--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Credential-less Application Discovery # Credential-less Application Discovery {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Credential-less Application Discovery attempts to identify an application service actively listening on a specific port at a given IP address. ## The application discovery pattern {#credential-less-app-discovery__section_ix2_1my_mbb} Service Mapping launches the Credentialless Discovery Application pattern when all credential-based port classification steps fail. The pattern executes an Nmap command on a Windows MID Server with Nmap installed, that is configured to perform application/version detection against a specific remote host IP address and port. If the port being scanned by Nmap is open, the pattern executes the CredentialLessApplicationClassNameMapper MID Server script include, which maps the service product, service name, and any extra information supplied by Nmap to a supported ServiceNow application table. If the script can map the returned product to an appropriate table derived from the base Application \[cmdb_ci_appl\] table, the script passes this information to the pattern. The pattern passes the match to the Discovery identifier for eventual CI creation or reconciliation. If the information returned by Nmap does not match any derived table, then the instance uses the base Application \[cmdb_ci_appl\] table to create the CI. Important: To allow the Credentialless Discovery Application pattern to launch, ensure that the mid.discovery.credentialless.enable system property is set to true. To disable, ensure this property is set to false. ## Example scan {#credential-less-app-discovery__section_l3r_4pt_fdb} This information was returned by an Nmap Application/Version Detection port scan on a Linux test system and illustrates the type of application data Nmap scans can return.{#credential-less-app-discovery__table_tgr_1jn_5bb__entry__2} | Information | Port | |-|-| | Port state | open | | Service name | ssh | | Service product | OpenSSH | | Extra service information | Protocol 2.0 | [ ] {#credential-less-app-discovery__table_tgr_1jn_5bb} ## Default application mappings {#credential-less-app-discovery__section_awh_jgz_mbb} The CredentialLessApplicationClassNameMapper MID Server script include is configured with a subset of the most common application tables available for Discovery and Service Mapping. A user with the agent_admin role can edit this script include to add CI tables that credential-less application Discovery can use for mapping to a derived application CI class. Shown in this table are examples of close matches returned by Nmap on a test system that [CMDB Identification and Reconciliation](https://www.servicenow.com/docs/access?context=c_CMDBIdentifyandReconcile&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US) was able to resolve into defined products. In many cases, the service name returned by Nmap was not needed to determine a match. Service names that appear in the table were required to determine a match. Products returned by Nmap that cannot be resolved into defined Discovery products use the following naming format: \:\:\. If any value in this string is null, it is dropped from the name. * serviceProduct: Service product information returned by Nmap. * serviceExtrainfo: Any additional information that Nmap returns about the application that might help identify it, such as protocol information. * serviceName: The installed name of the service or daemon of the product. {#credential-less-app-discovery__ul_uft_tyf_nbb} {#credential-less-app-discovery__table_sg4_dkv_sbb__entry__2}{#credential-less-app-discovery__table_sg4_dkv_sbb__entry__7} | Nmap response ||| Script response - Identifier input || | Service product | Service name | Service extra information | Discovered product | CI application table | |:-:|-|-|:-:|-| | Apache Tomcat/Coyote JSP engine 1.1 | N/A | NULL | Tomcat | cmdb_ci_app_server_tomcat | | Apache httpd 2.2.10 ((Linux/SUSE)) | N/A | NULL | Apache Web Server | cmdb_ci_apache_web_server | | IBM HTTP Server | N/A | Derived from Apache | Apache Web Server | cmdb_ci_apache_web_server | | IBM DB2 Database Server (QDB2/LINUX) | N/A | NULL | DB2 Instance | cmdb_ci_db_db2_instance | | Microsoft Exchange smtpd | smtp | NULL | Exchange Client Access Server | cmdb_ci_exchange_cas | | Microsoft Exchange 2010 log copier | msexchange-logcopier | NULL | Exchange Mailbox | cmdb_ci_exchange_mailbox_server | | JBoss service httpd | N/A | NULL | JBoss | cmdb_ci_app_server_jboss | | Microsoft IIS httpd 6.0 | N/A | NULL | Microsoft iis Web Server | cmdb_ci_microsoft_iis_web_server | | Microsoft SQL Server 2005 9.00.4035; SP3 | N/A | NULL | Microsoft SQL Server | cmdb_ci_db_mssql_instance | | MongoDB 2.5.1 | N/A | NULL | MongoDB Instance | cmdb_ci_db_mongodb_instance | | MySQL 5.5.51 | N/A | NULL | MySQL Instance | cmdb_ci_db_mysql_instance | | nginx 1.4.6 (Ubuntu) | N/A | NULL | Nginx Web Server | cmdb_ci_nginx_web_server | | PostgreSQL DB | N/A | NULL | PostgreSQL Instance | cmdb_ci_db_postgresql_instance | | Oracle WebLogic Server | N/A | NULL | Weblogic | cmdb_ci_app_server_weblogic | | IBM WebSphere MQ 6.0 | N/A | NULL | IBM WebSphere MQ | cmdb_ci_appl_ibm_wmq | | IBM WebSphere Application Server 6.1 | N/A | NULL | IBM Websphere | cmdb_ci_app_server_websphere | | OpenSSH : ssh | N/A | NULL | OpenSSH | cmdb_ci_appl | | Oracle Instance | N/A | NULL | Oracle Database | cmdb_ci_db_ora_instance | | Oracle Instance | N/A | NULL | Oracle TNS Listener | cmdb_ci_db_ora_instance | | product-A | service-B | NULL | product-A:service-B | cmdb_ci_appl | | product-A | service-B | extrainfo-C | product-A:extrainfo-C:service-B | cmdb_ci_appl | [Table 1. Examples of close matches that were resolved] {#credential-less-app-discovery__table_sg4_dkv_sbb} ## Examples of applications not uniquely matched {#credential-less-app-discovery__section_h32_lyn_5bb} In this example, the information returned by Nmap does not match any derived table, and the instance must use the base Application \[cmdb_ci_appl\] table to create the CI.{#credential-less-app-discovery__table_zpv_rzn_5bb__entry__3}{#credential-less-app-discovery__table_zpv_rzn_5bb__entry__8} | Scanned application | Nmap response ||| Script response - identifier input || | Scanned application | Service product | Service name | Service extra information | Discovered product | CI application table | |:-:|:-:|-|-|:-:|-| | ExchangeHub | Microsoft Windows RPC | msrpc | null | Microsoft Windows RPC:msrpc | cmdb_ci_appl | | HAProxy Load Balancer | IBM HTTP Server (Derived from Apache) | http | null | IBM HTTP Server (Derived from Apache):http | cmdb_ci_appl | | SharePoint | Oracle Database | http | null | Oracle Database:http | cmdb_ci_appl | | SharePoint | Oracle Instance | N/A | null | Oracle Database | cmdb_ci_appl | [ ] {#credential-less-app-discovery__table_zpv_rzn_5bb} ## Application identification {#credential-less-app-discovery__section_a1g_2gg_nbb} The Discovery - IP Based \[com.snc.discovery.ip_based\] plugin adds an identifier to the Application Rule for the Application \[cmdb_ci_appl\] table that matches on sys_class_name and cl_port for Nmap scans.Figure 1. Nmap identifier for the Application Rule