IT Discovery for Operational Technology (OT) Networks

  • Release version: Zurich
  • Updated March 12, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of IT Discovery for Operational Technology (OT) Networks

    The IT Discovery for Operational Technology (OT) Networks feature in ServiceNow enables discovery of IT class OT devices within Industrial Control System (ICS) networks, specifically targeting designated Purdue levels. These devices include switches, routers, and computers located both in data centers and factory environments. This functionality helps organizations effectively manage and update their Configuration Management Database (CMDB) with accurate and current information about OT-related IT assets.

    Show full answer Show less

    Discovery Scope and Purdue Levels

    Standard Discovery in ServiceNow typically processes devices at Purdue Levels 4 and 5, covering site business logistics and enterprise networks.

    • Level 4: IT functions at the site business and logistics level.
    • Level 5: Enterprise networks supporting ERP functions.

    IT Discovery for OT Networks specifically targets Purdue Levels 3 and 3.5, which are critical for OT environments:

    • Level 3.5 (DMZ/IDMZ): A demilitarized zone designed to securely connect networks with different security requirements, often hosting both IT and OT class computers and servers.
    • Level 3: Site operations where plant-wide control and monitoring functions reside.

    Important: Discovery should not be run on Purdue Levels 0 through 2 to avoid disrupting critical industrial operations.

    How IT Discovery for OT Networks Works

    When running an OT discovery schedule, the process:

    • Scans assigned IP addresses to discover all hardware items.
    • Triggers a discovery.device.complete event upon discovering each configuration item (CI).
    • Checks for existing OT entity records in the CMDB and updates or creates them as necessary, ensuring the OT entities reflect current attributes.
    • Pushes location and other defined attributes from the discovery schedule to both the CI and related OT entities.
    • Creates OT entity records for applications installed on discovered OT devices.

    Discovered OT applications can be viewed via the Industrial Workspace under the Applications list in the Operational Technology section.

    Practical Benefits for ServiceNow Customers

    • Enables comprehensive discovery and management of critical OT network IT devices within ICS environments.
    • Supports secure and targeted discovery at appropriate Purdue levels to minimize risks to industrial operations.
    • Keeps the CMDB up to date with both hardware and application-level OT asset information, enhancing operational visibility.
    • Facilitates integration and coordination between IT and OT asset management within ServiceNow.

    You can use the IT Discovery for Operational Technology (OT) Networks function to discover IT class OT devices. These devices are located in designated Purdue levels within your Industrial Control System (ICS) networks. IT class items include switches, routers, and computers that exist both in data centers and in your factories.

    Where standard Discovery processing takes place

    The IT Discovery for OT Networks process operates in a manner that is similar to the standard Discovery processes.

    Figure 1. Targeted Purdue levels in standard and IT Discovery for OT Networks Discovery

    Standard Discovery processing in the ServiceNow AI Platform® normally takes place in the following Purdue levels in your enterprise:

    Table 1. Processed Purdue levels
    Purdue Level Description
    4 Site business and logistics, such as all Information Technology (IT) functions.
    5 Enterprise Network, where Enterprise Resource Planning (ERP) functions take place.
    Note:
    To learn more about Purdue levels in Industrial Control Systems, see https://subscription.packtpub.com/book/networking_and_servers/9781788395151/1/ch01lvl1sec10/the-purdue-model-for-industrial-control-systems.

    Where and how IT Discovery for OT Networks processing takes place

    In contrast, IT Discovery for OT Networks processing can take place in the following Purdue levels, depending on which you select when you create an OT discovery schedule:
    Table 2. Processed Purdue levels
    Purdue Level Description
    3.5 Demilitarized Zone (DMZ) or Industrial Demilitarized Zone (IDMZ). Similar to a traditional (IT) DMZ, the OT-oriented IDMZ enables you to securely connect networks with different security requirements.
    3 Site operations where plant or site-wide control and monitoring functions reside.
    You typically run IT Discovery for OT Networks in the DMZ (or IDMZ, Purdue Level 3.5) of your ICS networks. This Purdue level is where there are usually IT and OT class computers and servers to discover and manage.
    Note:
    To avoid the possibility of disrupting your industrial operations, you should not run Discovery processes against Purdue levels 0 through 2 in your ICS networks.
    Figure 2. IT Discovery for OT Networks processing

    When you run an OT discovery schedule, it performs the following processing:

    1. Proceeds through the assigned IP addresses and discovers all hardware items that exist in it.
    2. When it completes discovery of a configuration item (CI), it internally triggers a (discovery.device.complete) event. This logic checks if an OT entity (cmdb_ot_entity) record exists for it in the Configuration Management Database (CMDB).
      • If one exists, and any related attributes have changed for the discovered item, it updates the OT Entities that are related to that CI.
      • If one does not exist, it creates one for it.
    3. And the location attribute, it also pushes the defined attributes from the OT discovery schedule to the CI and to the related OT entity records.
    4. It also creates OT entity records for the applications installed on discovered OT devices. To view the applications that have OT entity records created through IT Discovery for OT Networks, navigate to the Industrial Workspace list view and open the Applications list under Operational Technology (OT).