--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # File-based Discovery # File-based Discovery {#ariaid-title1} Release version: Australia Updated March 25, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of File-based Discovery File-based Discovery in ServiceNow identifies software running on Windows, UNIX, and macOS servers and devices, even when registration data is absent. It helps manage software licenses, detect unlicensed or forbidden files, and assess potential threats from unwanted files. This capability enhances installed software discovery by scanning for known file signatures and applying normalization rules to improve accuracy and completeness of software identification. Show full answer Show less ## Key Features * **Required Plugins:** Activation of the File-based Discovery plugin is necessary and triggers the Software Asset Management - File Signature Normalization plugin automatically. * **Discovery Process:** Triggered during the exploration phase of normal Discovery, probes scan configured paths for specific file extensions or names. * **File Signature Matching:** Uses file name, size, and version to match discovered files against known software signatures, storing results in the *File Information \[cmdbfileinformation\]* table linked to the server CI. * **Integration with Software Asset Management (SAM):** When SAM is active, matched files populate product and publisher information and update software installation and license data in *cmdbsamswinstall*. Without SAM, only file information is stored. * **Platform-Specific Handling:** UNIX uses a smaller signature list processed on the target; Windows uses a larger list processed by the MID Server for efficient filtering. * **SWID Tag Support:** SWID tag collection can be enabled to populate the *cmdbswidtag* table, linking software installations to detailed tag data. Base64 package is required for scanning SWID tags on UNIX/Linux servers. * **Unidentified Files Management:** Files that cannot be matched are stored in *Unidentified File Set \[cmdbunidentifiedfileset\]*, allowing manual updates to improve future discovery accuracy. * **Configurable and Disablable:** File-based Discovery can be enabled or disabled via the Discovery Configuration Console, with disabled scans ignoring file data if results are not yet returned. * **Supported Platforms and Versions:** Supports Windows (2008 and later, excluding PowerShell 7 for ADME), UNIX (POSIX-compliant Linux/Solaris), AIX (5.3, 6.1, 7.1), HP/UX 8.11, and macOS. ## Practical Considerations * Ensure File-based Discovery plugin activation is requested and completed before use. * For Ubuntu 20 systems, modify the default shell from sh to bash to avoid scan errors. * File version information is only available for certain file types (e.g., .exe, .jar) and is used to enhance software identification. * If running into errors like "Invoke-WmiMethod" not recognized, verify PowerShell compatibility and configuration. ## Benefits for ServiceNow Customers This feature empowers customers to gain detailed visibility into software assets beyond registered inventory, enabling better license compliance, security posture evaluation, and software asset management accuracy. By leveraging file signatures and integration with SAM, organizations can automate software identification, reduce manual efforts, and maintain an accurate software configuration management database (CMDB). File-based Discovery helps you identify what software is running on your Windows and UNIX servers and devices, even if there's no registration information available. You can then manage and maintain records of your software licenses, check for unlicensed files, detect forbidden or damaged files, and help evaluate any threats from unwanted files. ## Required plugins {#file-based-discovery__section_cys_3jr_13b} The File-based Discovery \[com.snc.discovery.file_based_discovery\] plugin is required for file signature filtering. Your Discovery subscription includes this plugin, but you must [request activation](https://www.servicenow.com/docs/access?context=t_RequestAPlugin&version=australia&pubname=australia-platform-administration&ft:locale=en-US). Once the File-based Discovery plugin is active, the Software Asset Management - File Signature Normalization \[com.snc.file_signature_normalization\] plugin is also activated. For more information on the File Signature Normalization plugin, see [File Signature Normalization](https://www.servicenow.com/docs/access?context=sam-file-based-discovery&version=australia&pubname=australia-it-asset-management&ft:locale=en-US). ## How File-based Discovery works {#file-based-discovery__section_ifz_rbp_x2b} File-based Discovery enhances the pre-existing discovery of installed software. It scans target servers for a known list of file signatures and processes those files with an established set of rules. The resulting data enhances the identification of installed software and identifies unregistered software products. For information about using Agent Client Collector for Visibility Content to perform file-based discovery, see [Discover java installation data using Agent Client Collector for Visibility Content file-based discovery](https://www.servicenow.com/docs/N__G0zAcjmBoxv~N~YQZZw "Discovering java installation data using Agent Client Collector for Visibility Content file-based discovery enables you to discover file information in your system."). File-based Discovery is triggered in the exploration phase of normal Discovery. File-based Discovery probes execute a scan searching for specific file extensions or file names in paths that you configure. The resulting file information is returned in the probe payload. The sensor attempts to match the discovered files with installed software, using the file name, size, and version returned by the probe. File-based Discovery uses file signatures to detect software that might not have been registered. This information is then stored in the File Information \[cmdb_file_information\] table with a reference to the CI of the server. You can view the files found from each CI in a related list on this table. For more information, see [Related list of CI components](https://www.servicenow.com/docs/access?context=r_RelatedListsOfCIComponents&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). When [Software Asset Management](https://www.servicenow.com/docs/access?context=c_SoftwareAssetMgmt&version=australia&pubname=australia-it-asset-management&ft:locale=en-US) (SAM) is active, if any file matches a software product, Discovery populates the Product and Publisher information for that file. Use this information to understand what software is running on your server and to help evaluate any threats from unwanted files. Discovery uses lists of known file signatures for Windows and UNIX to constrain the scope of the search. The filtering process for Windows and UNIX hosts is executed differently because their signature lists differ greatly in size. The smaller UNIX signature list is included with the Unix - File Discovery probe and processed directly on the target. The Windows signature list is larger and can't be processed on the target. The Windows - File Discovery probe scans the target for specific file extensions and paths and returns these results to the MID Server. The MID Server performs file signature filtering using the entire Windows list. The MID Server then sends all file information back to the instance for normalization and matching. If SAMP is active on the instance, File-based Discovery creates or updates identified software products in the Software Installation \[cmdb_sam_sw_install\] table and updates matched software package licenses. Without SAMP, no software records are created. Only the file information goes into the File Information \[cmdb_file_information\] table. You can enable SWID tags in the Discovery Configuration Console. With SWID tag enabled, when running File-based Discovery, the SWID tag information then populates the \[cmdb_swid_tag\] table. Information about the software installed on a particular machine includes name, file information, publisher, version, installed on, and content. The software_installation column in the \[cmdb_swid_tag\] is a reference to the \[cmdb_sam_sw_install\] table. Note: Base64 package is a prerequisite for any UNIX or Linux servers to scan SWID tag files using File-based Discovery. File-based Discovery inserts any file not matched by the normalization process into the Unidentified File Set \[cmdb_unidentified_file_set\] table. You can update the records in this table and provide additional details for previously unidentified files. If you provide values for the Product and Publisher fields for a file, SAMP settings can enable File-based Discovery to use that file for installed software matching in future discoveries. You can disable File-based Discovery at any time by changing the setting in the [Discovery Configuration Console](https://www.servicenow.com/docs/Dd4Yjm8isniEARaNj8bgVw#c_DiscoveryConfigurationConsole "Use the Discovery Configuration Console to manage what kind of configuration items (CIs) and CI information you want to discover."). If you disable File-based Discovery before scan results are returned, the file data is ignored. Note: File-based Discovery supports Windows, UNIX, and macOS devices. The UNIX probe is POSIX-compliant and should run on any Linux/Solaris server. Discovery supports Windows versions 2008, 2008R2, 2012R2, 2016, 2019, and above with PowerShell 3.0--7. Discovery also supports AIX versions 5.3, 6.1, and 7.1 and HP/UX 8.11. File-based Discovery and Windows ADME are not supported on Windows with PowerShell 7. File-based Discovery fails with the following error message: `Error(s) during file-based discovery: Unable to start background scan. System.Management.Automation.CommandNotFoundException: The term 'Invoke-WmiMethod' is not recognized as a name of a cmdlet, function, script file, or executable program.` If you're running File-based Discovery on Ubuntu version 20, modify the default Bourne shell (sh) to point to Bourne Again shell (bash). Version information is populated only for the files with version information returned from probes. Not all files have versions. Files with extensions such as .exe, .jar, and so on, have versions. **Related tasks** * [Run File-based Discovery](https://www.servicenow.com/docs/PUMRzUkdPjIVC9xJnsPX1Q#run-file-based-discovery "Run File-based Discovery to find all of your installed software whether it is registered or not. You can enable and configure File-based Discovery at any time using the Discovery Configuration Console.") **Related reference** * [File-based Discovery references](https://www.servicenow.com/docs/mhh8lvi5vJsgY735Dpsazg "Review this reference material for further details on File-based Discovery.") * [File-based Discovery issue resolution](https://www.servicenow.com/docs/jMday1zZtOq5Kn4n4gGPdQ "If you have any issues while setting up or running File-based Discovery, follow the actions listed here to help resolve them.")