers how to test them before the first production scan. ## Reading a Discovery status properly A completed schedule tells you the scan finished. It doesn't tell you the CMDB improved. Open the Discovery status and look at the device history for a sample of addresses. For each one, check how far it got. Scanned but not classified usually means a firewall or an unexpected port profile. Classified but not identified usually means a credential failed or the payload lacked identifying attributes. Group the errors by message and by range after every run. A single credential failure repeated across a thousand addresses is one fix, but it looks like a thousand problems on the status page. Track three figures per range as key performance indicators (KPIs): addresses that responded, devices that classified, and devices that reached exploration. The drop between each stage is your work list. ## Horizontal discovery, patterns and service mapping What's described above is horizontal discovery. It works across the estate, device by device, and builds the infrastructure layer with its direct relationships. Most exploration today runs on patterns, which are step-by-step collection logic you can read and extend in the pattern designer. Service mapping takes a different direction, starting from an entry point such as a web address and following connections down to the infrastructure that supports one business service. The two work together. Horizontal discovery supplies the CIs, and service mapping explains which of them matter to which service. We cover the difference in more depth in later articles in this series. ## Where Discovery rollouts usually break Discovery rarely fails on the technology. It fails on ownership of the inputs. Ranges get handed over from an old spreadsheet that nobody has checked. Credentials arrive for one platform and stall for the rest. Nobody agrees a scan window with the teams who run sensitive equipment. The identification rules stay at their defaults until duplicates appear. Give each input an owner in the RACI (responsible, accountable, consulted, informed) for the CMDB, and put any change to ranges, schedules or credentials through change management. Then roll out in phases, one range at a time, checking the three stage figures before you widen the scope. Once Discovery is feeding the CMDB, other sources will want to write to the same CIs. Our article on [reconciliation rules](https://www.apexconfiguration.com/blog/servicenow-reconciliation-rules-which-source-wins) explains how to decide which one wins. ## How Apex helps Our discovery and integration coverage review establishes what is missing from your estate view, where, and what that costs during an incident. It covers horizontal discovery end to end, from range coverage and server placement to credential failures and identification, along with any third-party tools writing to the CMDB. We scope it with you at an initial consultation. If Discovery is already running and you're unsure what to trust, our two-week CMDB health baseline scores which CIs are trustworthy and which are guesses, in a report you can take to your change advisory board. [Book a CMDB diagnostic call](https://www.apexconfiguration.com/cmdb-diagnostic-call) or [arrange a meeting with a consultant](https://www.apexconfiguration.com/book-a-meeting). ## Frequently asked questions ### Does ServiceNow Discovery need agents on every device? No. Horizontal discovery is agentless and logs in remotely using the credentials you provide. Agent-based collection is available as an option where remote access isn't possible or desirable. ### How many Management, Instrumentation and Discovery Servers do we need? Enough to reach every segment you want scanned, with capacity for the volume in each. Network boundaries usually decide the minimum. Scan volume and resilience decide how many you add beyond that. ### Can Discovery damage devices? It can disrupt fragile equipment if schedules and probe settings aren't tuned. That's why sensitive kit should be excluded or scanned with a lighter configuration, in agreed windows. ### Why do some devices appear with almost no attributes? They were classified but never explored, which usually means a credential failed. Check the device history for that address to see where it stopped. *Written by Warren O'Neill, Apex Configuration Group.* Book a free call to discuss how Apex can help you on your journey to a better CMDB   [![\CMDB Diagnostic Call\](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/147949153/interactive-378363509978.png)](https://www.apexconfiguration.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLAfsnGY1%2FHMrt2EXrZg8Ctuyk6PlvddnKubl12kbBNwwQz2tpSK6wdVz%2B3PkDgLIrQduOnT06JqN0VCvFsWJdPKLmS7cAVIZdjqwY9RGQyNw6XPu9LC9%2FM%2BNqjsEsT8qBnHaQDjbIYlOlhwitudX93hyXdvds6Mmsz2epd3Mt%2FAMzMRvN6l9zMen%2Bz3n7BBtc1Ibi3CNx9%2BYmcJ6aSe04sauRHoZpUy50%2Bm3EFnN0%3D&webInteractiveContentId=378363509978&portalId=147949153) - Recent - Topics - Archive Recent ### Recent Topics ### Topics - [ServiceNow (40)](https://www.apexconfiguration.com/blog/tag/servicenow) - [CMDB (28)](https://www.apexconfiguration.com/blog/tag/cmdb) - [CMDB Data Quality (13)](https://www.apexconfiguration.com/blog/tag/cmdb-data-quality) - [Case Studies (8)](https://www.apexconfiguration.com/blog/tag/case-studies) - [Change Management (6)](https://www.apexconfiguration.com/blog/tag/change-management) - [Service Mapping (6)](https://www.apexconfiguration.com/blog/tag/service-mapping) - [Duplicate CIs (5)](https://www.apexconfiguration.com/blog/tag/duplicate-cis) - [IT Governance (5)](https://www.apexconfiguration.com/blog/tag/it-governance) - [ServiceNow Discovery (5)](https://www.apexconfiguration.com/blog/tag/servicenow-discovery) - [Vulnerability Management (5)](https://www.apexconfiguration.com/blog/tag/vulnerability-management) - [CI Ownership (4)](https://www.apexconfiguration.com/blog/tag/ci-ownership) - [Compliance & Audit (4)](https://www.apexconfiguration.com/blog/tag/compliance-audit) - [Incident Management (4)](https://www.apexconfiguration.com/blog/tag/incident-management) - [Agentic AI (3)](https://www.apexconfiguration.com/blog/tag/agentic-ai) - [Configuration Management (3)](https://www.apexconfiguration.com/blog/tag/configuration-management) - [Data Model Design (3)](https://www.apexconfiguration.com/blog/tag/data-model-design) - [Enterprise Risk Management (3)](https://www.apexconfiguration.com/blog/tag/enterprise-risk-management) - [IRE (3)](https://www.apexconfiguration.com/blog/tag/ire) - [Problem Management (3)](https://www.apexconfiguration.com/blog/tag/problem-management) - [Service Graph Connectors (3)](https://www.apexconfiguration.com/blog/tag/service-graph-connectors) - [Broadcast & Media (2)](https://www.apexconfiguration.com/blog/tag/broadcast-media) - [Cyber Security (2)](https://www.apexconfiguration.com/blog/tag/cyber-security) - [Dependency Views (2)](https://www.apexconfiguration.com/blog/tag/dependency-views) - [IT Cost Optimisation (2)](https://www.apexconfiguration.com/blog/tag/it-cost-optimisation) - [Managed Services (2)](https://www.apexconfiguration.com/blog/tag/managed-services) - [Manufacturing (2)](https://www.apexconfiguration.com/blog/tag/manufacturing) - [CI Reconciliation (1)](https://www.apexconfiguration.com/blog/tag/ci-reconciliation) - [CMDB Remediation (1)](https://www.apexconfiguration.com/blog/tag/cmdb-remediation) - [CSDM (1)](https://www.apexconfiguration.com/blog/tag/csdm) - [IT Asset Management (1)](https://www.apexconfiguration.com/blog/tag/it-asset-management) - [ITOM (1)](https://www.apexconfiguration.com/blog/tag/itom) - [Operational Efficiency (1)](https://www.apexconfiguration.com/blog/tag/operational-efficiency) - [ServiceNow Advisory (1)](https://www.apexconfiguration.com/blog/tag/servicenow-advisory) See all Archive ### Archive - [October 2026 (13)](https://www.apexconfiguration.com/blog/archive/2026/10) - [September 2026 (16)](https://www.apexconfiguration.com/blog/archive/2026/09) - [August 2026 (2)](https://www.apexconfiguration.com/blog/archive/2026/08) - [July 2026 (4)](https://www.apexconfiguration.com/blog/archive/2026/07) - [June 2026 (3)](https://www.apexconfiguration.com/blog/archive/2026/06) - [May 2026 (2)](https://www.apexconfiguration.com/blog/archive/2026/05) See all ### Subscribe by email Share this [Share on X](https://x.com/intent/post?url=https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work&text=What+Is+ServiceNow+Discovery+And+How+Does+It+Work%3F) [Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work&t=What+Is+ServiceNow+Discovery+And+How+Does+It+Work%3F) [Share on LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work&t=What+Is+ServiceNow+Discovery+And+How+Does+It+Work%3F) Previous story [← Replacing The Configuration Management Lead Cost $100,000 To Fix](https://www.apexconfiguration.com/blog/replacing-the-configuration-management-lead) ![Warren O'Neill](https://www.apexconfiguration.com/hs-fs/hubfs/warren-oneill.webp?width=64&height=64&name=warren-oneill.webp) By [Warren O'Neill](https://www.apexconfiguration.com/blog/author/warren-oneill) Co-owner and Technology Director at Apex Configuration Group, based in Bath, UK. Warren specialises in ServiceNow CMDB and CSDM, ITOM Discovery, Service Mapping and pattern development, with a focus… [Full profile & credentials →](https://www.apexconfiguration.com/blog/author/warren-oneill) ### Get Email Notifications [![APEX CONFIGURATION GROUP](https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png?width=135&height=93&name=ACG-logo.png)](https://www.apexconfiguration.com/) ServiceNow CMDB specialists delivering enterprise-grade implementation, remediation, and managed services. Address: 20 Wenlock Road, London, England, N1 7GU VAT Number: 505 0347 31 Company Number: 15871442 Email: [contact@apexconfiguration.com](mailto:contact@apexconfiguration.com) [Follow Apex Configuration Group on LinkedIn](https://www.linkedin.com/company/apex-configuration-group) Services - [CMDB Health Check](https://www.apexconfiguration.com/cmdb-health-check) - [Design & Implementation](https://www.apexconfiguration.com/cmdb-design-implementation) - [Managed Service](https://www.apexconfiguration.com/managed-cmdb-services) - [Automation & Optimisation](https://www.apexconfiguration.com/cmdb-automation-tools) - [Health Dashboard & Reporting](https://www.apexconfiguration.com/cmdb-health-dashboard-servicenow) Company - [What is a CMDB?](https://www.apexconfiguration.com/what-is-cmdb) - [Benefits](https://www.apexconfiguration.com/benefits-of-cmdb) - [About](https://www.apexconfiguration.com/about-apex) - [Blog](https://www.apexconfiguration.com/blog) Resources - [Contact Us](https://www.apexconfiguration.com/contact-us) - [CMDB Diagnostic Call](https://www.apexconfiguration.com/cmdb-diagnostic-call) - [Book A Meeting](https://www.apexconfiguration.com/book-a-meeting) © 2026 Apex Configuration Group. All rights reserved. ServiceNow is a trademark of ServiceNow, Inc. We are not affiliated with or endorsed by ServiceNow. - [Terms](https://www.apexconfiguration.com/terms) - [Cookies](https://www.apexconfiguration.com/cookie-policy) - [Privacy](https://www.apexconfiguration.com/privacy-policy) ```json { "@context" : "https://schema.org", "@id" : "https://www.apexconfiguration.com/#organization", "@type" : [ "Organization", "ProfessionalService" ], "address" : { "@type" : "PostalAddress", "addressCountry" : "GB", "addressLocality" : "London", "addressRegion" : "England", "postalCode" : "N1 7GU", "streetAddress" : "20 Wenlock Road" }, "alternateName" : "Apex Configuration Group", "areaServed" : "GB", "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "GB", "availableLanguage" : "en", "contactType" : "customer service", "telephone" : "+44 20 8058 8135" }, "identifier" : { "@type" : "PropertyValue", "propertyID" : "UK Companies House company number", "value" : "15871442" }, "image" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/Configuration-data.webp", "legalName" : "Apex Configuration Group Ltd", "logo" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png", "name" : "Apex Configuration Group Ltd", "sameAs" : [ "https://www.linkedin.com/company/apex-configuration-group", "https://find-and-update.company-information.service.gov.uk/company/15871442", "https://www.crunchbase.com/organization/apex-configuration-group-ltd" ], "telephone" : "+44 20 8058 8135", "url" : "https://www.apexconfiguration.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.apexconfiguration.com/#website", "@type" : "WebSite", "inLanguage" : "en-GB", "name" : "Apex Configuration Group", "publisher" : { "@id" : "https://www.apexconfiguration.com/#organization" }, "url" : "https://www.apexconfiguration.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "WebPage", "description" : "ServiceNow Discovery scans, classifies, identifies and explores. Here's what each phase does, what it needs from you, and where rollouts break.", "inLanguage" : "en-GB", "name" : "What Is ServiceNow Discovery And How Does It Work?", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png" }, "name" : "Apex Configuration Group Ltd", "url" : "https://www.apexconfiguration.com/" }, "url" : "https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.apexconfiguration.com/", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work", "name" : "What Is ServiceNow Discovery And How Does It Work?", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Warren O'Neill", "sameAs" : [ "https://www.linkedin.com/in/warren-oneill/" ], "url" : "https://www.apexconfiguration.com/blog/author/warren-oneill" }, "dateModified" : "2026-10-14T08:00:01+0000", "datePublished" : "2026-10-14T08:00:01+0000", "headline" : "What Is ServiceNow Discovery And How Does It Work?", "image" : [ "https://147949153.fs1.hubspotusercontent-eu1.net/hubfs/147949153/AI-Generated%20Media/Images/Engineer%20With%20Laptop%20In%20Dark%20Data%20Centre%20Aisle.png" ], "mainEntityOfPage" : { "@id" : "https://www.apexconfiguration.com/blog/what-is-servicenow-discovery-and-how-does-it-work", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.apexconfiguration.com/hs-fs/hubfs/Act3%20child/images/ACG-logo.png" }, "name" : "Apex Configuration Group Ltd", "url" : "https://www.apexconfiguration.com/" } } ```