Create a Discovery behavior

Create a Discovery behavior to determine which probes Shazzam launches and which MID Server is used.

1. Navigate to Discovery Definition > Behavior and click New.
2. Enter a name.
3. Right-click the form header and select Save.

   

4. In the Discovery Functionality related list, click New.
   Discovery Functionality defines what each MID Server in this behavior must do, specifically which protocols to detect.
5. Fill out the form fields:

   Field	Description
   Phase	Enter an integer that represents an arbitrary phase. The phase is used to group one or more functionalities together. All the functionalities within a specified phase are executed together, and all phases are executed in numerical order. All functionalities in a behavior can have the same phase. The Shazzam probe runs once for each phase in a behavior, which makes fewer phases desirable. Run multiple phases for behaviors only when devices in the network are running multiple protocols, such as SSH and SNMP. In that example, set one phase for the SSH scan and another phase for the SNMP scan.
   Active	Keep this option selected to apply the discovery functionality.
   Functionality definition	Click the lookup icon, and then select a pre-configured functionality that defines the protocol or list of protocols that each MID Server scans.
   Match criteria	Define criteria here for Windows MID Servers.
   MID Servers	Select one or more MID Servers to perform this functionality for the following Discovery types: IP Scan CI Scan Discovery automatically balances the load when multiple MID Servers are selected.

6. Right-click the form header and select Save.
7. To add criteria that the functionality must meet in order to be triggered, click New in the Functionality Criteria related list, fill out the form fields, and then click Submit.

   Field	Input Value
   Name	The name in the criteria is the variable that passes the following information: mid_server: MID Server that processes the results from the Shazzam probe. win_domain: Windows domain of the target device.
   Operator	Select a logical operator.
   Value	Enter the actual name of the MID Server (mid_server) or domain (win_domain) to pass to Discovery for this criteria. This field can also have a value of mid_domain, which defines the Windows domain of the MID Server that is processing the Shazzam results.

   Note: Functionality criteria are required for Windows MID Servers only, and only when the behavior controls Discovery across multiple domains. When the instance launches the Shazzam probe for a Discovery in which a behavior defines multiple MID Servers to scan multiple domains, the functionality criteria determine which MID Server process the results of the probe.

   The following graphic shows an example of functionality criteria.