--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Pattern-based discovery in Service Mapping # Pattern-based discovery in Service Mapping {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Pattern-based discovery in Service Mapping Pattern-based discovery is the primary method used by Service Mapping to collect detailed data about devices and applications within application services. This data enables Service Mapping to create accurate application service maps and maintain up-to-date configuration items (CIs) in the Configuration Management Database (CMDB). Patterns consist of sequences of commands that identify CI attributes and their outbound connections, facilitating comprehensive mapping of service components. Show full answer Show less ## How Pattern-based Discovery Works * **Entry Point Definition:** The discovery process starts at an entry point, which is the access point for clients to a service instance (e.g., an IP address or hostname of an email server). * **Horizontal Discovery:** Service Mapping performs horizontal discovery to identify the host device of the service if it does not already exist in the CMDB. * **Top-down Discovery:** After host identification, Service Mapping conducts top-down discovery to find and map applications running on that host. * **MID Server Role:** MID Servers within the customer's network execute discovery probes and facilitate communication without firewall traversal. * **Discovery Steps:** Discovery sends probes (port discovery, classification, identification, exploration) via the External Communication Channel (ECC) queue, which MID Servers execute to gather host and application data. * **Pattern Execution:** MID Servers run identification sections of patterns to discover CIs and then connectivity sections to find outbound connections, continuously updating the CMDB and service maps. * **Connection Enrichment:** Service Mapping supplements discovered connection data with unique information from the cmdbtcp and saflowconnection tables when available. * **Discovery Boundaries:** Discovery stops mapping at CIs marked as boundaries or those without outbound connections to control the scope of the service map. ## Important Considerations * Pattern operations currently only support English; non-English data cannot be parsed properly, which may cause discovery failures. * Service Mapping periodically runs service recomputation to update CMDB data, including network and storage paths and to apply impact rules. ## What This Enables ServiceNow Customers to Do By leveraging pattern-based discovery, ServiceNow customers can automate the identification and mapping of application services and their underlying infrastructure. This provides a detailed, accurate, and dynamically updated view of service components and their relationships in the CMDB, critical for effective service management, impact analysis, and operational decision-making. Pattern-based discovery is the main method of Service Mapping collecting data about devices and applications used in application services. After Service Mapping collects data, it then creates a map of application services and stores the collected data in the CMDB. ServiceNow applications refer to devices and applications that comprise a service instance as configuration items (CIs). Service Mapping uses patterns to discover and map CIs. A pattern is a sequence of commands designed to detect attributes of a CI and its outbound connections. A typical Service Mapping pattern consists of two types of algorithms for identifying CIs and finding CI connections. The starting point of any discovery process is an entry point. An entry point is a point where clients access a service instance. For example, to map your electronic mailing service instance, define an IP address or host name of the email server as an entry point. The discovery and mapping process begins from Discovery performing the horizontal discovery to identify the host. Once the host discovery is complete, Service Mapping starts the top-down discovery to find and map applications running on this host. Service Mapping uses MID Servers to communicate with CIs in your organization. MID Servers are located inside your organization network and Service Mapping can communicate with them without traversing firewalls. Note: Currently, pattern operations do not support multi-languages. If values returned from pattern operations are not in English, the returned data cannot be parsed properly and the pattern discovery will fail. The discovery and mapping process consists of the following interactions: 1. An administrator defines an service instance with an entry point for an application CI. Service Mapping creates a record for the new service instance in the Mapped Application Service \[cmdb_ci_service_discovered\] table. 2. The device hosting the application is identified. 1. Service Mapping checks if the device hosting this application CI exists in the CMDB. 2. If the device hosting this application CI does not exist, Service Mapping triggers Discovery to detect host. 3. Discovery creates the first set of probes for port discovery, referred to as Shazzam probes, and places them as a discovery request in the External Communication Channel (ECC) queue. 4. The MID Server checks the ECC queue and retrieves the discovery request assigned to it. 5. The MID Server runs the probes against the host and discovers open ports. 6. The MID Server passes information on the host ports to the ECC queue. 7. Discovery checks the ECC queue and receives information on the host ports. 8. These steps are repeated for other types of probes: classification, identification, and exploration. 9. Discovery adds the host to the CMDB. 10. During the host discovery using probes, Service Mapping checks the ECC queue if this process is complete. When the host discovery is complete, Service Mapping checks whether this host exists in the CMDB. {#pattern-based-discovery__ol_nmh_grh_dx} Note: For the detailed description of the horizontal discovery flow, refer to [Horizontal discovery process flow with probes and sensors](https://www.servicenow.com/docs/Af~VFnWMDR7QiImX9LEh7Q "The horizontal discovery process passes through the four phases of discovery using probes, which gather information on the target machine, and then sensors, which help Discovery determine what to do with that information."). 3. Once the host is found in the CMDB, Service Mapping discovers the application running on this host. 1. Service Mapping creates an application discovery request for the IP address of the entry point. It then writes the request in the ECC queue and assigns a MID Server to the request. 2. The MID Server checks the ECC queue and retrieves the discovery request assigned to it. 3. The MID Server starts running identification sections of the patterns associated with the classifier to find the match for the entry point. When the identification section matches the entry point, the pattern discovers a CI. 4. The MID Server starts running connectivity sections of the pattern to find outgoing connections of the newly discovered CI. 5. The MID Server passes information on the discovered CI, its attributes, and connections to the ECC queue. 6. Service Mapping checks the ECC queue and receives information on the newly discovered CI. Whenever Service Mapping checks the ECC queue and receives information on a discovered CI, it checks these tables for any data on outbound connections related to the CI: the cmdb_tcp and sa_flow_connection tables. If these two tables contain unique data that patterns did not discover, Service Mapping enriches the information about the CI connections and adds them to the map. 7. Service Mapping writes the information into the CMDB and adds this CI to the service instance map. 8. Service Mapping creates the discovery requests for all applications to which the newly discovered CI connects. Mapping is complete after Service Mapping maps a CI that either does not have any outbound connections or is marked as a boundary. A boundary makes Service Mapping stop discovery from this point and not follow outgoing connections. {#pattern-based-discovery__ul_rfq_rth_dx} 4. The system regularly runs the service recomputation to query the CMDB for the latest CI changes, add data for network and storage paths, and apply CI impact rules. {#pattern-based-discovery__ul_crj_tgf_lt} **Related concepts** * [Horizontal discovery process flow with probes and sensors](https://www.servicenow.com/docs/Af~VFnWMDR7QiImX9LEh7Q "The horizontal discovery process passes through the four phases of discovery using probes, which gather information on the target machine, and then sensors, which help Discovery determine what to do with that information.") * [Traffic-based discovery in Service Mapping](https://www.servicenow.com/docs/Nc~BmgMGFb2e4_PVEPNMaw "Service Mapping can discover and map configuration items (CIs) following their traffic-based connections. This method is referred to as traffic-based mapping and complements pattern-based mapping.") **Related reference** * [The ECC queue for Discovery](https://www.servicenow.com/docs/BVFgMoSEO4IOOWIXFgUsrA "The External Communication Channel (ECC) Queue is a connection point between your ServiceNow instance and other systems that integrate with it, most commonly a MID Server.") **Related topics** * [Service instances (Application services)](https://www.servicenow.com/docs/access?context=application-services&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US)