Discovery

Kubernetes Visibility Agent detects changes on resources in a Kubernetes cluster. It performs continuous discovery, reports any changes back to your instance, and updates the Configuration Management Database (CMDB) with the latest data.

Access the IT Operations Management Configuration Console to set up Discovery.

You can upgrade Kubernetes Visibility Agent using either a Helm chart or the Kubernetes YAML file.

Activate schedules that were created automatically via the Discovery and IP Address Management (IPAM) integration.

Add a certificate authority (CA) that supports the ACME protocol to enable automated certificate request, renewal, and revocation flows.

Add Azure change processing support for an Azure resource type per the needs of your organization.

Enable your MID Server to auto-renew your certificates by adding the Certificate Inventory and Management and GenerateCSR applications.

Administrators can configure Discovery settings, assign roles, manage credentials, and review Discovery schedules, errors, and anomalies through the ITOM Configuration Console.

Alibaba Cloud discovery is one of the overall Cloud discovery offerings within the IT Operations Management (ITOM) Visibility framework. It’s an automated process used to scan and identify Alibaba Cloud resources within your organization's cloud infrastructure. This discovery process is critical for maintaining an accurate and trustworthy data foundation—the Configuration Management Database (CMDB).

Sometimes you need to manually approve a certificate task to ensure the validity and security of TLS certificates.

From Certificate Inventory and Management version 1.1.7, the Data Archiver [com.glide.auxdb] plugin performs daily operations to transfer data that is no longer required from primary tables to a designated set of archive tables.

Archive firewall rule requests, audit requests, and audit tasks that are older than a specific time period to enhance system performance. At a later time, you can delete them from the archive table altogether to reduce the size of that table.

Assign the discovery_admin role to users who will be in charge of Discovery configuration and operational control.

Attest or reject ownership of a certificate from your certification attestation email notification.

Attestation jobs run in regular intervals, sending emails to certificate owners, giving them a chance to review certificate ownership.

Automate the flow of requesting, renewing, and revoking your certificates by integrating Keyfactor EJBCA with the Automated Certificate Management Environment (ACME).

From Certificate Inventory and Management version 1.3.8, you can automate the request flow for new certificates, renewals, and revoking certificates.

Detect certificates that are about to expire and renew them automatically before expiration to keep your digital systems secure and continuously available.

Renew a specific certificate by opening it and asking the certificate renewal AI agent to renew it.

Cloud Discovery uses Patterns to discover certificate data that the Amazon AWS Cloud Certificate Manager (ACM) manages. Discovering this data requires installing and updating Discovery and Service Mapping Patterns and Certificate Inventory and Management.

Configure the Amazon Web Services (AWS) Config service to send event notifications to the ServiceNow instance for any changes in the lifecycle state of a resource.

Comparison of use cases and requirements for cloud discovery methods in AWS.

ITOM Visibility applications discover a variety of AWS resources and populate the relevant configuration item (CI) classes in the Configuration Management Database (CMDB) with their attributes.

Use AWS events-driven discovery to keep your CMDB current automatically when AWS resource configurations change, without waiting for a scheduled Discovery run.

AWS Systems Manager (SSM) Agent discovery introduces a streamlined, agent-based approach to discovering Amazon Elastic Compute Cloud (EC2) using AWS SSM. This integration enhances Discovery by leveraging SSM agents to reduce dependency on traditional MID Server configurations, simplify credential management, and improve scalability across multi-region environments.

Cloud Discovery uses Patterns to discover Azure Key Vault certificates. Discovering this data requires installing and updating Discovery and Service Mapping Patterns and Certificate Inventory and Management.

The Azure change processing feature collects information about Microsoft Azure resources that have undergone a life-cycle state change or configuration change near real time. Then, it uses the collected information to update the Configuration Management Database (CMDB).

Discover Linux virtual machines on Azure using Service Principal (SP) with short-lived SSH certificates. Using these certificates circumvents the need for passwords or public and private key-pairs.

If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources.

Comparison of use cases and requirements for cloud discovery methods in Azure.

ITOM Visibility applications discover a variety of Microsoft Azure resources and populate the relevant configuration item (CI) classes in the Configuration Management Database (CMDB) with their attributes.

The bulk certificate upload Excel template contains fields that map to the fields in the Unique Certificate [cmdb_ci_certificate] table. You can import up to 5000 SSL certificates in bulk using the Excel file.

Discovery Admin Workspace enables you to conveniently view, edit, and run Discovery schedules conveniently within a single interface.

The horizontal discovery process passes through the four phases of discovery using probes, which gather information on the target machine. Sensors then help Discovery determine what to do with that information.

A Discovery schedule for VMware virtualization discovers vCenter and ESX hosts and individual ESXi hosts that manage VMs and related components without a vCenter.

Use these guidelines to avoid common issues when you use Discovery and System Center Configuration Manager (SCCM) together.

Discovery behaviors determine the probes that Shazzam launches and from which MID Servers these probes are launched.

Configure the elements that Discovery requires to investigate your network, such as credentials, schedules, and IP addresses.

Use the Discovery Configuration Console to manage what kind of configuration items (CIs) and CI information you want to discover.

Domain separation is supported in Discovery. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Review common Discovery error messages and their causes to identify and resolve issues that occur during discovery runs.

You can configure several additional components of Discovery such as Application Dependency Mapping, the ECC queue, and extensions for the MID server.

After Discovery classifies a configuration item (CI), it uses identifiers to determine if the device already exists in the Configuration Management Database (CMDB).

Discovery probes and sensors perform data collection and update the Configuration Management Database (CMDB).

The Discovery status provides a summary of a Discovery launched from a schedule. You can also cancel a Discovery that is in progress from the status form.

A Discovery timeline generates a graphical display of a Discovery Status record, including information about each probe and sensor that was used in the discovery.

Learn how to monitor the progress of your discoveries and how to configure the system to aggregate performance metrics that are important to you. Find descriptions of the error messages you see, and possible steps you can take to solve problems. The Now Support Knowledge Base on Hi contains several articles to help you troubleshoot discovery issues.

You can optimize Discovery properties to adjust throughput and enhance safety when pinning jobs.

Discovery finds computers, servers, printers, a variety of IP-enabled devices, and the applications that run on them. It can then update the configuration items (CIs) in your Configuration Management Database (CMDB) with the data it collects.

When Discovery has determined the device's class, it launches an identity probe that is configured to run one or more commands with a single authentication.

Network Discovery discovers the internal IP networks and subnets within your organization.

The PowerShell Probe executes PowerShell V2 scripts on the MID Server host.

SNMP probes query a device for a list of OIDs using the SNMP protocol. The results are traversed and passed back to the sensors. MID Servers support all SNMP protocol versions by default. You can set a MID Server to support only specific SNMP versions.

Discovery supports SNMP versions 1, 2c, and 3. If you have an active SNMP v3 credential, valid options for SNMP version are v3 or All. If you have an active SNMP v1 or v2 credential (community string), valid options for SNMP version are v1, v2c, or All. Default is All.

The SSHCommand probe computes the default path from the following sources.

A probe using the ECC queue topic name SSHCommand executes a shell command on the target host, and returns the resulting output to the sensor.

In the basic VMware system, the VMware Workstation runs on a Windows or Linux host machine, but not managed directly thorugh vCenter.

A pattern is a series of operations that tell Discovery which CIs to find on your network and what credentials to use. Patterns also define what tables to populate in the CMDB.

Explore the Certificate Authorities (CA) pattern API elements and permissions for comprehensive insights into the associated functionalities and authorization requirements.

Fine-tune discovering applications based on processes, if the discovery results are not satisfactory.

Streamline the process of gaining insights into certificate and inventory Management, covering key aspects like certificate discovery, bulk upload functionality, maintenance of certificate chain relationships, configuration of Credential Identifiers, customization of the system, creation of new/renewal requests, archiving tasks, automation of TLS certificate management, integration with Event Management, Slack notifications for alerts, and leveraging cert-Manager for efficient certificate generation.

Certificate Inventory and Management serves as a centralized and automated solution for handling the complexities of certificate management. It enhances security, ensures compliance, and provides a streamlined approach to managing the life cycle of digital certificates within an organization.

Following the discovery phase, the system manages TLS certificates, offering flexibility for both manual and automated request options, catering to various certificate-related tasks and processes.

The pre-discovery phase involves preparatory steps, such as defining scanning parameters and configuring credential details, for a smooth initiation of the certificate discovery process.

Certificate Inventory and Management allows Discovery to automatically scan for certificates on specific ports through your existing CI-based Discovery schedules. In addition, you can create new Discovery schedules to scan individual URLs.

Dedicated users with specialized roles are assigned to optimize the monitoring and tracking of requests for new and renewing certificates.

From version 1.2.0 onward, Certificate Inventory and Management integrates with Event Management, providing a unified solution for streamlined operations. This integration enables the generation of events and notifications, with the added capability of sending alerts to Slack. Certificate Inventory and Management also supports sending certificate notifications via email and Microsoft Teams.

The Certificate Management workspace provides centralized visibility into your organization's certificates so you can make data-driven decisions. For example, you can avoid outages by looking at the numbers that are soon to expire.

With Certificate Inventory and Management, you can discover, conduct an inventory, and proactively manage all TLS certificates. Certificate Inventory and Management supports IPv6, providing comprehensive coverage for your certificate management needs.

Efficiently manage your Certificate Inventory with patterns to streamline the management of digital certificates. Patterns reduce the risk of vulnerabilities by bolstering security, compliance, and efficient life cycle control.

Reference topics provide additional information about Certificate Inventory and Management dashboard and components, including tables, patterns, and terms.

This framework supports security, compliance, and streamlined operations. Certificate Inventory and Management tables provide a centralized system to track and manage digital certificates. They capture key details, including discovered certificates, installation locations, historical data, and associated tasks such as renewals and requests.

The Certificate Inventory and Management glossary comprises a set of concise definitions and explanations for terms related to the tracking, storage, and management of digital certificates within an IT environment.

Request a certificate through Kubernetes cert-manager using the ServiceNow External Issuer (sn-external-issuer) and save the certificate and its related information securely within the Kubernetes cluster as a secret. In Kubernetes, a secret is an object that allows you to store and manage sensitive information, such as passwords, API keys, and certificates.

Fill in the Certificate Routing Policy form to set up the routing policy for ACME.

To automate the processes of your certificate life cycle, you must fill out a routing policy form that populates your Certificate Signing Requests. This table shows you the required fields and values.

The Certificate Routing Policy form enables you to configure routing policies for CyberArk Certificate Manager SaaS.

Discovery generic attributes can automatically set configuration item (CI) field values during discovery. Attributes follow a scope hierarchy where more specific scopes override broader ones. You can define defaults at the schedule level and apply precise values at the range level.

The ServiceNow Certificate Inventory and Management application has been integrated with CyberArk Certificate Manager SaaS for automated certificate life-cycle management, providing centralized certificate provisioning, renewal, and revocation capabilities.

These parameters are available for Discovery classifiers.

Comparing cloud discovery solutions provides insights on the relative strengths of each solution. The comparison showcases the number of resource types supported by the solutions across AWS, Microsoft Azure, and GCP. The comparison can help you understand the capabilities of each solution and better manage your CMDB when using one or multiple methods.

Reference topics provide additional information about the lists, forms, and cloud settings used in Cloud Discovery.

Cloud discovery reporting provides a user-friendly interface for navigating and analyzing your cloud resource inventory. It offers drill-down and slice-and-dice views to gain granular insights into your cloud resource inventories, with details obtained from the discovery. It provides an easier and faster way to locate and identify the state and location of cloud resources, streamlining your management tasks.

Perform the necessary procedures to prepare for discovering resource CIs on the cloud.

Get started with Cloud Discovery by configuring credentials, service accounts, schedules, and MID Servers.

ITOM Visibility cloud discovery solutions enable you to collect detailed information about your cloud-based infrastructure and your resources in major cloud service providers: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), IBM Cloud Platform, Oracle Cloud Infrastructure (OCI), and Alibaba Cloud.

Create schedules for discovering cloud resources based on the discovery method that you choose: service accounts or IP ranges. The discovery schedule defines the various settings for the cloud discovery.

The Cloud Discovery service account form displays detailed information about the selected cloud provider. The Cloud Discovery service account form is available in the Cloud Discovery Workspace.

The Cloud Discovery home page displays a summary of the discoveries triggered through a discovery schedule. You can view the count of CIs discovered and errors encountered over time. You can also select any dashboard report to view additional information.

The Cloud Discovery schedules dashboard displays information about the selected discovery run.

View the Cloud Discovery errors that occurred during the discovery and resolve them. You can view the errors for all the Cloud Discovery runs or a single Cloud Discovery run.

Platform Analytics Solutions contain prepackaged Performance Analytics and Reporting content for use with other ServiceNow AI Platform products. Finish the following sentence with a short statement on the business use case for this Solution. For example: This Analytics and Reporting Solution helps you track trends in incidents and plan your incident management strategy going forward.

The Cloud Resources dashboard shows the aggregated view of all your cloud resources, their combined analytical views, and a visual summary and detail of all your cloud resources.

Activate the Performance Analytics Content Pack for the Cloud Resources ServiceNow Store application for the Analytics and Reporting Solution.

Use the ServiceNow Cloud Resources Explorer to filter and visualize the distribution of resources across your multi cloud estate. Gain insight into operational information such as stale resources and cloud event inflow rates.

This section refers to advanced configuration options for the Kubernetes Visibility Agent component running in a Kubernetes cluster.

Configure system properties to control the automatic retirement of inactive Kubernetes cluster configuration items (CIs) and their associated resources, so your CMDB reflects only active infrastructure.

The Kubernetes Visibility Agent Informer collects data on Kubernetes resources and populates various CMDB tables.

Add custom Labels and Annotations to all resources deployed by Kubernetes Visibility Agent in the Kubernetes cluster.

In Kubernetes Visibility Agent, define include and exclude lists of Labels and Annotations in Kubernetes resources that the Informer pulls into the Configuration Management Database (CMDB).

Switch off continuous discovery by Kubernetes Visibility Agent if all you need is periodic snapshots of your cluster resources. If you have multiple clusters with frequent changes, deactivating continuous discovery reduces the load on your instance.

Customize how often you want the Kubernetes Visibility Agent Informer to run a full discovery.

Set the memory limit and memory request of the Kubernetes Visibility Agent Informer pod.

Configure whether the Kubernetes Visibility Agent Informer creates a server CI for each Kubernetes node.

You can configure the Kubernetes Visibility Agent Informer to pull extra resources from Kubernetes clusters into the Configuration Management Database (CMDB), in addition to the resources it sends to the database by default. By pulling in additional resources beyond the default set, you can enhance visibility into your Kubernetes clusters.

Make the Kubernetes Visibility Agent Informer populate the relevant field in the cmdb_ci_kubernetes_cluster CI to display the Kubernetes cluster version.

Set up Kubernetes Visibility Agent by performing the described procedures.

You can install Kubernetes Visibility Agent Informer using either a Helm chart or the Kubernetes YAML file provided by ServiceNow.

Prepare your ServiceNow instance and the Kubernetes cluster for Kubernetes Visibility Agent (KVA) deployment.

Kubernetes Visibility Agent enables you to gain visibility into on-premises Kubernetes clusters and the various Cloud deployments.

The fields in the Kubernetes Visibility Agent Informers table sn_acc_visibility_kubernetes_informer describe the status of the Informer pods deployed in your Kubernetes clusters.

Upgrade Kubernetes Visibility Agent Informer pods in Kubernetes clusters remotely from the ServiceNow Instance to avoid dependence on your Kubernetes admin. You can upgrade a single Informer or multiple Informers together.

Control Kubernetes Visibility Agent Informer execution parameters from the ServiceNow Instance to avoid dependence on your Kubernetes admin.

Reference information about Kubernetes Visibility Agent.

The Kubernetes Visibility Agent component is supported on several versions of Kubernetes and OpenShift and in various Kubernetes environments.

Discovery is supported on instances with Code Signing enabled. Code signing validates the integrity of Discovery components before execution to help prevent unauthorized scripts from running on MID Servers and target machines.

Command Validation Tasks form displays the fields that you must fill when you create or modify a task for testing a pattern command.

The Command List form contains all commands used in discovery by infrastructure or application type patterns.

You can compare two versions of tracked CI configuration files to see the actual changes made to them.

Enable the system to automatically create Discovery schedules based on IP data from your IP Address Management (IPAM) connections.

Configure a system property to disable unsupported script tracking for Cloud Discovery operations on instances with code signing enabled.

Update the data collection time interval for individual visualizations on the Discovery Operations Monitor dashboard. By default, each visualization displays data in 15-minute intervals.

Configure two MID Server parameters to run File-based Discovery and Windows ADME on target hosts that use PowerShell 7.

Configure MID Server properties to enable Key Management Service (KMS) key access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery.

Enable the auto-renewal options in your System Properties to configure your system to renew automatically Transport Layer Security (TLS) certificates before they expire.

Update the data time frame for individual visualizations on the Discovery Operations Monitor dashboard. By default, each visualization displays data from the last 7 days. You can extend the time frame up to 30 days, which is the maximum data retention period for this dashboard.

Configure for VMware Discovery by setting up alternate port for vCenter and configuring your ESXi resource pools.

Configure the Azure change processing to collect resource change information from the Microsoft Azure cloud and use it to update the Configuration Management Database (CMDB).

Configure your base API URL for EJBCA ACME to your organization's root URL address.

Send out emails to all certificate owners confirming their ownership or confirming they're no longer certificate owners at set intervals.

Configure a proxy bypass for container image scans to reach specific internal or private registries that require a direct connection.

Ensure unique identification and effective management of credentials by configuring credential identifier for Certificate Inventory and Management.

Define a non-root user for AWS SSM discovery by creating a credential record that specifies a user name with sufficient privileges to execute discovery commands on Linux targets.

Configure authentication credentials so Certificate Inventory and Management can communicate with CyberArk Certificate Manager SaaS for automated certificate life-cycle management.

Configuring the "Run as" user in a Discovery schedule directs discovered Configuration Items (CIs) to the correct domain and maintains data isolation.

Collect information about root certificates stored outside your server. Create a specialized Discovery schedule.

Configure MID Server properties to enable Simple Storage Service (S3) access from the ServiceNow AI Platform when performing Systems Manager (SSM) Agent discovery.

Configure certificate notifications to be delivered to a Microsoft Teams channel so that you can receive alerts and initiate certificate renewal workflows directly from Microsoft Teams. Configure certificate notifications to be delivered to a Microsoft Teams channel so that you can receive alerts and initiate certificate renewal workflows directly from Microsoft Teams.

Using properties, you can enable or disable ADM discovery, and you can set the location of the TCP tracking file for enhanced ADM.

Configure your MID Server and system properties to automatically renew certificates before they expire.

Connect intermediate certificates to recently imported certificates or to root certificates located outside the servers to complete the certificate chain of trust.

The Discovery and Service Mapping Patterns application uses the Scan Container Image pattern to discover Docker images and OS packages data. Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.

Container discovery enables IT departments of companies to collect detailed information about their container management tools in the infrastructure. Discovery finds resources in major container management services providers.

The ITOM Visibility apps, Discovery and Service Mapping Patterns and Kubernetes Visibility Agent integrate with Aqua Trivy to collect data on container images and OS packages. You can increase your control over container deployment by having visibility to the container components.

Enable container image scanning using the Aqua Trivy tool.

The Create a new discovery schedule form displays information related to the schedule and the target cloud provider. The Create a new discovery schedule form is available in the Cloud Discovery Workspace.

Create Alibaba Cloud API credentials on the ServiceNow AI Platform to enable access to your Alibaba Cloud resources during Alibaba Cloud discovery.

Create a Discovery schedule to run Alibaba Cloud discovery.

Use the Discovery Admin Workspace dashboard to create an Alibaba Cloud Discovery schedule.

Create a service map that maps application services based on traffic between the workloads in Kubernetes using Istio or Linkerd service meshes or a ServiceNow DaemonSet.

An HTTP classifier enables the horizontal discovery process to find devices via the HTTP protocol.

Use the Discovery Admin Workspace dashboard to create an Amazon Web Services (AWS) Discovery schedule.

If your cloud resources are in an Azure cloud, create credentials that can access the Azure account. This procedure requires configuration in your Azure account.

Use the Discovery Admin Workspace dashboard to create an Azure Discovery schedule.

Create cloud credentials to manage access to cloud-based applications, including Amazon Web Services, Microsoft Azure, and Google Cloud. Discovery uses these credentials to connect to your cloud provider accounts and discover cloud resources.

Create credentials so Certificate Inventory and Management can communicate with your ACME certificate authority (CA) for automated certificate life-cycle management.

Create a Discovery behavior to determine which probes Shazzam launches and which MID Server is used.

A CI classification allows Discovery to discover most common operating systems, network devices, and processes.

Use the Discovery Admin Workspace dashboard to create a Google Cloud Platform (GCP) Discovery schedule.

Create hybrid service maps that extend outside the Kubernetes cluster and map other related service resources.

Use the Discovery Admin Workspace dashboard to create an IBM Discovery schedule.

Create IP credentials for Discovery to securely connect to devices in your environment. Discovery uses these credentials to log in to devices and retrieve configuration data during the discovery process.

Create a user account with the mid_server role so MID Servers can authenticate and communicate with the ServiceNow instance.

Create certificate requests manually through Service Catalog for approval when your certificate authority (CA) is not covered in the automated flow.

Use the Discovery Admin Workspace dashboard to create an Oracle Cloud Infrastructure (OCI) Discovery schedule.

Use the Discovery Admin Workspace dashboard to create an OpenStack Discovery schedule.

Use the Discovery Admin Workspace dashboard to create an oVirt Discovery schedule.

To find application CIs that reside on a known host in your CMDB, create an infrastructure pattern for host-based serverless discovery. After creating the pattern, create a Discovery schedule that triggers the pattern.

To find application CIs that reside on an unknown host, create an infrastructure pattern for standard serverless discovery. After creating the pattern, create a Discovery schedule that triggers the pattern.

Manually initiate renewal requests for certificates using the Service Catalog for approval when your certificate authority (CA) is not covered in the automated flow.

Create routing policies to direct certificate requests to CyberArk Certificate Manager SaaS by matching attributes such as organization, domain, and certificate type to the Routing Policy [sn_disco_certmgmt_routing_policy] table.

Enable application service maps based on the traffic between the workloads in Kubernetes by connecting to a Cilium agent already running in the cluster.

Enable application service maps based on the traffic between the workloads in Kubernetes by using a ServiceNow DaemonSet as part of Kubernetes Visibility Agent (KVA) installation.

Enable application service maps based on the traffic between the workloads in Kubernetes by using Istio or Linkerd or service meshes as part of Kubernetes Visibility Agent (KVA) installation.

Use the Discovery Admin Workspace dashboard to create a VMware Discovery schedule.

Credential-less Application Discovery attempts to identify an application service actively listening on a specific port at a given IP address.

Credential-less host discovery occurs when a scanned host is found to be alive, but not active, or when all configured credential-based classification probes have failed.

Customize various aspects within Certificate Inventory and Management using Discovery properties, enabling you to tailor the solution to your specific needs and enhance the overall management of TLS certificates.

Configure default policy owner and approval groups for firewall rule change requests to reduce manual data entry.

Nmap executes in phases when collecting data and runs a controlled set of safe commands with two patterns for exploring applications and devices.

Use the New IP data dialog in the IP inventory page to add IP addresses, ranges, networks, or range sets to your discovery configuration.

Use the IP inventory page in Discovery Admin Workspace to add IP ranges or networks to a new or existing range set.

The Discovery Status Details page offers a summary of a discovery initiated from a schedule, detailing the devices identified, any errors encountered, and any anomalies found.

Configure a certificate port probe in the Discovery Admin Workspace, so Discovery collects certificates from devices with secure ports open during your existing IP-based Discovery schedules.

Create a certificate Discovery schedule in the Discovery Admin Workspace to collect certificates from specific URLs rather than from ports found during IP-based Discovery.

The Error Details page displays the root cause and remediation steps for a specific Discovery error, along with the list of individual error instances associated with that error.

The IP inventory page centralizes the IP addresses, ranges, networks, and range sets that Discovery uses to scan your environment. Use it to review existing IP data and add entries to Discovery range sets.

Define attributes on a Discovery schedule, IP network, IP range set, or IP address range to automatically populate configuration item (CI) field values during discovery.

Use the system property sn_disco_certmgmt.auto_renewal_max_retries to set the maximum retries your system enables for automatic certificate renewal.

When you perform discovery with a pattern, you can choose what to do with configuration items (CIs) that are in the Configuration Management Database (CMDB) but Discovery can no longer find.

Deploying a MID Server lets ServiceNow securely communicate with systems inside a private network by installing and validating a trusted runtime that performs discovery, integrations, and automation tasks without requiring inbound network access.

Configure Docker discovery to collect image CIs only, instead of both image and container CIs.

As a member of a security team, you can discover firewall devices, policies, and owner groups from supported vendors (Palo Alto Panorama and Fortinet FortiManager), allowing a central view of the footprint. This data is updated in the ServiceNow CMDB. Set up a schedule to discover your firewall policies to help you keep track of your company's valuable information.

Discovery generic attributes enable you to define custom attributes at the schedule, range, and range set level. These attributes attach metadata that can influence CMDB field population and Discovery runtime behavior, providing granular control based on the scope of the discovery.

The Discovery Operations Monitor dashboard displays performance metrics for your Discovery environment. Use this dashboard to monitor discovery health and identify issues across your IT landscape.

Horizontal discovery with patterns has four phases, just as horizontal discovery with probes does. However, for the last two phases, Discovery triggers operations from a pattern, rather than additional sets of probes.

Use the Discovery Admin Workspace Diagnostics page to identify and resolve the cause when Discovery fails to start or classify a device.

Discover applications based on suggestions based on ServiceNow Predictive Intelligence. Predictive Intelligence automatically classifies and categorizes the discovered running processes, as application fingerprints, and provides suggestions. ITOM Visibility uses Predictive Intelligence to perform initial analysis of discovered processes and suggest applications that you might want to discover. When using this method, ITOM Visibility automatically creates a Configuration Management Database (CMDB) configuration item (CI) class, a classifier, or a pattern for the new application CI class.

Discover applications using suggestions based on ServiceNow Predictive Intelligence or ServiceNow ITOM Content Service to create configuration items.

KubeVirt provides a unified development platform where developers can build, modify, and deploy applications in both Application Containers and Virtual Machines.

Use the Discovery Admin Workspace to identify compute resources that weren't discovered recently. Run a quick discovery to update the resource's data. If a resource isn't discoverable, ignore the resource and exclude it from the report. This procedure helps you maximize the use of your resources.

Describe the certificates that you want to renew, and the certificate renewal AI agent finds them and renews them after you confirm.

Collect information about root certificates stored outside your server. Create a specialized Discovery schedule.

When viewing suggestions based on application fingerprints, verify the information on the Application fingerprints suggestion form.

The Diagnostics page helps you prioritize and address errors and anomalies in IP-based and Cloud Discovery schedules.

The Discovery Admin Workspace Home page features tools to help you identify and address the most critical discovery errors.

The Insights page provides widgets, dashboards, and reports for IT operations management and infrastructure monitoring. Use these tools to improve operational visibility and infrastructure health.

The Schedules page provides a single place to monitor Discovery performance, efficiently manage schedules and statuses, and set up new IP-based or Cloud Discovery schedules.

The Settings page enables you to customize and manage high-level Discovery properties so they're tailored to meet your specific needs.

The Tuning page enables you to validate your existing configurations and resolve configuration issues.

The Discovery Admin Workspace serves as a central location for monitoring, tracking, and completing discovery-related tasks. Experience a streamlined discovery process and greater efficiency with the integration of schedules, diagnostics, tuning, anomaly detection, and more within this single workspace.

The Discovery API plugin provides APIs for scoped applications and is loaded when the Discovery plugin is activated.

ITOM Visibility uses Predictive Intelligence to perform initial analysis of discovered processes and suggest applications that you might want to discover. When using this method, ITOM Visibility automatically creates a Configuration Management Database (CMDB) configuration item (CI) class, a classifier, or a pattern for the new application CI class. Use the Application Fingerprints dashboard to review suggested applications.

A classifier tells Discovery which probes to trigger for the identification and exploration phases of discovery. Classifiers can also trigger the Horizontal Pattern probe, which launches a pattern, rather than additional probes, for identification and exploration.

Discovery commands are used for both probe and pattern-based discovery to access configuration items (CIs) in your environment.

Platform Analytics Solutions contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

ITOM Discovery Guided Setup provides a sequence of tasks that help you install and get started with Discovery. If you're setting up Discovery for the first time, this is a good way to get your environment up and running quickly.

The Discovery Home page provides a summary of discoveries that were triggered by cloud and non-cloud schedules. You can view any errors that occurred during a Discovery and find remediation suggestions. Use the Home page view to examine the cloud resources discovered for the service accounts you selected in a cloud schedule.

Use one or more of these methods in any combination to define the network or network segment for Discovery to query. You can include or exclude specific IP ranges from your query.

Discovery logs contain information on the horizontal discovery process based on probes and patterns.

Create schedules for discovering cloud resources using service accounts or IP ranges.

This Discovery enhancement collects performance metrics on probe/pattern and sensor processing times and then aggregates that data over time. You can use the roll-up data to monitor the performance of specific discoveries or to compare performance between versions after an upgrade.

Discovery Quick Start is a wizard that helps you get up and running with Discovery quickly. Use Discovery Quick Start tasks to discover IP ranges, or subnets, in your environment and then to identify the configuration items (CI) in those subnets.

Reference topics provide additional information about Discovery lists and forms.

Standard transactions on Windows and UNIX generate various amounts of network traffic, depending on what is being discovered.

To perform Discovery on root certificates stored outside your server, you must set a special Discovery schedule that locates these certificates. This table guides you through the form required for this task.

The Discovery Schedule form provides details about the configuration items (CIs) targeted for discovery, the associated MID Server, and the schedule settings for the discovery run.

After you activate the Discovery application, you have several ways to get started.

These tables display the SSH commands run by Discovery probes during horizontal discovery. These SSH commands require elevated privileges to run.

These tables display the SSH commands run by Discovery probes on target devices during horizontal discovery. These SSH commands don’t require elevated privileges to run.

The Content 360 page enables you to discover applications and evaluate application suggestions based on machine learning or crowd-sourced resources. Then, create configuration items with a single click.

DNS probes determine the DNS names for configuration items (CI).

By editing the definition check, you can change description and script.

The Edit settings form displays information about the Amazon Web Services (AWS) settings used to record and deliver the AWS events to the listening endpoint.

Configure Discovery to use AWS Systems Manager (SSM) Agent.

Enable the fallback root user property to allow AWS SSM discovery to run commands as root on Linux systems when alternate user credentials aren’t configured.

Enable the Software Bill of Materials (SBOM) creation and avoid duplicate SBOM files from being generated by setting the system properties.

Application service maps give you visibility into how workloads communicate in a Kubernetes cluster, helping you detect dependencies and monitor traffic flows in real time.

Use container image scanning with the Syft scanner to identify the software packages installed in your container images for compliance, licensing, and security purposes without requiring a MID Server.

Discovery Admin Workspace uses the Error Framework to surface actionable Discovery errors. You can review errors, understand their causes, and take steps to resolve them directly from the Diagnostics page.

You can specify a range of IP addresses that you want to exclude from your Discovery query.

The Automated Certificate Management Environment (ACME) is a communication protocol that automates the interaction between a certificate authority (CA) and a server. It streamlines the processes of requesting, renewing, and revoking SSL/TLS certificates.

AI Agents for Discovery provides an AI agent in Certificate Inventory and Management that helps PKI administrators automatically renew TLS certificates through a conversational prompt.

AI-powered features in Discovery help administrators investigate missing CI attributes, diagnose discovery errors, manage certificates, and request firewall rules using automation and generative AI.

AI provides an agentic workflow in Firewall Audits and Reporting that helps firewall administrators request new firewall rules using natural language.

Review this reference material for further details on File-based Discovery.

If you have any issues while setting up or running File-based Discovery, follow the actions listed here to help resolve them.

File-based Discovery helps you identify what software is running on your Windows and UNIX servers and devices, even if there's no registration information available. You can then manage and maintain records of your software licenses, check for unlicensed files, detect forbidden or damaged files, and help evaluate any threats from unwanted files.

The unified dashboard enables security and risk teams to oversee tasks, change requests, and the entire firewall inventory life cycle.

Set up the process to gain insight into discovering and compiling an inventory of firewall security policies, devices, device groups, and manager information.