--- sourceDocument: Brazil IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Discovery behaviors # Discovery behaviors {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Discovery behaviors Discovery behaviors in ServiceNow control which probes Shazzam launches during Discovery and designate the MID Servers that perform these probes. Unlike a single MID Server scanning a defined IP range, behaviors enable distributing tasks across multiple MID Servers on the same or different network segments. They are essential in Discovery schedules where configuration items (CIs) are updated in the CMDB. Show full answer Show less This capability allows efficient, flexible Discovery in complex environments with multiple MID Servers, diverse protocols, and segmented networks. ## Key Features * **Load balancing:** Distribute Discovery tasks evenly across multiple MID Servers deployed in one or more domains to optimize performance and resource use. * **Multi-protocol and multi-domain scanning:** Assign specific MID Servers to scan different protocols or domains, such as one MID Server scanning all protocols in one domain and another performing WMI scans in a second domain. * **Access Control List (ACL) support:** Configure MID Servers to scan SNMP devices protected by ACLs by ensuring the MID Server host has access rights. * **Protocol control for devices running multiple protocols:** Manage Discovery on devices running protocols like SSH and SNMP simultaneously by specifying which protocol to explore and which to exclude, avoiding duplicate scans. Behaviors facilitate efficient Discovery of SSH, SNMP, and WMI devices across multiple Windows domains using multiple MID Servers, minimizing duplicated effort in complex network environments. Note: For multiple Windows domains, the preferred approach is using PowerShell with a single MID Server authenticating across domains via stored credentials. ## Available Functionality Definitions When creating a behavior, you select a functionality definition that determines which protocols are scanned. Key functionality options include: * **Windows only (WMI):** Scans Windows devices using the WMI protocol; requires a Windows MID Server with domain-specific criteria. * **Windows, DNS, and WINS:** Scans Windows devices with WMI, resolving domains using DNS and WINS; requires a Windows MID Server. * **SNMP only:** Scans only SNMP devices; ideal for scanning devices protected by ACLs restricting SNMP access; does not require functionality criteria. * **All except SNMP:** Scans all protocols except SNMP, including WMI and SSH; used alongside SNMP-only functionality to separate MID Server responsibilities. * **All except Windows (no WMI):** Scans all protocols except WMI, including SSH and SNMP; useful when scanning multiple domains or when non-Windows devices require a different MID Server. ## Practical Use and Configuration Creating a Discovery behavior involves selecting appropriate functionalities to define which probes Shazzam launches and assigning MID Servers accordingly. This setup enables precise control over scanning responsibilities, optimizing Discovery efficiency. Load balancing behaviors can be configured to automatically distribute scanning tasks evenly among multiple MID Servers handling the same protocols, improving performance and scalability. Examples include: * Scanning SNMP devices protected by ACLs by assigning MID Servers with proper access. * Separating scans of Windows devices and SNMP devices across different MID Servers to avoid overlap. These configurations help ServiceNow customers ensure comprehensive, efficient Discovery processes, reduce redundant scans, and maintain accurate CMDB updates across diverse network environments. Discovery behaviors determine the probes that Shazzam launches, and from which MID Servers these probes are launched. Unlike a scan performed by a single MID Server on a designated IP address range, a behavior can assign different tasks to multiple MID Servers on the same IP address segment or on different network segments. Behaviors are available in [Discovery schedules](https://www.servicenow.com/docs/A3BVdNwrtvD7FvMzmPuJVA#t_CreateADiscoverySchedule "A discovery schedule determines what horizontal discovery searches for, when it runs, and which MID Servers are used. Create a discovery schedule for your local environment or a schedule for discovering the resources in your cloud service account.") for discoveries in which configuration items (CI) are updated in the CMDB. Behaviors can be used in the following scenarios: * Load balancing: A behavior enables load balancing in systems that use multiple MID Servers deployed across one or more domains. * Multiple protocols in multiple domains: Configure one MID Server to scan for all protocols on one domain and another MID Server to perform a WMI scan on a second domain. * Access Control Lists (ACL): Discovery can scan SNMP devices protected by an ACL if the MID Server host machine is granted access by that ACL. Use a behavior to configure a MID Server to scan devices protected by an ACL. * Devices running two protocols: Some devices might have two protocols running at the same time. Examples of this are the SSH and SNMP protocols running concurrently on one device (most common). A behavior can control which of the two protocols is explored for certain devices. The behavior then prevents the other protocol from being explored. {#c_DiscoveryBehaviors__ul_vyl_1q2_vp} Behaviors also enable the efficient Discovery of SSH and SNMP devices and WMI devices running on multiple Windows domains, using multiple MID Servers. For example, an organization has two Windows domains in its network and a variety of UNIX computers and SNMP devices. The challenge is to discover all the devices efficiently, without duplicating effort. Each domain contains a Windows MID Server which is used to scan the IP addresses from the two domains specified in the Discovery Schedule, as well as the SSH and SNMP devices. We need a Behavior that divides the work appropriately to avoid scanning anything twice. In this example, we assume that both domains are in the same geographical location, and that a single schedule is sufficient. Note: The preferred method for running Discovery over multiple Windows domains is to use [PowerShell](https://www.servicenow.com/docs/bGB9C1UqE_RIQDFvPvVJow "MID Servers use PowerShell and PowerShell Remoting for accessing configuration items (CIs) during horizontal and top-down discovery. Review MID Server parameters and script includes, probe parameters, and credentials for using PowerShell."), which allows a single MID Server to authenticate on machines on different domains using credentials stored on the instance. ## Available functionality definitions {#c_DiscoveryBehaviors__section_ur1_rdr_43c} When creating a behavior, you select a functionality definition that determines which protocols Shazzam scans. The following table lists the available options.{#c_DiscoveryBehaviors__table_uxz_tdr_43c__entry__2} | Functionality | Description | |-|-| | Windows only (WMI) | Scans for Windows devices using WMI protocol. Requires a Windows MID Server and functionality criteria to specify the domain. | | Windows, DNS, and WINS | Scans for Windows devices using WMI protocol and resolves the domain using DNS and WINS. Requires a Windows MID Server and functionality criteria. | | SNMP only | Scans for SNMP devices only. Use this when scanning devices protected by an ACL that restricts SNMP access to specific MID Server hosts. Does not require functionality criteria. | | All except SNMP | Scans for all protocols except SNMP, including WMI and SSH. Use this in combination with SNMP only functionality when you need separate MID Servers for SNMP and other protocols. | | All except Windows (no WMI) | Scans for all protocols except WMI, including SSH and SNMP. Use this in combination with Windows only functionality when scanning multiple domains or when non-Windows devices require a different MID Server. | [Table 1. Discovery functionalities] {#c_DiscoveryBehaviors__table_uxz_tdr_43c} * **[Create a Discovery behavior](https://www.servicenow.com/docs/mt5hlq4j0gNDocZUJLzpMg)** Create a Discovery behavior to determine which probes Shazzam launches and which MID Server is used. * **[Set up a load balancing behavior](https://www.servicenow.com/docs/CJYZU119YL16a7bzX5LerQ)** When multiple MID Servers are configured to scan the same protocol, you can set up load balancing behavior to automatically balance the work between MID Servers. * **[Examples of Discovery behavior functionalities](https://www.servicenow.com/docs/L2eX7IW2vUzv_xynY6L_kg)** This example of a Discovery behavior requires three functionalities for the behavior. * **[Access an ACL-protected SNMP device](https://www.servicenow.com/docs/Xqx82huIFzC6omWO9bImBA)** Access an SNMP device protected by an ACL using a Discovery behavior.