ServiceNow CIS-Discovery - ITOM Discovery Implementation

Start with the Discovery Log on the status record and drill into ECC payloads for probe failures. MID install logs can help for MID-down issues but are secondary for most schedule failures.

The Identification section collects unique attributes (serial number, hostname, etc.), passes them through CI Identifier rules to check whether the CI exists, then triggers an insert or update. If a critical step returns empty output, e.g., the SSH command finds no matching process, Discovery has no basis to create or update a CI and exits silently. A connection failure aborts the entire pattern with a logged error. The scenario states the Connection section completed successfully, ruling this out. A broken Extension reference causes a logged step error, not a CMDB omission. Extension sections run after Identification and only if at least one Identification section completes successfully; extension issues therefore occur after the point where the CI would already be identified/created. Exploration runs after Identification in pattern-based horizontal discovery (patterns are used in the Identification and Exploration phases), so an Exploration issue would occur after the CI has been identified rather than preventing Identification from producing any CI basis at all.

The Completeness, Correctness, and Compliance Key Performance Indicators (KPIs) display aggregated health information on the Configuration Management Database (CMDB) Health Dashboard. Completeness measures attribute population, Correctness evaluates identification rule adherence, and Compliance tracks class definition conformity. Administrators rely on this consolidated dashboard view to quickly assess overall CMDB data quality and pinpoint specific areas requiring remediation across the configuration management database. Staleness is a CI-level metric tracked within the CMDB, and Relationship Health has its own separate dashboard accessible from CMDB Workspace; neither appears as a KPI tile on the main CMDB Health Dashboard. The three tiles that appear are Completeness, Correctness, and Compliance. These metrics assess attribute population, identification rule adherence, and class definition conformity rather than the temporal freshness or relationship integrity that Staleness and Relationship Health measure. Duplicate is a CMDB Health metric but rolls up under the Correctness tile rather than appearing as its own dashboard KPI tile. The aggregated dashboard tiles remain Comple...

A delimited parsing strategy extracts each value into separate variables. Delimited parsing is used when the structure of the data is stable and fields are separated by a known, consistent character or sequence. Typical cases include CSV output, pipe-delimited command results, tab-separated values, or log lines where every record follows the same positional layout. Delimited parsing is simpler to configure, easier to read in a pattern, and more resilient when the input format is predictable. It is also less error-prone when extracting multiple columns into a tabular variable, because field boundaries are explicit. A regular expression does not extract each value into separate variables. Regex parsing is used when the data structure is irregular, loosely formatted, or cannot be reliably split by a single delimiter. This includes free-form text, mixed key-value output, logs with optional fields, or command output where spacing and ordering vary between records or versions. Regex allows selective extraction of values based on patterns rather than position, which is necessary when only certain tokens are relevant or when delimiters are inconsistent. The trade-off is higher complexit...

Windows discovery uses Windows Management Instrumentation (WMI) to query the target device for system information including OS version, hardware details, installed software, and running processes. WMI remote access requires local administrator or domain administrator privileges to access the necessary namespaces and execute queries. Service accounts that are created for discovery are granted these permissions. Sudo and root permissions are Linux/Unix privilege concepts used for SSH-based discovery. They have no relevance to Windows WMI-based discovery. Windows uses its own permission model based on local/domain administrator groups. While read-only WMI permissions might allow some basic queries, they are insufficient for full Windows discovery. Discovery requires access to multiple WMI namespaces and classes, including those that demand elevated permissions, as well as software inventory classes. Standard user accounts lack the WMI namespace permissions required for remote system queries. Even with remote access enabled, a standard user cannot query the full range of WMI classes that Discovery requires for complete device classification and exploration.