--- sourceDocument: Brazil IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Horizontal discovery process flow with probes and sensors # Horizontal discovery process flow with probes and sensors {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Horizontal discovery process flow with probes and sensors The horizontal discovery process in ServiceNow uses probes and sensors across four phases to identify and classify devices on a network and update the Configuration Management Database (CMDB). This process is initiated by scheduling or manually triggering discovery for specified IP addresses or ranges. Show full answer Show less ## Discovery Phases * **Kicking off Discovery:** Discovery starts with user configuration or on-demand launch, targeting specific IP addresses. * **Scanning phase:** The Shazzam probe and port probes are executed via the MID Server to detect open ports and gather initial information about the device type (e.g., UNIX/Linux if port 22 is open). Results are returned to the instance through the External Communication Channel (ECC) queue. * **Classification phase:** Based on port probe data, Discovery sends a classification probe to gather detailed device information such as operating system version, determining the Configuration Item (CI) class. Only one classification probe runs per device. * **Identification phase:** Discovery selects the appropriate classifier based on the CI class to run identification trigger probes that apply identification rules. These rules decide whether to insert or update CIs in the CMDB. Probes gather identification data which sensors process to update the CMDB accordingly. * **Exploration phase:** Exploration probes specified in the classifier's Triggers Probes related list run to collect additional data and enrich the CI information. Data is sent back through the MID Server, and sensors apply updates to the CMDB similarly to the identification phase. ## Key Components * **Probes:** Scripts executed by the MID Server to collect information from target devices across different discovery phases. * **Sensors:** Processes that analyze probe data and determine how to update the CMDB with new or changed CI information. * **MID Server:** Acts as the communication channel between ServiceNow and target devices, running probes and managing data flow via the ECC queue. * **ECC Queue:** The queue that holds discovery requests and responses to coordinate probe execution and data return. ## Practical Benefits for ServiceNow Customers This structured discovery approach enables accurate identification, classification, and updating of devices in the CMDB, ensuring reliable and up-to-date configuration data. Customers can automate discovery across diverse device types and protocols, leading to improved IT service management and infrastructure visibility. The horizontal discovery process passes through the four phases of discovery using probes, which gather information on the target machine. Sensors then help Discovery determine what to do with that information. ## Kicking off Discovery A user triggers horizontal discovery by configuring a discovery schedule or by launching an on-demand discovery with Discover now or Quick Discovery. The schedule specifies one or more IP addresses or range of IP addresses. ## Scanning phase 1. Discovery first takes the Shazzam probe (and then [port probes](https://www.servicenow.com/docs/mTJydb5_g1_KYh6wCnBhwA "Port probes are used in Discovery by the Shazzam probe to detect protocol activity on open ports on devices it encounters.")) and places it in a request in the External Communication Channel (ECC) queue. 2. The MID Server checks the ECC queue, retrieves the discovery request, and runs the probes against the host and discovers open ports. 3. The port probes scan common ports using several protocols, such as WMI, HTTP, SSH, and SNMP. 4. If one or more ports respond, the Shazzam probe sends information about the port back to the ECC queue through the MID Server. 5. Discovery checks the ECC queue to find out which ports responded, which identifies the type of machine. For example, if Shazzam detects that the machine is listening on port 22, Discovery treats the machine as a UNIX or Linux machine. {#c_DiscoProcessFlows__ol_m13_l45_bz} ## Classification phase 1. The Discovery application determines which classification probe to send to the newly discovered device by using information in the record of the port probe that successfully responded. 2. Discovery puts the classification probe into the ECC queue. 3. The MID Server checks the ECC queue, retrieves the discovery request, and runs the classification probe. 4. The classification probe retrieves additional information, such as which version of the operating system is running on a machine. This information determines the class of the CI that Discovery found. There is only one classification probe per discovered device. 5. The classification probe sends information back to the instance ECC queue through the MID Server. {#c_DiscoProcessFlows__ol_ey2_pqt_lx} ## The Identification phase 1. Discovery determines which classifier to use based on the class of the CI and the criteria specified in all CI classifier records. The classifier specifies which probes to use for the next two phases. 2. Discovery puts the identification trigger probe for the CI classifier into the ECC queue. For example, a UNIX machine running HP-UX would require the HP-UX classifier, which specifies that the Multi Probe-HP-UX Identity identification trigger probe. These probes use identification rules to determine whether or not to insert or update a CI in the CMDB. Note: The trigger probe could also be the Horizontal Pattern probe, which tells Discovery to follow the operations in the specified pattern, rather than sending out additional probes. The operations in the pattern cover both the identification and exploration phases. Discovery knows which identification rules to use based on the CI type, and Discovery makes inserts or updates to the CMDB based on these rules. Probes and sensors are not used. 3. The MID Server checks the ECC queue, retrieves the discovery request, and runs the identification trigger probe. 4. The identification probe accumulates identification data for each device and sends that data back to the instance via the MID Server. 5. Discovery uses sensors for the identifier probe to process the information. 6. Discovery performs the analysis on the CMDB using [CI identifiers](https://www.servicenow.com/docs/RsiSfBRqsA0e3xCxN0HCUw "After Discovery classifies a configuration item (CI), it uses identifiers to determine if the device already exists in the Configuration Management Database (CMDB)."). Discovery can update existing CIs in the CMDB or create new ones. {#c_DiscoProcessFlows__ol_thp_zst_lx} ## The Exploration phase 1. Discovery looks at the Triggers Probes related list in the classifier to find exploration probes to run. 2. Discovery puts the exploration trigger probe into the ECC queue. 3. The MID Server checks the ECC queue, retrieves the discovery request, and runs the exploration trigger probes. 4. The probes send data back to the instance via the MID Server and sensors make updates to the CMDB, just as in the identification phase. {#c_DiscoProcessFlows__ol_y3p_445_bz} **Related concepts** * [Horizontal discovery process flow with patterns](https://www.servicenow.com/docs/JChX4mGFKEFvdrtwJW1r5g "Horizontal discovery with patterns has four phases, just as horizontal discovery with probes does. However, for the last two phases, Discovery triggers operations from a pattern, rather than additional sets of probes.") * [Patterns and horizontal discovery](https://www.servicenow.com/docs/piYqWjmjUPYN3Uwc_n3NMw#c-UsingPatternsForHorizontalDiscovery "A pattern is a series of operations that tell Discovery which CIs to find on your network and what credentials to use. Patterns also define what tables to populate in the CMDB.")