---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Discovery classifiers

# Discovery classifiers {#ariaid-title1}

Release version: Australia  
Updated November 1, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Discovery classifiers

Discovery classifiers in ServiceNow determine which probes or patterns to trigger during the identification and exploration phases of Discovery.
They initiate the identification process by using parameters returned from classification probes to decide subsequent actions.
Typically, you do not need to create or modify classifiers unless you want to discover new CI types or troubleshoot horizontal discovery issues.
Show full answer Show less  

## Types of Classification

* **Device Classification:** Identifies device types such as Windows or UNIX/Linux computers, routers, switches, and load balancers. It triggers additional probes like active processes probes for deeper exploration. Since the Madrid release, HTTP protocol can be used for classification but only if higher priority protocols like WMI, SSH, or SNMP are unavailable or fail.
* **Process Classification:** Classifies applications based on running processes during the exploration phase. It can create child CIs linked to parent devices and uses process handler scripts to avoid duplicate CIs. This classification also helps map application dependencies in the CMDB.
* **IP Address (IP Scan) Classification:** Credential-less classification using open ports and banners to identify devices and software. Once classified, Discovery launches exploration probes to gather detailed CI information. This method triggers multiple probes to collect attributes like disk size, memory, and connections.

## Classifier Criteria and Patterns

Classifiers use criteria based on parameters returned from classification probes, defined by parameter, operator, and value to control when they run. Process classifier conditions are case-sensitive. Discovery supports triggering patterns via the Horizontal Pattern probe attached to classifiers, enabling advanced identification and exploration beyond standard probes.

## Debugging and Customization

To debug classification issues, enable the system property **glide.discovery.debug.classification** which logs classifier execution details and available parameters. You can create or modify classifiers to discover new CI types or trigger additional probes, including adapting classifiers to use protocols like WinRM for Windows machines or reclassifying Windows workstations as servers based on function.

## Practical Benefits for ServiceNow Customers

* Enables tailored discovery of devices, applications, and IP-based CIs to accurately populate the CMDB.
* Supports efficient and flexible identification methods including protocol fallback and pattern-based discovery.
* Provides mechanisms to avoid duplicate CIs and ensure data consistency via process handlers.
* Allows customization for specific enterprise environments, including Windows protocol preferences and functional reclassification.
* Includes debugging tools to troubleshoot classification and discovery issues effectively.  
A classifier tells Discovery which probes to trigger for the identification and
exploration phases of discovery. Classifiers can also trigger the Horizontal Pattern probe, which
launches a pattern, rather than additional probes, for identification and exploration.
The classifier essentially starts the identification stage. Discovery uses it after the classification probe returns important parameters to the instance that tell Discovery what to do next.

In most cases, you do not need to create or modify a classifier. If you are having trouble with horizontal discovery, check the conditions that determine when a classifier runs. These conditions are based on the parameters the classification probe returns to the instance. To discover a new CI type that Discovery does not already find, create your own classifier.

## Device, process, and IP address classification {#discovery-classifiers__section_mrj_wkz_2cb}

Discovery classification can be broken down into three types: device classification, process classification, and IP address (or IP scan) classification:

Device classification

:   The classification of actual device types, such as a computer running Windows, a computer running a flavor or UNIX or LINUX, a router, a switch, or a load balancer, and so on.When Discovery identifies a computer CI, it triggers an active processes probe to explore the computer CI further. Discovery compares the results of the active processes probe to the process classification conditions to determine if there is a match.

    Starting with the Madrid release, the horizontal discovery process can classify devices using HTTP.  
    Of all protocols that Discovery uses (including WMI, SSH, and SNMP), HTTP is the lowest priority by default. Discovery uses HTTP classification only if:

    * Shazzam determines that the ports for HTTP (80) and HTTPS (443) traffic are open.
    * The horizontal discovery process fails for the higher priority port probes (WMI, SSH, and SNMP) if the ports for those protocols are not open, or if discovery for those protocols fail. The horizontal discovery process can fail, for example, if SSH and SNMP credentials are not configured or are incorrect.  
      Note:  
      See [Port Probes](https://www.servicenow.com/docs/2aY~7BvjUi~Ir2RC2cmgXA "Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters.") for more details on how port scanning works and to see the priorities of the different protocols.

    {#discovery-classifiers__ul_m4d_k13_sdb}HTTP classification launches the HTTP Classify probe to classify the device. The HTTP - Classify probe runs a GET request for each device for each HTTP classification. The URL of the request is built as follows: `PROTOCOL://IP:PORT/PATH`, where:

    For more information on port probes, see [Port probes](https://www.servicenow.com/docs/2aY~7BvjUi~Ir2RC2cmgXA "Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters."). For instructions on creating an HTTP classifier, see [Create an HTTP classification](https://www.servicenow.com/docs/Kk5ZrS1_3UPc22_azBmtjQ "An HTTP classifier enables the horizontal discovery process to find devices via the HTTP protocol.").

Process classification

:   The classification of applications based on the processes that are running. Discovery classifies processes during the last phase of discovery: the exploration phase, after identifying devices in the Computer \[cmdb_ci_computer\] table and its extensions. Just like device
    classification, process classification has its own classification criteria and also has the ability to launch probes. Unlike device classification, process classification creates child configuration
    items (CI) with Runs on::Runs relationships. By default, Discovery includes classifications for most common processes.

    If a process matches the classification criteria, Discovery determines whether to run the process handler script. The process handler script modifies the parameter data to help Discovery identify whether the process represents an existing or new application CI. Discovery process handlers prevent the creation of duplicate CIs by filtering out parameters known to have inconsistent values before process classification occurs. Every time Discovery adds or updates an application CI, it also determines the application dependency mapping of the application CI to other CIs in the CMDB.

IP address (IP scan) classification

:   IP address discovery is credential-less. It identifies devices and software using only the open ports and banners it finds, without requiring credentials. If the classification criteria are met for a device in the IP Scan mode, Discovery automatically updates the CI in
    the CMDB. After a device is properly classified, Discovery launches the exploration probes
    configured for that class of device and begins gathering detailed information about the CI.

    In the default Discovery system, the
    Linux classifier triggers eleven exploration probes that return information such as disk
    size, memory, and the number of current connections. The data from these probes returns at
    different times and is stored in the ECC Queue until processing is complete.  
    This diagram shows the processing flow for classifying and probing devices with an IP scan (no identifiers):Figure 1. IP scan classification

See [Classification for IP address discovery](https://www.servicenow.com/docs/JUBSslLLD3AIiaNvkk0K~w "Discovery provides a way to classify devices it finds through IP address discovery, even when no credentials are available.") for more details about the
parameters available to classifiers for this type of discovery.

## Classifier criteria {#discovery-classifiers__section_u3t_slx_2cb}

Classifiers also provide criteria that you can use to specify when Discovery should use the
classifier under the conditions that you define. The criteria is based on the parameters that a
classify probe returns to Discovery. Criteria is constructed
with the parameter, an operator, and a value.  
Note:  
Condition filters in process classifiers are case-sensitive.

## Classifiers and patterns {#discovery-classifiers__section_ayk_2by_2cb}

Discovery can use patterns, rather than probes, to identify and explore CIs. Discovery
triggers patterns from the Horizontal Discovery probe, which can be specified on a classifier.
You can create you own patterns and add them, via the Horizontal Discovery probe, to a
classifier. See [Add the Horizontal Pattern probe to a classifier](https://www.servicenow.com/docs/WtfJx~H7mHHJKPMU3hBM9w#t_AddHorizontalPatternProbe "To use a pattern for the identification and exploration phases of horizontal discovery, add the Horizontal Pattern probe to the relevant classifiers. The classifiers must match the CI types you are trying to discover.") for instructions. You
might already be using one of the out-of-box patterns that are provided with Discovery. You can
verify this by looking at the classifier to see if the Horizontal Pattern Probe is
specified.

## Logging classification debugging information {#discovery-classifiers__section_i24_jz1_z1b}

To log debugging information about classifications, add the following system property. The resulting log entries list the name of each classifier that runs, along with all the names and values that are available to the criteria in the classifier.{#discovery-classifiers__table_a4q_lly_2cb__entry__2}

| System property | Description |
|-|-|
| `glide.discovery.debug.classification` | Enables debugging information for process classification. * Type: true \| false * Default Value: false * Location: Add to the System Properties \[sys_properties\] table. For more information, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US). {#discovery-classifiers__ul_v3r_jxv_1q} |
[ ]

{#discovery-classifiers__table_a4q_lly_2cb}

## What you can do with Discovery classification {#discovery-classifiers__section_wqn_nvc_fcb}

* Create or modify a discovery classifier if you want to classify CIs that Discovery does not already classify, or trigger other probes that are not already on a classifier. You can modify classifiers that Discovery uses in [standard CI discovery](https://www.servicenow.com/docs/SSxAivg8J_Y2~NZ4Nyyziw "A CI classification allows Discovery to discover most common operating systems, network devices, and processes."), [process
  classifiers for applications](https://www.servicenow.com/docs/Ut8zP2rAy4sKKvicIuwaCg "A process classification allows Discovery to create a particular CI type from information gathered during the identification and exploration phases."), and [classifiers based on IP
  address scans](https://www.servicenow.com/docs/8wcAeTTVEmViL~kWhIh11g "When you run an IP address type of discovery, port probes scan devices without the use of credentials, and then Discovery can determine which classifiers to use. You can add port probes and additional classifiers for IP address discovery.").

  Before you modify any classifiers, [review the
  parameters](https://www.servicenow.com/docs/tryg2Lnpe1Nnxu31m5BvRg "These parameters are available for Discovery classifiers.") that are available for each type of classifier.
* If Windows machines are on your network, you can use the WinRM protocol, rather than WMI, for more efficient lightweight data transfer and remote command execution. By default, Discovery uses WMI. For instructions on the classifier modifications you can make to use WinRM, see [Use Windows Remote Management for classification](https://www.servicenow.com/docs/9Y~GFtqEFCQ90pm2JdMObQ "You can configure the discovery of Windows hosts using the Windows Remote Management (WinRM) protocol.").
* To classify Windows computers that act as servers by function rather than by operating system, update the criteria of the Windows classifier. See [Reclassify a Windows Workstation machine as a server](https://www.servicenow.com/docs/4T0srxsIPvv6Y7HOHY17AA "By default, Discovery automatically classifies computers using certain Windows operating systems as workstations. However, you might want specific computers in your network that are acting as servers to be classified by their function and not their operating system.") for instructions.
{#discovery-classifiers__ul_ql5_kwc_fcb}