Horizontal discovery process flow with patterns

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Horizontal discovery process flow with patterns

    Horizontal discovery with patterns in ServiceNow follows a structured four-phase process, similar to discovery with probes, but differs in how the last two phases operate. Instead of using additional probes, this method triggers operations from discovery patterns. This approach streamlines identification and exploration by leveraging predefined patterns and classifiers to update the CMDB precisely.

    Show full answer Show less

    Scanning phase

    The process begins with the Shazzam probe, followed by port probes, which are placed in the External Communication Channel (ECC) queue. The MID Server retrieves these requests and executes the probes against the target host to detect open ports using common protocols such as WMI, HTTP, SSH, and SNMP. Responding ports provide information to classify the machine type (e.g., port 22 indicates a UNIX/Linux machine), which is sent back via the ECC queue.

    Classification phase

    Discovery uses port response data to select the appropriate classification probe for the device. This probe is queued in ECC, executed by the MID Server, and gathers detailed information such as the operating system version. This data determines the Configuration Item (CI) class. Each device receives one classification probe, which feeds back relevant information to the instance ECC queue.

    Identification and Exploration phases

    These phases are unified through patterns. Based on the CI class and classifier records, Discovery selects the correct classifier and launches the corresponding horizontal pattern via the Horizontal Pattern probe. This probe includes a sensor responsible for updating the CMDB. Patterns require both host access credentials and applicative credentials to effectively discover applications running on the host.

    The pattern defines all necessary operations for identification and exploration, guiding Discovery on classification rules and CMDB insertions or updates. Only the Horizontal Discovery Sensor is used during these phases; other probes and sensors are not employed.

    Practical considerations for ServiceNow customers

    • Ensure the MID Server is properly configured to process ECC queue requests and run probes.
    • Configure both host machine credentials and applicative credentials to enable comprehensive discovery of applications.
    • Understand that patterns consolidate identification and exploration, improving efficiency and accuracy in CMDB population.
    • Familiarize with how classifiers and patterns interact to customize discovery for different CI types.

    Horizontal discovery with patterns has four phases, just as horizontal discovery with probes does. However, for the last two phases, Discovery triggers operations from a pattern, rather than additional sets of probes.

    Scanning phase

    1. Discovery first takes the Shazzam probe (and then port probes) and places it in a request in the External Communication Channel (ECC) queue.
    2. The MID Server checks the ECC queue, retrieves the discovery request, and runs the probes against the host and discovers open ports.
    3. The port probes scan common ports using several protocols, such as WMI, HTTP, SSH, and SNMP.
    4. If one or more ports respond, the Shazzam probe sends information about the port back to the ECC queue through the MID Server.
    5. Discovery checks the ECC queue to find out which ports responded, which identifies the type of machine. For example, if Shazzam detects that the machine is listening on port 22, Discovery treats the machine as a UNIX or Linux machine.

    Classification phase

    1. The Discovery application determines which classification probe to send to the newly discovered device by using information in the record of the port probe that successfully responded.
    2. Discovery puts the classification probe into the ECC queue.
    3. The MID Server checks the ECC queue, retrieves the discovery request, and runs the classification probe.
    4. The classification probe retrieves additional information, such as which version of the operating system is running on a machine. This information determines the class of the CI that Discovery found. There is only one classification probe per discovered device.
    5. The classification probe sends information back to the instance ECC queue through the MID Server.

    The Identification and Exploration phases

    Patterns unify the Identification and Exploration phases of discovery.

    1. Discovery determines which classifier to use based on the class of the CI and the criteria specified in all CI classifier records. The classifier specifies the Horizontal Pattern probe, which in turn specifies which pattern to launch. The Horizontal pattern probe also contains a sensor which does the actual work of updating the CMDB.
      Note:
      Patterns need applicative credentials to find applications running on host machines. Make sure you have applicative credentials configured along with the credentials required to access the host machine itself.
    2. The operations in the pattern specify the actions that Discovery needs to take for both the identification and exploration phases. Discovery knows which identification rules to use based on the CI type in the pattern, and Discovery makes inserts or updates to the CMDB based on these rules. Only the Horizontal Discovery Sensor is used. Other probes and sensors are not used.