--- sourceDocument: Zurich IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Discovery for cloud environment # Discovery for cloud environment {#ariaid-title1} * Release version: Zurich * * Updated June 17, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Discovery for cloud environment ITOM Visibility cloud discovery solutions enable ServiceNow customers to collect detailed information about cloud infrastructures and resources across major cloud providers such as AWS, Microsoft Azure, Google Cloud Platform (GCP), IBM Cloud, Oracle Cloud Infrastructure (OCI), and Alibaba Cloud. Cloud discovery operates at two layers---the cloud metadata (topology) layer and the operating system (OS) layer---offering comprehensive visibility from structural inventory to detailed operational insights. This layered approach allows organizations to customize discovery methods according to their specific business needs. Show full answer Show less ## Key Features * **Cloud Discovery Layers:** * **Cloud Metadata Layer:** Provides a high-level inventory of cloud resources (e.g., VMs, networks) to understand architecture and resource relationships. * **OS Layer:** Delivers detailed information about installed software, active services, and configurations for monitoring and compliance. * **Discovery Methods:** * **Pattern-based Cloud Discovery and IP-based Horizontal Discovery:** Pull-based, scheduled methods that require OS/application credentials and MID Server firewall access; support both metadata and OS layers; compatible with AWS, Azure, GCP, OCI, Alibaba, IBM clouds. * **Agent Client Collector for Visibility Content:** Agent-based, push model with near real-time OS layer discovery; does not require OS credentials or MID Server; supports Windows, Linux, macOS on AWS, Azure, GCP. * **Service Graph Connectors:** Third-party connectors pulling data via cloud provider APIs; support metadata and limited OS layer discovery; require read access only; no OS credentials or firewall changes needed; support continuous visibility for AWS. * **Continuous Visibility:** Critical for dynamic cloud environments, available as pull-based (periodic data sync) and push-based (event-driven near real-time updates). Supported by pattern-based discovery, Service Graph Connectors, and Agent Client Collector depending on provider and method. * **Managing Discovery:** Discovery Admin Workspace centralizes monitoring, issue diagnosis, performance tracking, and tuning discovery configurations. Cloud Account Management within Cloud Workspace further enhances asset inventory and compliance monitoring across cloud providers. ## Key Outcomes * **Regulatory Compliance:** Provides visibility and data required for compliance mandates across cloud providers. * **Software Asset Management (SAM):** Enables effective management of cloud software deployments. * **Financial Operations (FinOps):** Offers detailed resource usage insights to optimize cloud spending. * **Security Operations (SecOps):** Supports continuous monitoring of resource configurations to enhance cloud security. * **Certificate Management:** Tracks certificates and expiration to reduce outage risks. * **Artificial Intelligence for IT Operations (AIOps):** Supplies foundational data for proactive monitoring and issue prediction. Selecting the appropriate discovery method at each layer is essential to meet specific business outcomes effectively. Cloud metadata methods (pattern-based discovery and Service Graph Connectors) and OS layer methods (IP-based discovery, Agent Client Collector, and Service Graph Connectors) provide varying levels of coverage and support different operational goals. ITOM Visibility cloud discovery solutions enable you to collect detailed information about your cloud-based infrastructure and your resources in major cloud service providers: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), IBM Cloud Platform, Oracle Cloud Infrastructure (OCI), and Alibaba Cloud. ITOM Visibility cloud discovery can be understood through the layers at which discovery operates and the methods used to perform discovery. Different methods or combination of methods at the different layers support various business outcomes, giving you the flexibility to customize your discovery approach to your organization's specific needs. ## Business outcomes {#cloud-discovery-wizard__section_vqw_m2w_4gc} Effective cloud discovery is crucial for maintaining an accurate and up-to-date inventory of cloud resources. This comprehensive visibility into the cloud infrastructure enables organizations to drive several key business outcomes. It empowers informed decision-making, accelerates innovation by optimizing resource allocation, and helps cloud investments align directly with strategic business objectives. {#cloud-discovery-wizard__table_zmb_jvk_khc__entry__2} | Business outcome | Cloud discovery role | |-|-| | Regulatory compliance | Provides the necessary visibility and data to support regulatory compliance mandates. | | SAM (software asset management) | Enables more effective software asset management by providing comprehensive visibility into cloud software deployments. | | FinOps (financial operations) | Provides comprehensive visibility into cloud resources and their usage, enabling FinOps teams to optimize cloud spend across cloud providers, organizations, and cost centers. | | SecOps (security operations) | Offers continuous visibility into cloud resources and their configurations, supporting the security and compliance of cloud environments. | | Certificate management | Discovers and tracks certificates, their expiry, and usage, enabling teams to reduce the risk of certificate-related outages and assess potential business impact. | | AIOps (artificial intelligence for IT operations) | Identifies and maps cloud resources, their configurations, and interdependencies. Cloud discovery provides the foundational data for AIOps platforms to monitor proactively, analyze, and predict potential issues, ultimately reducing outage risks and supporting business continuity. | [Table 1. Business outcomes supported by cloud discovery] {#cloud-discovery-wizard__table_zmb_jvk_khc} For more information on which cloud discovery methods best support each business outcome, see the Matching methods to business outcomes section. ## Cloud discovery layers {#cloud-discovery-wizard__section_bxx_q3p_chc} To achieve these business outcomes, you need to understand how cloud discovery works. Cloud discovery can be understood in two distinct layers: the cloud metadata (or topology) layer and the operating system (OS) layer. Each layer provides a different level of visibility into cloud infrastructure, from structural inventory to a detailed operational state. Think of it like mapping a neighborhood versus inspecting individual buildings. The cloud metadata layer provides a high-level view of cloud infrastructure by outlining its structural components. This outline includes identifying resources like virtual machines, networks, and subnets, effectively creating an inventory of what exists. It's similar to mapping all the buildings in a neighborhood, showing how everything is organized and interconnected. This layer helps to understand the overall architecture and resource relationships within a cloud environment. The OS layer reveals the internal state of cloud resources, including installed software, active services, running processes, and system configurations. It's like stepping inside each building in a neighborhood to inspect its internal setup. This deeper level of discovery helps monitor operations, verify configurations, and maintain compliance and security across environments. These layers can be discovered through the different cloud discovery methods and together, the two layers enable comprehensive visibility from structural inventory to detailed operational insights. ## Cloud discovery methods {#cloud-discovery-wizard__section_od4_ht4_5pb} ITOM Visibility supports several methods for cloud discovery, depending on the layer. Different discovery methods address different organizational needs and constraints. * Cloud metadata layer: Pattern-based Cloud Discovery and Service Graph Connectors * OS layer: IP-based Horizontal Discovery, Agent Client Collector for Visibility Content, and Service Graph Connectors {#cloud-discovery-wizard__ul_wbr_bj3_mhc} Note: The pattern-based Cloud Discovery and IP-based Horizontal Discovery methods operate at different layers but both use the Discovery and Service Mapping Patterns application. Pattern-based Cloud Discovery/IP-based Horizontal Discovery : The Discovery and Service Mapping Patterns application supports both cloud metadata and OS layer discovery. Patterns execute commands in a pull-based, scheduled approach by targeting devices within specified IP ranges. Key characteristics include: * Requires OS and application credentials * Needs firewall access from a MID Server * Works with AWS, Azure, GCP, OCI, Alibaba Cloud, and IBM clouds * Supports continuous visibility for AWS, Azure, and GCP {#cloud-discovery-wizard__ul_ad3_g3r_khc}For more information, see [Discovery patterns used by ITOM Visibility](https://www.servicenow.com/docs/G6Qi9CpVd~QDcPGBjdqbbA "Service Mapping and Discovery use patterns in their discovery process that cover most industry standard network devices and applications. You can customize these patterns and create new ones."). Agent Client Collector for Visibility Content : An agent-based, push-based cloud discovery that provides near real-time discovery and supports OS layer discovery. Key characteristics include: * Supports deployment with or without a MID Server * Doesn't require OS-level credentials * Works on Windows, Linux, and macOS * Uses system accounts, local service accounts, or Microsoft gMSA * Supports OS layer discovery only * Works with AWS, Azure, and GCP {#cloud-discovery-wizard__ul_vmb_r3r_khc}For more information, see [Agent Client Collector Discovery](https://www.servicenow.com/docs/edhre6~2pn1oGWgUK2rrGQ "Discover CIs in your environment by using Agent Client Collector for Visibility Content (ACC-VC) Discovery. ACC-VC works with both horizontal IP-based Discovery, and you can also use push-based Discovery."). Service Graph Connectors : Third-party connectors that perform scheduled imports by pulling data directly from cloud provider APIs. Service Graph Connectors support both cloud metadata and limited OS layer discovery. Key characteristics include: * Requires read access to the provider's system * Doesn't require OS credentials or MID Server firewall access * Works with AWS, Azure, and GCP * Supports continuous visibility for AWS {#cloud-discovery-wizard__ul_zyb_gjr_khc}For more information, see [Integrating third-party data into CMDB](https://www.servicenow.com/docs/access?context=cmdb-third-party-integrations&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US). Each method has its own requirements and supports different use cases, depending on the cloud provider. For more information, see: * AWS: [AWS cloud discovery methods and use cases](https://www.servicenow.com/docs/B39CrjfakrVSqMDn6QjeoQ "Comparison of use cases and requirements for cloud discovery methods in AWS.") * Azure: [Azure cloud discovery methods and use cases](https://www.servicenow.com/docs/6QMrFOekkSJnHQ7HpVhmUQ "Comparison of use cases and requirements for cloud discovery methods in Azure.") * GCP: [GCP cloud discovery methods and use cases](https://www.servicenow.com/docs/pk9vcCFvNG0au_Bl8qAAFw "Comparison of use cases and requirements for cloud discovery methods in GCP.") {#cloud-discovery-wizard__ul_lnx_w1m_wgc} For a list of AWS, Azure, and GCP resources discovered by Discovery and Service Mapping Patterns and Service Graph Connectors, see [Cloud discovery solutions comparison](https://www.servicenow.com/docs/1x1OeHci8MaZik4qKVOa3Q "Comparing cloud discovery solutions provides insights on the relative strengths of each solution. The comparison showcases the number of resource types supported by the solutions across AWS, Azure, and GCP. The comparison can help you understand the capabilities of each solution and better manage your CMDB when using one or multiple methods."). ## Continuous visibility {#cloud-discovery-wizard__section_edd_zmz_wfc} Beyond choosing a cloud discovery method, you must also consider when and how often discovery occurs. Cloud environments are highly dynamic, with resources constantly being created, modified, or deleted. Traditional scheduled discovery often fails to keep up with these rapid changes, leading to a stale and inaccurate CMDB. Continuous visibility addresses this challenge by capturing changes as they happen in the cloud. There are two main types of continuous visibility: pull-based and push-based. In pull-based discovery, the ServiceNow instance connects to cloud providers at set intervals to retrieve and update CMDB data. This approach promotes regular synchronization and offers more frequent updates than traditional scheduled scans. The pattern-based Cloud Discovery method supports this approach for both Azure and GCP. In push-based discovery, the cloud environment itself is configured to send change events directly to the ServiceNow instance. This approach enables near real-time updates to the CMDB. Both Service Graph Connectors and the pattern-based Cloud Discovery method support push-based discovery for AWS. Note: Continuous visibility for Amazon AWS Cloud, Microsoft Azure Cloud, and Google Cloud Platform doesn't require Cloud Provisioning and Governance. For more information, see: * Azure: [Microsoft Azure Alert driven discovery](https://www.servicenow.com/docs/xjCcpuFw4L7d1uuSDtZxsw#microsoft-azure-alert-driven-discovery "The Microsoft Azure Alert service can raise alerts for any changes in the life-cycle state or the configuration of a cloud resource. You can configure the service to auto-update the latest resource information in the Configuration Management Database (CMDB) without waiting for the next scheduled Cloud Discovery to run.") * GCP: [Configure the Google Cloud Logging service to auto-update the CMDB](https://www.servicenow.com/docs/DkAqvHe_wGTuYvP4srIYgA "You can activate the Google Cloud Logging (formerly Stackdriver Logging) service to auto-update Configuration Management Database (CMDB) configuration items (CI) data whenever Google Cloud Connector or your Google account makes a life-cycle state or configuration change to a Google Cloud Platform (GCP) resource. As a result, the CI data in the CMDB is updated without having to wait for Discovery to run.") * AWS: [AWS events-driven discovery](https://www.servicenow.com/docs/3JTqKzaJXc~YEvZ11lrchw "The Amazon Web Services (AWS) Config service can raise events for any changes in the life-cycle state or the configuration of a cloud resource. The ServiceNow event-driven discovery uses the events to auto-update the latest resource information in the Configuration Management Database (CMDB).") {#cloud-discovery-wizard__ul_gqv_bfv_xfc} ## Choosing methods for desired business outcomes {#cloud-discovery-wizard__section_lqr_zhf_xgc} Choosing the right discovery methods at the cloud metadata and OS layers for your desired business outcomes is essential for optimizing your configuration management strategy and achieving operational goals. Cloud metadata layer discovery methods support the following business outcomes: {#cloud-discovery-wizard__table_en1_xpr_khc__entry__3} | Business outcomes | Pattern-based Cloud Discovery | Service Graph Connectors | |-|-|-| | Regulatory compliance | Yes | Yes | | Basic AIOps | Yes | Yes | | Continuous visibility | AWS, Azure, and GCP | AWS only | [Table 2. Cloud metadata layer discovery] {#cloud-discovery-wizard__table_en1_xpr_khc} OS layer discovery methods support the following business outcomes: {#cloud-discovery-wizard__table_c5q_3qr_khc__entry__4} | Business outcomes | IP-based Horizontal Discovery | Agent Client Collector for Visibility Content | Service Graph Connectors | |-|-|-|-| | Regulatory compliance | Full | Full | Limited | | SAM | Enterprise | Enterprise | Basic | | FinOps | Yes | Yes | No | | SecOps | Yes, including file-based discovery | Yes, including file-based discovery | No | | Certificate management | Yes | Yes | No | | AIOps | Full | Full | Limited | | Oracle GLAS (Global Licensing Advisory Services) audits | Yes | Yes | No | | Hibernating or autoscaling resource visibility | No | Yes | No | [Table 3. OS layer discovery] {#cloud-discovery-wizard__table_c5q_3qr_khc} ## Managing your cloud resources {#cloud-discovery-wizard__section_sr3_3dp_b3b} Discovery Admin Workspace provides a centralized location for managing and monitoring discovery operations, including performance monitoring, issue diagnosis, and maintaining configuration accuracy. From tracking schedules and diagnosing errors to tuning configurations and accessing insights, Discovery Admin Workspace integrates key tools to improve efficiency and visibility. You can identify critical tasks, manage discovery processes, and resolve issues with enhanced diagnostics and reporting. For more information, see [Discovery Admin Workspace](https://www.servicenow.com/docs/Gjld4BNqHm4n6vq4J4XK9g "The Discovery Admin Workspace serves as a central location for monitoring, tracking, and completing discovery-related tasks. Experience a streamlined discovery process and greater efficiency with the integration of schedules, diagnostics, tuning, anomaly detection, and more within this single workspace."). If you have Cloud Account Management (CAM) within Cloud Workspace, you can use CAM to access your cloud account and resource inventory through the Cloud Asset Explorer, Cloud Compliance, and Cloud Accounts dashboards. Cloud Workspace provides comprehensive visibility into cloud accounts and assets across providers, enabling you to track ownership, monitor account trends, and promote regulatory compliance. For more information, see [Cloud Account Management](https://www.servicenow.com/docs/8ubSenw1KQutowvq0yuxjw "Cloud Account Management simplifies account management by automating tasks like creation and provisioning. Predefined policies enable easy suspension, reactivation, and certification of accounts. Potentially reduce provisioning times from weeks to minutes by automating requests, approvals, and setups.").