---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Discovery classifiers

# Discovery classifiers {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Discovery classifiers

Discovery classifiers in ServiceNow guide the Discovery process by determining which probes to trigger during the identification and exploration phases.
They use parameters returned by classification probes to decide the next steps.
Classifiers can also launch Horizontal Pattern probes to apply patterns instead of additional probes.
Typically, classifiers do not require modification unless you need to troubleshoot horizontal discovery or discover new CI types not covered by existing classifiers.
Show full answer Show less  

## Types of Classification

* **Device Classification:** Identifies device types such as Windows or UNIX/Linux computers, routers, switches, or load balancers. After identifying a device, Discovery triggers active process probes and compares results against process classification conditions. Since Madrid release, HTTP is used as a low-priority protocol for classification if ports 80/443 are open and higher priority protocols (WMI, SSH, SNMP) fail or are unavailable.
* **Process Classification:** Classifies applications based on running processes during the exploration phase. It creates child CIs with Runs on::Runs relationships and uses process handler scripts to avoid duplicate CIs by filtering inconsistent parameters. Discovery also determines application dependency mapping for classified applications.
* **IP Address (IP Scan) Classification:** Credential-less classification based on open ports and banners. Once classified via IP scan, Discovery updates the CMDB and launches exploration probes to gather detailed CI information. For example, the Linux classifier triggers several probes for hardware and connection details.

## Classifier Criteria and Patterns

Classifiers use criteria based on parameters returned by classification probes, constructed from parameters, operators, and values. Process classifier condition filters are case-sensitive. Discovery supports using patterns triggered by the Horizontal Discovery probe in classifiers for CI identification and exploration. Customers can create custom patterns and add them to classifiers as needed.

## Logging and Debugging

To troubleshoot classification, enable the system property **glide.discovery.debug.classification**. This logs detailed information about classifier execution, including names and values available to classifier criteria, aiding in debugging process classification.

## Practical Applications for ServiceNow Customers

* Create or modify classifiers to discover new CI types or trigger additional probes beyond default configurations.
* Adjust classifiers for device types, processes, or IP scanning based on your network environment and discovery needs.
* Use WinRM protocol instead of WMI on Windows machines for more efficient data transfer by modifying classifiers accordingly.
* Reclassify Windows machines by function (e.g., from workstation to server) by updating classifier criteria.
* Understand protocol priorities and when HTTP classification is used to troubleshoot or optimize device classification.  
A classifier tells Discovery which probes to trigger for the identification and
exploration phases of discovery. Classifiers can also trigger the Horizontal Pattern probe, which
launches a pattern, rather than additional probes, for identification and exploration.
The classifier essentially starts the identification stage. Discovery uses it after the classification probe returns important parameters to the instance that tell Discovery what to do next.

In most cases, you do not need to create a classifier or modify a classifier. But if you
are having trouble with horizontal discovery, you might want to check the conditions that
determine when a classifier runs based on the parameters the classification probe returns to the
instance. Or if you want to discover a new type of CI that Discovery does not already find, you
can create your own classifier.

## Device, process, and IP address classification {#discovery-classifiers__section_mrj_wkz_2cb}

Discovery classification can be broken down into three types: device classification, process classification, and IP address (or IP scan) classification:

Device classification

:   The classification of actual device types, such as a computer running Windows, a computer running a flavor or UNIX or LINUX, a router, a switch, or a load balancer, and so on.When Discovery identifies a computer CI, it triggers an active processes probe to explore the computer CI further. Discovery compares the results of the active processes probe to the process classification conditions to determine if there is a match.

    Starting with the Madrid release, the horizontal discovery process can classify devices using HTTP.  
    Of all protocols that Discovery uses (including WMI, SSH, and SNMP), HTTP is the lowest priority by default. Discovery uses HTTP classification only if:

    * Shazzam determines that the ports for HTTP (80) and HTTPS (443) traffic are open.
    * The horizontal discovery process fails for the higher priority port probes (WMI, SSH, and SNMP) if the ports for those protocols are not open, or if discovery for those protocols fail. The horizontal discovery process can fail, for example, if SSH and SNMP credentials are not configured or are incorrect.  
      Note:  
      See [Port Probes](https://servicenow-prod.fluidtopics.net/ygRcHO00eL0TEmDy2l8T7Q "Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters.") for more details on how port scanning works and to see the priorities of the different protocols.

    {#discovery-classifiers__ul_m4d_k13_sdb}HTTP classification launches the HTTP Classify probe to classify the device. The HTTP - Classify probe runs a GET request for each device for each HTTP classification. The URL of the request is built as follows: `PROTOCOL://IP:PORT/PATH`, where:

    For more information on port probes, see [Port probes](https://servicenow-prod.fluidtopics.net/ygRcHO00eL0TEmDy2l8T7Q "Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters."). For instructions on creating an HTTP classifier, see [Create an HTTP classification](https://servicenow-prod.fluidtopics.net/5NEr9lZQ0m8KmxUZmmIZlA "An HTTP classifier enables the horizontal discovery process to find devices via the HTTP protocol.").

Process classification

:   The classification of applications based on the processes that are running. Discovery classifies processes during the last phase of discovery: the exploration phase, after identifying devices in the Computer \[cmdb_ci_computer\] table and its extensions. Just like device
    classification, process classification has its own classification criteria and also has the ability to launch probes. Unlike device classification, process classification creates child configuration
    items (CI) with Runs on::Runs relationships. By default, Discovery includes classifications for most common processes.

    If a process matches the classification criteria, Discovery determines whether to run the process handler script. The process handler script modifies the parameter data to help Discovery identify whether the process represents an existing or new application CI. Discovery process handlers prevent the creation of duplicate CIs by filtering out parameters known to have inconsistent values before process classification occurs. Every time Discovery adds or updates an application CI, it also determines the application dependency mapping of the application CI to other CIs in the CMDB.

IP address (IP scan) classification

:   IP address discovery is credential-less, meaning that it attempts to identify devices and
    software based on just the open ports and banners it finds without requiring you to create
    credentials. If the classification criteria are met for a device in the IP Scan mode, Discovery automatically updates the CI in
    the CMDB. After a device is properly classified, Discovery launches the exploration probes
    configured for that class of device and begins gathering detailed information about the CI.

    In the default Discovery system, the
    Linux classifier triggers eleven exploration probes that return information such as disk
    size, memory, and the number of current connections. The data from these probes returns at
    different times and is stored in the ECC Queue until processing is complete.  
    This diagram shows the processing flow for classifying and probing devices with an IP scan (no identifiers):Figure 1. IP scan classification

See [Classification for IP address discovery](https://servicenow-prod.fluidtopics.net/PcoevGut27dS1Wq~L1uv_g "Discovery provides a way to classify devices it finds through IP address discovery, even when no credentials are available.") for more details about the
parameters available to classifiers for this type of discovery.

## Classifier criteria {#discovery-classifiers__section_u3t_slx_2cb}

Classifiers also provide criteria that you can use to specify when Discovery should use the
classifier under the conditions that you define. The criteria is based on the parameters that a
classify probe returns to Discovery. Criteria is constructed
with the parameter, an operator, and a value.  
Note:  
Condition filters in process classifiers are case-sensitive.

## Classifiers and patterns {#discovery-classifiers__section_ayk_2by_2cb}

Discovery can use patterns, rather than probes, to identify and explore CIs. Discovery
triggers patterns from the Horizontal Discovery probe, which can be specified on a classifier.
You can create you own patterns and add them, via the Horizontal Discovery probe, to a
classifier. See [Add the Horizontal Pattern probe to a classifier](https://servicenow-prod.fluidtopics.net/F1AaGd2A7GKs7d9ZAQQp5w#t_AddHorizontalPatternProbe "To use a pattern for the identification and exploration phases of horizontal discovery, you must add the Horizontal Pattern probe to the classifiers for the CIs are you trying to discover.") for instructions. You
might already be using one of the out-of-box patterns that are provided with Discovery. You can
verify this by looking at the classifier to see if the Horizontal Pattern Probe is
specified.

## Logging classification debugging information {#discovery-classifiers__section_i24_jz1_z1b}

To log debugging information about classifications, add the following system property. The resulting log entries list the name of each classifier that runs, along with all the names and values that are available to the criteria in the classifier.{#discovery-classifiers__table_a4q_lly_2cb__entry__2}

| System property | Description |
|-|-|
| `glide.discovery.debug.classification` | Enables debugging information for process classification. * Type: true \| false * Default Value: false * Location: Add to the System Properties \[sys_properties\] table. For more information, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=yokohama&pubname=yokohama-platform-administration&ft:locale=en-US). {#discovery-classifiers__ul_v3r_jxv_1q} |
[ ]

{#discovery-classifiers__table_a4q_lly_2cb}

## What you can do with Discovery classification {#discovery-classifiers__section_wqn_nvc_fcb}

* Create or modify a discovery classifier if you want to classify CIs that Discovery does not already classify, or trigger other probes that are not already on a classifier. You can modify classifiers that Discovery uses in [standard CI discovery](https://servicenow-prod.fluidtopics.net/IIbCQw4jyfDYfm6OcHRBIA "A CI classification allows Discovery to discover most common operating systems, network devices, and processes."), [process
  classifiers for applications](https://servicenow-prod.fluidtopics.net/Y0kJlJBBOBgJb1_WpeIZlg "A process classification allows Discovery to create a particular CI type from information gathered during the identification and exploration phases."), and [classifiers based on IP
  address scans](https://servicenow-prod.fluidtopics.net/ypYnTzCWJug2rXhRhyNUjw "When you run an IP address type of discovery, port probes scan devices without the use of credentials, and then Discovery can determine which classifiers to use. You can add port probes and additional classifiers for IP address discovery.").

  Before you modify any classifiers, [review the
  parameters](https://servicenow-prod.fluidtopics.net/MUt~FEg8Q5OS2Uhy_tjoIg "These parameters are available for Discovery classifiers.") that are available for each type of classifier.
* If Windows machines are on your network, you can use the WinRM protocol, rather than WMI, for more efficient lightweight data transfer and remote command execution. By default, Discovery uses WMI. For instructions on the classifier modifications you can make to use WinRM, see [Use Windows Remote Management for classification](https://servicenow-prod.fluidtopics.net/XC0APTUDdqiGNRLN6RIKBA "You can configure the discovery of Windows hosts using the Windows Remote Management (WinRM) protocol.").
* If you have Windows computers that are acting as servers and you want them to be classified by their function rather than by the operating system, you can make changes to the criteria of the Windows classifier. See [Reclassify a Windows Workstation machine as a server](https://servicenow-prod.fluidtopics.net/pdih8tzVcLfc_IK2LczrmQ "By default, Discovery automatically classifies computers using certain Windows operating systems as workstations. However, you might want specific computers in your network that are acting as servers to be classified by their function and not their operating system.") for instructions.
{#discovery-classifiers__ul_ql5_kwc_fcb}