---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# IT Operations Management and pattern discovery

# IT Operations Management and pattern discovery {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

When discovery is enabled, information is received from the Information Technology Operations Management
(ITOM) team. If the ITOM Discovery is enabled, you can see Kubernetes
Namespaces, Kubernetes Clusters, and Kubernetes Services when you open a container vulnerable item
(CVIT). Else, you can see Prisma payload information.

The image labels from the Prisma payloads are stored as key value pairs under the docker image.
The labels in a Prisma payload are stored in the cmdb_key_value table. To enable this feature, an
identification rule is shipped for cmdb_ci_docker_image by the ITOM team. Open the Docker image
to view the related items list. Most of the items are populated by the ITOM
team. The identification entry for a docker image is shipped to show the values as key value
pairs.

The business criticality is determined based on the service criticality information received
from the ITOM team. A scheduled job is run to pull data from all the
services associated with an image. It calculates the business criticality based on service
mapping. As the risk score can depend on business criticality, the risk score is also calculated
based on it.