---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Discovery behaviors
# Discovery behaviors {#ariaid-title1}
Release version: Australia
Updated October 20, 2026
 3 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Discovery behaviors
Discovery behaviors in ServiceNow control which probes Shazzam launches and assign these probes to specific MID Servers for scanning designated IP address ranges.
They enable efficient and customized discovery processes by distributing tasks across multiple MID Servers, particularly useful in environments with multiple network domains, protocols, and access restrictions.
Show full answer Show less
Behaviors are used within Discovery schedules to update configuration items (CIs) in the Configuration Management Database (CMDB), helping customers optimize discovery operations by managing load balancing, protocol allocation, and access controls.
## Key Features
* **Load balancing:** Distributes discovery tasks across several MID Servers to optimize resource use and speed.
* **Multiple protocols and domains:** Assigns different MID Servers to scan various protocols or domains, such as configuring one MID Server for all protocols on one domain and another for WMI scans on a different domain.
* **Access control list (ACL) support:** Enables scanning of SNMP devices protected by ACLs by assigning MID Servers that have appropriate access.
* **Protocol control on devices with multiple protocols:** Allows behaviors to specify which protocol (e.g., SSH or SNMP) should be used for discovery, preventing redundant scans.
* **Discovery functionalities:** Each behavior includes one or more functionalities that define the protocols to scan, the MID Servers involved, execution phases, and criteria to determine which MID Server processes results, especially important for multi-domain Windows environments.
## Key Outcomes
* Improved efficiency and accuracy in discovery by avoiding duplicate scans and balancing workload across MID Servers.
* Ability to handle complex network environments involving multiple Windows domains, UNIX systems, and SNMP devices.
* Support for scanning devices under restrictive ACLs by assigning appropriate MID Servers.
* Flexible configuration of discovery tasks to meet organizational needs, such as separating SNMP scans from other protocols or managing multi-domain authentication with PowerShell.
## Practical Application for ServiceNow Customers
Customers can create Discovery behaviors to tailor discovery tasks precisely, ensuring that the right MID Servers perform the right probes on the correct network segments. This setup supports reliable CMDB updates by efficiently managing discovery across diverse environments.
For example, in a network with multiple Windows domains and mixed device types, behaviors can allocate Windows MID Servers to scan their respective domains and assign other MID Servers to handle SSH and SNMP devices, reducing redundancy and improving discovery speed.
Load balancing behaviors further ensure that no single MID Server is overwhelmed, enhancing system performance and stability during discovery runs.
Discovery behaviors determine the probes that Shazzam launches and from which MID Servers these probes are launched.
A scan performed by a single MID Server targets a designated IP address range. A behavior can assign different tasks to multiple MID Servers on the same IP address segment or on different network segments. Behaviors are available in [Discovery schedules](https://www.servicenow.com/docs/VO0owNull6HAfXGFWMKxhg#t_CreateADiscoverySchedule "A discovery schedule determines what horizontal discovery searches for, when it runs, and which MID Servers are used. Create a discovery schedule for your local environment or a schedule for discovering the resources in your cloud service account.") for discoveries that update configuration items (CIs) in the Configuration Management Database (CMDB).
You can use behaviors in the following scenarios:
* Load balancing: A behavior enables load balancing in systems that use multiple MID Servers deployed across one or more domains.
* Multiple protocols in multiple domains: A behavior can configure one MID Server to scan for all protocols on one domain and another MID Server to perform a WMI scan on a second domain.
* Access control lists (ACLs): Discovery can scan SNMP devices protected by an ACL if the MID Server host machine is granted access by that ACL. A behavior can configure a MID Server to scan devices protected by an ACL.
* Devices running two protocols: Some devices run two protocols at the same time, most commonly SSH and SNMP. A behavior can control which of the two protocols is explored for certain devices. The behavior then excludes the other protocol from exploration.
{#c_DiscoveryBehaviors__ul_vyl_1q2_vp} Behaviors enable Discovery of SSH and SNMP devices and WMI devices running on multiple Windows domains by using multiple MID Servers.
For example, an organization has two Windows domains in its network and a variety of UNIX computers and SNMP devices. The challenge is to discover all the devices efficiently, without duplicating effort. Each domain contains a Windows MID Server, which is used to scan the IP addresses from the two domains specified in the Discovery schedule, and the SSH and SNMP devices. Use a behavior to divide the work so that no device is scanned twice. In this example, both domains are in the same geographical location, and a single schedule is sufficient.
Note:
To run Discovery over multiple Windows domains, use [PowerShell](https://www.servicenow.com/docs/q4ezdLN~r5GFJQxzN~nh0w "MID Servers use PowerShell and PowerShell Remoting for accessing configuration items (CIs) during horizontal and top-down discovery. Review MID Server parameters and script includes, probe parameters, and credentials for using PowerShell."), which enables a single MID Server to authenticate on machines on different domains using credentials stored on the instance.
## Discovery functionalities {#c_DiscoveryBehaviors__section_ur1_rdr_43c}
Each behavior contains one or more Discovery functionality records. A Discovery functionality defines what each MID Server in this behavior must do, specifically which protocols to detect. {#c_DiscoveryBehaviors__ph_discovery-functionality}
A functionality record links the following items:
* Functionality definition: The protocol or list of protocols that the MID Servers in the functionality scan. Several definitions are available by default, and you can also create custom definitions.
* MID Servers: The MID Servers that perform the functionality. When you select multiple MID Servers, Discovery balances the load across them.
* Phase: An integer that groups functionalities. Functionalities in the same phase run together in one Shazzam probe, and phases run in numerical order.
* Functionality criteria: Conditions that determine which MID Server processes the Shazzam results, based on the MID Server name (mid_server), the target domain (win_domain), or the MID Server domain (mid_win_domain). Criteria are required only for Windows MID Servers, and only when the behavior controls Discovery across multiple domains.
{#c_DiscoveryBehaviors__ul_kfw_2dr_43d}
The following table lists some common functionality definitions. For the full list, view the records in the Functionality Definition \[discovery_function_def\] table by navigating to AllDiscoveryDiscovery DefinitionFunctionality Definitions.{#c_DiscoveryBehaviors__table_uxz_tdr_43c__entry__2}
| Functionality | Description |
|-|-|
| Windows only (WMI) | Scans for Windows devices using the WMI protocol. Requires a Windows MID Server and functionality criteria to specify the domain. |
| Windows, DNS, and WINS | Scans for Windows devices using the WMI protocol and resolves the domain using DNS and WINS. Requires a Windows MID Server and functionality criteria. |
| SNMP only | Scans for SNMP devices only. Use this when scanning devices protected by an ACL that restricts SNMP access to specific MID Server hosts. Does not require functionality criteria. |
| All except SNMP | Scans for all protocols except SNMP, including WMI and SSH. Use this in combination with SNMP only functionality when you need separate MID Servers for SNMP and other protocols. |
| All except Windows (no WMI) | Scans for all protocols except WMI, including SSH and SNMP. Use this in combination with Windows only functionality when scanning multiple domains or when non-Windows devices require a different MID Server. |
[Table 1. Common functionality definitions]
{#c_DiscoveryBehaviors__table_uxz_tdr_43c}
* **[Create a Discovery behavior](https://www.servicenow.com/docs/NKs~1K42KI9xntraaYjcWg)**
Create a Discovery behavior to determine which probes Shazzam launches and which MID Server is used.
* **[Set up a load balancing behavior](https://www.servicenow.com/docs/y34l1cfxEwuUaDv_E9fAKQ)**
When multiple MID Servers are configured to scan the same protocol, you can set up load balancing behavior to automatically balance the work between MID Servers.
* **[Examples of Discovery behavior functionalities](https://www.servicenow.com/docs/wDR7JVRJMo0NLCQDaAkIjg)**
This example of a Discovery behavior requires three functionalities for the behavior.
* **[Access an ACL-protected SNMP device](https://www.servicenow.com/docs/1YFCRuTXRZgme9ihqwRc0g)**
Access an SNMP device protected by an ACL using a Discovery behavior.
*[\>]: and then