--- sourceDocument: Brazil IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Discovery probes and sensors # Discovery probes and sensors {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Discovery probes and sensors Discovery probes and sensors are critical components in ServiceNow Discovery that collect and process data to update the Configuration Management Database (CMDB). While newer releases increasingly use patterns instead of probes and sensors, probes remain essential for customers who have not yet transitioned or have customized probes. Probes gather data from devices, which sensors then process to update the CMDB. Show full answer Show less Discovery operates in four phases: scanning, classification, identification, and exploration. Probes and sensors are always used during scanning and classification. For identification and exploration, Discovery may use either probes and sensors or patterns. ## How Probes, Sensors, and the ECC Queue Work Probes and sensors operate through the ECC (External Communication Channel) queue managed by the MID Server. The MID Server monitors the ECC queue for tasks, runs probes to collect data, and returns results as input entries in the ECC queue. A business rule triggers the sensor processor to handle these inputs, identify relevant sensors, and process the data to update the CMDB. Discovery enforces code signing for probes, probe parameters, and sensors when enabled on the instance, ensuring only validated and untampered code executes. ## Interaction Between Probes and Sensors The MID Server launches probes to collect device data, which is either post-processed on the MID Server or sent directly to sensors in the ServiceNow instance for processing. Sensors finalize data processing and update the CMDB accordingly. Multiprobes are composite probes containing multiple individual probes, and multisensors correspondingly process the data from each probe within the multiprobe, aggregating results before updating the CMDB. ## Probe Types and Use Cases * **Windows machines:** Remote WMI queries and shell commands * **UNIX/Linux servers:** Shell commands via SSH (Bourne-compatible shells supported) * **Storage devices:** CIM/WBEM queries * **Printers and network gear (switches, routers):** SNMP queries * **Web servers:** HTTP header examination * **Uninterruptible Power Supplies (UPS):** SNMP queries ## Managing Discovery Probes and Sensors ServiceNow provides a wide range of pre-built probes and sensors that typically require little modification. However, customers may need to adjust probe parameters or realign customized probes and sensors after upgrading their instance to maintain compatibility. Multiprobes allow executing multiple queries with a single authentication to efficiently gather detailed device information. ## Custom Use Cases Customers can create custom discovery probes, such as one that reads a text file from a Windows computer and populates a configuration item (CI) in the CMDB with the extracted values, enabling advanced and tailored discovery scenarios. Discovery probes and sensors perform data collection and update the Configuration Management Database (CMDB). With each release, patterns are replacing many probes and sensors for Discovery. Consider creating new patterns or editing existing ones if you want to customize what Discovery can find. The information on probes and sensors is intended for customers who are not yet using patterns or who have customized probes retained upon upgrade. See [Patterns and horizontal discovery](https://www.servicenow.com/docs/piYqWjmjUPYN3Uwc_n3NMw#c-UsingPatternsForHorizontalDiscovery "A pattern is a series of operations that tell Discovery which CIs to find on your network and what credentials to use. Patterns also define what tables to populate in the CMDB.") for more information on patterns. Note: For information on Probe to Pattern migration see the knowledge article [KB0694477](https://support.servicenow.com/kb_view.do?sysparm_article=KB0694477). ## Discovery phases {#c_DiscoveryProbesAndSensors__section_ug3_fv2_dcb} Discovery always uses probes and sensors during the first two phases of discovery: scanning and classification. For the last two phases, identification and exploration, Discovery can use probes and sensors or patterns. This topic refers to probes and sensors only. See [Exploring Discovery](https://www.servicenow.com/docs/OCGecCN9aViAOIuYCcMvlQ "Discovery finds computers, servers, printers, a variety of IP-enabled devices, and the applications that run on them. It can then update the configuration items (CIs) in your Configuration Management Database (CMDB) with the data it collects.") for an explanation of these phases. See [Patterns and horizontal discovery](https://www.servicenow.com/docs/piYqWjmjUPYN3Uwc_n3NMw#c-UsingPatternsForHorizontalDiscovery "A pattern is a series of operations that tell Discovery which CIs to find on your network and what credentials to use. Patterns also define what tables to populate in the CMDB.") for more information on patterns. ## Probes, sensors, and the ECC queue {#c_DiscoveryProbesAndSensors__section_zh4_dv2_dcb} The probe collects the information and the sensor processes it. Both get their instructions from the ECC queue. There is a worker job on the MID Server that monitors the queue for work. The monitor checks for any entries where the Queue is output and the State is ready. The MID Server then processes all the output ECC messages, runs the necessary probes, and returns the probes results to the ECC queue. These results are put in the ECC queue as input entries.Figure 1. ECC queue input After an entry is inserted in the ECC Queue table, a business rule fires (on insert) that takes that information and runs it through a sensor processor. The sensor processor's job is to take the input data, find any sensors interested in that data, and pass it along to be processed. Those sensors ultimately update the CMDB. Important: Discovery now enforces code signing for probes, probe parameters, and sensors when code signing is enabled on the instance. Unsigned or tampered payloads are blocked, and signatures are validated before execution. For more information about code signing, see [Discovery on Code Signing instances](https://www.servicenow.com/docs/WSM6pR1ycCnIZUpsChzIEQ "Discovery is supported on instances with Code Signing enabled. Code signing validates the integrity of Discovery components before execution to help prevent unauthorized scripts from running on MID Servers and target machines."). ## How probes and sensors work together The MID Server launches probes to collect information about a device. The probe sends back information to the sensor to be processed. If the probe has a post-processing script defined, the post-processing script does some data processing on the MID Server before data is sent back to the sensor on the ServiceNow instance. Otherwise the probes sends back all the data collected and the sensor performs this data processing. In both cases, the sensor updates the CMDB. A multi-probe is a probe that contains probes. A multi-sensor processes the data from a multi-probe. To process the data from the multi-probe, the multi-sensor contains individual scripts to process the data returned by each probe contained in the Multiprobe, as well as a main multi-sensor script. The individual scripts pass their processed data to the main multi-sensor script. ## Probe types {#c_DiscoveryProbesAndSensors__table_ixz_r1l_z4__entry__2} | Device | Probe Type | |-|-| | Windows computers and servers | Remote WMI queries, shell commands | | UNIX and Linux servers | Shell command (via SSH protocol, version 2). Discovery supports any Bourne-compatible shell. | | Storage | CIM/WBEM queries | | Printers | SNMP queries | | Network gear (switches, routers, etc.) | SNMP queries | | Web servers | HTTP header examination | | Uninterruptible Power Supplies (UPS) | SNMP queries | [ ] {#c_DiscoveryProbesAndSensors__table_ixz_r1l_z4} * **[List of Discovery probes](https://www.servicenow.com/docs/Hy5KTglI9i5gqyL747JqDw)** A wide variety of probes exist for the Discovery application to detect elements on your network. * **[Discovery sensors](https://www.servicenow.com/docs/pmf14MypkrocmeVrDKLJtw#r_Sensors)** Every probe in Discovery must have a corresponding sensor to process the data returned. * **[Discovery probe management](https://www.servicenow.com/docs/7WX1Ke4_r1gJzlP1ZjSgsw)** Several discovery probes and their associated sensors are included with Discovery. You rarely need to modify probes or sensors. But you might need to set parameters to control the behavior of a particular probe or align versions of customized probes. * **[Align versions of customized probes and sensors](https://www.servicenow.com/docs/WB74BLnoiNO86oUSlYWUnQ)** If you customized a probe or sensor and upgraded to a new instance version, realign the customized probe and sensor to the most current version. * **[Discovery multiprobes and multisensors](https://www.servicenow.com/docs/_qdedjNPXyQ6ElPX4Wo1dg#r_MultiprobesIncludedWithDiscovery)** Multiprobes contain one or more simple probes configured to extract specific information from manageable devices by executing multiple queries with a single authentication. * **[Custom Discovery probe to populate a CI from a text file](https://www.servicenow.com/docs/Elf~aOFQqMctbp5ggT0V_A)** This custom Discovery probe reads a text file from a Windows computer and populates a configuration item (CI) in the CMDB with the values from the file.