IT Discovery for Operational Technology (OT) Networks

  • Release version: Zurich
  • Updated March 12, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of IT Discovery for Operational Technology (OT) Networks

    IT Discovery for Operational Technology (OT) Networks enables ServiceNow customers to discover IT-class OT devices within designated Purdue levels of their Industrial Control System (ICS) networks. These devices include switches, routers, and computers located in both data centers and factory environments. This functionality is designed to integrate with your existing IT Discovery processes while addressing the unique security and operational considerations of OT environments.

    Show full answer Show less

    Key Features

    • Targeted Discovery Scope: Unlike standard IT Discovery, which focuses on Purdue Levels 4 and 5 (site business, logistics, and enterprise networks), IT Discovery for OT Networks primarily targets Purdue Levels 3.5 (Demilitarized Zone or Industrial DMZ) and 3 (site operations with plant control and monitoring functions).
    • Secure Discovery Zones: The process is typically run in the DMZ or IDMZ (Level 3.5), where IT and OT devices co-exist, minimizing risk to critical industrial operations by avoiding lower Purdue levels (0-2).
    • Automated CMDB Integration: Upon discovery, the system triggers events that check for existing OT entity records in the CMDB. It updates or creates these records as necessary, ensuring accurate and up-to-date representation of OT devices and their configurations.
    • OT Entity Attribute Management: The discovery schedule can push specific attributes to both the Configuration Items (CIs) and related OT entity records, enhancing data consistency and operational understanding.
    • Application Discovery: The process also identifies applications installed on OT devices and creates corresponding OT entity records, accessible via the Industrial Workspace under Operational Technology (OT).
    • Discovery Scheduling and Execution: Customers can create and manage Operational Technology Discovery schedules to orchestrate discovery runs, including immediate Quick Discovery or full OT Discovery executions.

    Practical Implications for ServiceNow Customers

    By leveraging IT Discovery for OT Networks, customers gain comprehensive visibility into IT-class devices within their OT environments, facilitating improved asset management, security posture, and operational efficiency. Running discovery in the IDMZ reduces operational risk while maintaining critical asset data accuracy in the CMDB. Additionally, integrating application-level discovery supports better management of software assets on OT devices.

    This functionality complements existing discovery capabilities by specifically addressing the unique structure and security zones of ICS networks, empowering customers to confidently manage and monitor their OT infrastructure alongside traditional IT assets.

    You can use the IT Discovery for Operational Technology (OT) Networks function to discover IT class OT devices. These devices are located in designated Purdue levels within your Industrial Control System (ICS) networks. IT class items include switches, routers, and computers that exist both in data centers and in your factories.

    Where standard Discovery processing takes place

    The IT Discovery for OT Networks process operates in a manner that is similar to the standard Discovery processes.

    Figure 1. Targeted Purdue levels in standard and IT Discovery for OT Networks Discovery

    Standard Discovery processing in the ServiceNow AI Platform® normally takes place in the following Purdue levels in your enterprise:

    Table 1. Processed Purdue levels
    Purdue Level Description
    4 Site business and logistics, such as all Information Technology (IT) functions.
    5 Enterprise Network, where Enterprise Resource Planning (ERP) functions take place.
    Note:
    To learn more about Purdue levels in Industrial Control Systems, see https://subscription.packtpub.com/book/networking_and_servers/9781788395151/1/ch01lvl1sec10/the-purdue-model-for-industrial-control-systems.

    Where and how IT Discovery for OT Networks processing takes place

    In contrast, IT Discovery for OT Networks processing can take place in the following Purdue levels, depending on which you select when you create an OT discovery schedule:
    Table 2. Processed Purdue levels
    Purdue Level Description
    3.5 Demilitarized Zone (DMZ) or Industrial Demilitarized Zone (IDMZ). Similar to a traditional (IT) DMZ, the OT-oriented IDMZ enables you to securely connect networks with different security requirements.
    3 Site operations where plant or site-wide control and monitoring functions reside.
    You typically run IT Discovery for OT Networks in the DMZ (or IDMZ, Purdue Level 3.5) of your ICS networks. This Purdue level is where there are usually IT and OT class computers and servers to discover and manage.
    Note:
    To avoid the possibility of disrupting your industrial operations, you should not run Discovery processes against Purdue levels 0 through 2 in your ICS networks.
    Figure 2. IT Discovery for OT Networks processing

    When you run an OT discovery schedule, it performs the following processing:

    1. Proceeds through the assigned IP addresses and discovers all hardware items that exist in it.
    2. When it completes discovery of a configuration item (CI), it internally triggers a (discovery.device.complete) event. This logic checks if an OT entity (cmdb_ot_entity) record exists for it in the Configuration Management Database (CMDB).
      • If one exists, and any related attributes have changed for the discovered item, it updates the OT Entities that are related to that CI.
      • If one does not exist, it creates one for it.
    3. And the location attribute, it also pushes the defined attributes from the OT discovery schedule to the CI and to the related OT entity records.
    4. It also creates OT entity records for the applications installed on discovered OT devices. To view the applications that have OT entity records created through IT Discovery for OT Networks, navigate to the Industrial Workspace list view and open the Applications list under Operational Technology (OT).