Discovery

Imagine how an atlas is mapped and how places have been discovered using exploration devices including manually, by satellite, by survey maps, or by street maps collector devices.

These devices crawl through all the streets to collect different data points that include information about the streets, houses, and much more.

This information is used by consumers for various purposes, including GPS devices, finding and exploring different areas, finding the address of a location, checking for any incidents, constructions, or road closures on the way, and so on.

ServiceNow discovery works in the same way, ServiceNow discovery explores the enterprise network, identifying the devices in scope. ServiceNow discovery probes and sensors perform the collection of infrastructure devices connected to a given enterprise network. Discovery uses probes to determine which TCP ports are opened and to see if it responds to the SNMP queries and sensors to explore any given computer or device, starting first with basic probes and then using more specific probes as it learns more.

Discovery explores to check on the type of device, for each type of device, discovery uses different kinds of probes to extract more information about the computer or device, and the software that is running on it.

CMDB is populated through ServiceNow discovery. ServiceNow discovery searches for devices on the network, when ServiceNow discovery finds a device match within the CMDB; either CMDB gets updated with an existing CI or a new CI is created within the CMDB. Discovery can be scheduled to perform the scan at certain intervals; configuration management keeps the up-to-date status of the CI through discovery.

During discovery, the MID Server looks back on the probes to run from the ServiceNow instance and executes probes to retrieves the results to the CMDB with in the ServiceNow instance. No data is retained on the MID Server. The data collected by these probes is processed by sensors.

Discovery architecture

ServiceNow is hosted in ServiceNow data centers spanned across the globe. ServiceNow as an application does not have the ability to communicate with any given enterprise network. Traditionally, there are two different types of discovery tool on the market:

• Agent based: An agent is a piece of software installed on the servers or inpidual systems that sends all information about the system to the CMDB.
• Agentless: Agentless discovery doesn't require any inpidual installations on the systems or components. They utilize a single system or piece of software to probe and sense the network by scanning and federating the CMDB.

ServiceNow is an agentless discovery that does not require any inpidual software to be installed, but it does require MID Server to be installed on the network where discovery has to be run. Discovery is available as a separate subscription from the rest of the ServiceNow platform and requires the discovery plugin.

MID Server is Java software that runs on any windows or UNIX or Linux system that resides within the enterprise network that needs to be discovered. MID Server is the bridge and communicator between the ServiceNow instance that is sitting somewhere on the cloud and the enterprise network that is secured and controlled.

MID Server uses several techniques to probe devices without using agents. Depending on the type of infrastructure components, MID Server uses the appropriate protocol to gather information from the infrastructure component. For example, to gather information from network devices MID Server will use Simple Network Management Protocol (SNMP), to connect to the Unix systems MID Server will use SSH.

The following table shows different ServiceNow discovery probe types: