SERVICENOW DISCOVERY TECHNICAL
STUDY SHEET 2026 COMPLETE
SOLUTIONS VERIFIED
◉ What COMPONENTS does discovery use to find CIs
Answer: Probes, Sensors and Patterns
◉ What do PROBES do?
Answer: Probes explore or investigate CIs on your network
◉ What do SENSORS do?
Answer: Sensors parse the data returned from the probes
◉ What are the Horizontal discovery phases
Answer: Scanning - Discovery sends a probe called Shazzam to the
network to see if commonly used ports are open and if these ports can
respond to queriessensors parse the data returned from the probes
Classification - If Discovery finds devices or computers, it sends
additional probes to find the type of device or the operating system on
the device.
Identification - Discovery tries to gather more information about the
device and then tries to determine if a CI for the device exists in the
CMDB. Discovery then uses additional probes, sensors, and identifiers
to update existing CIs in the CMDB or create new ones.
Exploration - The identifier launches additional probes configured in the
classifier. These probes are especially designed as exploration probes to
,gather additional information about the device, like the applications
running it, and additional attributes, such as memory, network cards, and
drivers. Discovery then creates relationships between applications and
devices and between applications. If you're using patterns, the operations
in the pattern perform the exploration of the CI.
◉ The MID Server starts all communication? (T/F)
Answer: True
◉ How does the MID Server communicate with the Instance?
Answer: Using SOAP(Simple Object Access Protocol) on HTTPS
◉ Does Discovery use an agent installed on devices? (T/F)
Answer: False
◉ What are the TYPES of discovery
Answer: Network discovery
CI discovery
Cloud discovery
Serverless discovery
◉ Describe IP SERVICE AFFINITY
Answer: IP Service affinity saves the IP service information that is used
to successfully find a device and associates it with the IP address of the
device. Using this information, Discovery can target the device in
,subsequent runs with the accurate protocol. Discovery records the IP
Service along with the IP address. Discovery can store the successful IP
service information in the IP Service Affinity table [ip_service_affinity].
◉ What is the differnce between the Horizontal discovery process flow
with PROBES AND SENSORS vs with PATTERNS?
Answer: Both have 4 phases.
For the last two phases, Discovery triggers operations from a pattern,
rather than additional sets of probes.
◉ What are the 3 horizontal discovery triggers?
Answer: 1. Discovery schedule
2. On-demand discovery with 'Discover now'
3. Quick Discovery
◉ Horizontal discovery process flow with probes and sensors/patterns -
Scanning phase
Answer: 1. Discovery first takes the Shazzam probe (and then port
probes) and places it in a request in the External Communication
Channel (ECC) queue.
2. The MID Server checks the ECC queue, retrieves the discovery
request, and runs the probes against the host and discovers open ports.
3. The port probes scan common ports using several protocols, such as
WMI, HTTP, SSH, and SNMP.
4. If one or more ports respond, the Shazzam probe sends information
about the port back to the ECC queue through the MID Server.
, 5. Discovery checks the ECC queue to find out which ports responded,
which identifies the type of machine. For example, if Shazzam detects
that the machine is listening on port 22, Discovery treats the machine as
a UNIX or Linux machine.
◉ Horizontal discovery process flow with probes and sensors/patterns -
Classification phase
Answer: 1. The Discovery application determines which classification
probe to send to the newly discovered device by using information in the
record of the port probe that successfully responded.
2. Discovery puts the classification probe into the ECC queue.
3. The MID Server checks the ECC queue, retrieves the discovery
request, and runs the classification probe.
4.The classification probe retrieves additional information, such as
which version of the operating system is running on a machine. This
information determines the class of the CI that Discovery found. There
is only one classification probe per discovered device.
5. The classification probe sends information back to the instance ECC
queue through the MID Server.
◉ Horizontal discovery process flow with probes and sensors -
Identification phase
Answer: 1. Discovery determines which classifier to use based on the
class of the CI and the criteria specified in all CI classifier records. The
classifier specifies which probes to use for the next two phases.
2. Discovery puts the identification trigger probe for the CI classifier
into the ECC queue. For example, a Unix machine running HP-UX
would require the HP-UX classifier, which specifies that the Multi
STUDY SHEET 2026 COMPLETE
SOLUTIONS VERIFIED
◉ What COMPONENTS does discovery use to find CIs
Answer: Probes, Sensors and Patterns
◉ What do PROBES do?
Answer: Probes explore or investigate CIs on your network
◉ What do SENSORS do?
Answer: Sensors parse the data returned from the probes
◉ What are the Horizontal discovery phases
Answer: Scanning - Discovery sends a probe called Shazzam to the
network to see if commonly used ports are open and if these ports can
respond to queriessensors parse the data returned from the probes
Classification - If Discovery finds devices or computers, it sends
additional probes to find the type of device or the operating system on
the device.
Identification - Discovery tries to gather more information about the
device and then tries to determine if a CI for the device exists in the
CMDB. Discovery then uses additional probes, sensors, and identifiers
to update existing CIs in the CMDB or create new ones.
Exploration - The identifier launches additional probes configured in the
classifier. These probes are especially designed as exploration probes to
,gather additional information about the device, like the applications
running it, and additional attributes, such as memory, network cards, and
drivers. Discovery then creates relationships between applications and
devices and between applications. If you're using patterns, the operations
in the pattern perform the exploration of the CI.
◉ The MID Server starts all communication? (T/F)
Answer: True
◉ How does the MID Server communicate with the Instance?
Answer: Using SOAP(Simple Object Access Protocol) on HTTPS
◉ Does Discovery use an agent installed on devices? (T/F)
Answer: False
◉ What are the TYPES of discovery
Answer: Network discovery
CI discovery
Cloud discovery
Serverless discovery
◉ Describe IP SERVICE AFFINITY
Answer: IP Service affinity saves the IP service information that is used
to successfully find a device and associates it with the IP address of the
device. Using this information, Discovery can target the device in
,subsequent runs with the accurate protocol. Discovery records the IP
Service along with the IP address. Discovery can store the successful IP
service information in the IP Service Affinity table [ip_service_affinity].
◉ What is the differnce between the Horizontal discovery process flow
with PROBES AND SENSORS vs with PATTERNS?
Answer: Both have 4 phases.
For the last two phases, Discovery triggers operations from a pattern,
rather than additional sets of probes.
◉ What are the 3 horizontal discovery triggers?
Answer: 1. Discovery schedule
2. On-demand discovery with 'Discover now'
3. Quick Discovery
◉ Horizontal discovery process flow with probes and sensors/patterns -
Scanning phase
Answer: 1. Discovery first takes the Shazzam probe (and then port
probes) and places it in a request in the External Communication
Channel (ECC) queue.
2. The MID Server checks the ECC queue, retrieves the discovery
request, and runs the probes against the host and discovers open ports.
3. The port probes scan common ports using several protocols, such as
WMI, HTTP, SSH, and SNMP.
4. If one or more ports respond, the Shazzam probe sends information
about the port back to the ECC queue through the MID Server.
, 5. Discovery checks the ECC queue to find out which ports responded,
which identifies the type of machine. For example, if Shazzam detects
that the machine is listening on port 22, Discovery treats the machine as
a UNIX or Linux machine.
◉ Horizontal discovery process flow with probes and sensors/patterns -
Classification phase
Answer: 1. The Discovery application determines which classification
probe to send to the newly discovered device by using information in the
record of the port probe that successfully responded.
2. Discovery puts the classification probe into the ECC queue.
3. The MID Server checks the ECC queue, retrieves the discovery
request, and runs the classification probe.
4.The classification probe retrieves additional information, such as
which version of the operating system is running on a machine. This
information determines the class of the CI that Discovery found. There
is only one classification probe per discovered device.
5. The classification probe sends information back to the instance ECC
queue through the MID Server.
◉ Horizontal discovery process flow with probes and sensors -
Identification phase
Answer: 1. Discovery determines which classifier to use based on the
class of the CI and the criteria specified in all CI classifier records. The
classifier specifies which probes to use for the next two phases.
2. Discovery puts the identification trigger probe for the CI classifier
into the ECC queue. For example, a Unix machine running HP-UX
would require the HP-UX classifier, which specifies that the Multi
