Create a Discovery behavior

Create a Discovery behavior to determine which probes Shazzam launches and which MID Server is used.

Before you begin

Role required: discovery_admin

Procedure

  1. Navigate to Discovery Definition > Behavior and click New.
  2. Enter a name.
  3. Right-click the form header and select Save.
    Discovery behavior form
  4. In the Discovery Functionality related list, click New.
    Discovery Functionality defines what each MID Server in this behavior must do, specifically which protocols to detect.
  5. Fill out the form fields:
    Field Description
    Phase

    Enter an integer that represents an arbitrary phase. The phase is used to group one or more functionalities together. All the functionalities within a specified phase are executed together, and all phases are executed in numerical order. All functionalities in a behavior can have the same phase.

    The Shazzam probe runs once for each phase in a behavior, which makes fewer phases desirable. Run multiple phases for behaviors only when devices in the network are running multiple protocols, such as SSH and SNMP. In that example, set one phase for the SSH scan and another phase for the SNMP scan.

    Active Keep this option selected to apply the discovery functionality.
    Functionality definition Click the lookup icon, and then select a pre-configured functionality that defines the protocol or list of protocols that each MID Server scans.
    Match criteria Define criteria here for Windows MID Servers.
    MID Servers Select one or more MID Servers to perform this functionality for the following Discovery types:
    • IP Scan
    • CI Scan
    Discovery automatically balances the load when multiple MID Servers are selected.
  6. Right-click the form header and select Save.
  7. To add criteria that the functionality must meet in order to be triggered, click New in the Functionality Criteria related list, fill out the form fields, and then click Submit.
    Field Input Value
    Name The name in the criteria is the variable that passes the following information:
    • mid_server: MID Server that processes the results from the Shazzam probe.
    • win_domain: Windows domain of the target device.
    Operator Select a logical operator.
    Value Enter the actual name of the MID Server (mid_server) or domain (win_domain) to pass to Discovery for this criteria. This field can also have a value of mid_domain, which defines the Windows domain of the MID Server that is processing the Shazzam results.
    Note: Functionality criteria are required for Windows MID Servers only, and only when the behavior controls Discovery across multiple domains. When the instance launches the Shazzam probe for a Discovery in which a behavior defines multiple MID Servers to scan multiple domains, the functionality criteria determine which MID Server process the results of the probe.

    The following graphic shows an example of functionality criteria. Discovery functionality criteria

What to do next

Create a Discovery Schedule of type Configuration Item, and select Use Behavior for the MID Server selection method.