Use xAssets as a ServiceNow Discovery Tool

Introduction

For ServiceNow customers, making sure the CMDB reflects what is actually on the network — and in people's homes — can be challenge and a huge expense. Coverage gaps are common for devices that sit outside the data centre and head office: printers, switches, UPS units, IP phones, Macs, Linux servers, and laptops used by home and remote workers that rarely appear on the LAN.

xAssets Discovery is designed to close those gaps. It combines two discovery modes — agentless scanning for LAN-connected devices and a lightweight agent for remote machines. It can feed the results directly into the ServiceNow CMDB through the xAssets ServiceNow integration.

It is also possible to feed other integrations into xAssets, and the normalised data from Discovery and other integrations can be fed into the ServiceNow CMDB. This includes Intune, Autopilot, MDMs, 30 other pre-built integrations, and the capacity to build new integrations quickly.

This gives a way to populate your CMDB and keep it up-to-date at a fraction of the price of ServiceNow discovery and ServiceNow integration fees can also be completely avoided.

Completeness of the CMDB

Many ServiceNow customers already have some form of discovery populating their CMDB. xAssets is used as a complementary source where there are known coverage gaps, or where the customer wants a second, independent view to verify what the primary source reports. Common examples include:

• Laptops that rarely connect to the corporate network
• Offices, retail sites and locations with limited connectivity
• Networking and infrastructure equipment (switches, routers, firewalls, UPS, printers, IP phones) that need SNMP-based discovery
• Macs and Linux machines alongside Windows endpoints
• Virtual machines, hypervisors and devices behind segmented zero-trust networks
• Acquired subsidiaries being merged into a central ServiceNow instance

The discovered data is pushed into the standard ServiceNow CI classes through the xAssets ServiceNow integration, so it lands in the CMDB alongside every other source.

Two Discovery Modes in One Product

xAssets Discovery exposes the same endpoint management framework through two different transports — agentless and agent-based — which means a single set of discovery scripts and field mappings drives both. Customers can mix and match as the environment requires, without running two separate discovery products.

Agentless LAN Discovery

The agentless architecture is suited to corporate LANs, WANs, and data centers. The xAssets scanner performs IP range sweeps with multi-threaded ping, then probes responsive addresses using a combination of technologies including a tiny agent, WMI, SSH, and SNMP. Credentials are held in an encrypted credential vault stored only on your network, and no software is installed on the target.

Agentless discovery requires no deployment, requires no endpoint footprint, and reaches all devices including those that do not support a traditional PC agent — switches, routers, wireless controllers, printers, UPS units, IP phones, sensors and storage arrays. These are the devices that are most often under-represented in a CMDB, and they are exactly where SNMP-based agentless scanning is most effective.

Agent-Based Discovery for Remote and Home Workers

The second mode is the xAssets Discovery Agent, known internally as DMPC (discover my PC). This is a lightweight always-on Windows or Mac endpoint service that maintains a persistent outbound WebSocket connection to a central collection server. Once installed, the agent reports hardware and software inventory continuously and responds to discovery jobs in real time — wherever the device happens to be.

This is the mode that closes the home and remote worker gap. A laptop that joins the corporate VPN for an hour a week will still be discovered accurately, because the agent does not depend on the corporate LAN, Active Directory visibility, domain credentials, or a scheduled scan window. The connection is initiated outbound by the endpoint over a single port, which works cleanly through home broadband, split-tunnel VPNs, hotel Wi-Fi and zero-trust network segmentation.

A Modern Agent Architecture

The discovery agent is built on a modern architecture designed for scale and security:

• Persistent WebSocket. Each endpoint holds a long-lived outbound WebSocket to the collection server. Idle connections carry zero traffic, which is what allows a single collection server to handle very large agent populations.
• Real-time change reporting. Because the agent is always on, hardware and software changes are picked up as they happen rather than at the next scheduled scan.
• Outbound only. No inbound ports are opened on the endpoint. One SSL port outbound (443) is all that is required — far simpler to approve through corporate firewall and zero-trust reviews than WMI, SMB or RPC.
• Token-based registration. Agents register with an encrypted installation code (AES-256) and receive a per-endpoint token and secret. Every subsequent command is authenticated with HMAC-SHA256 (making attacks like the Stryker attack impossible).
• Cross-platform. Native Windows service and native agent for macOS, both speaking the same WebSocket protocol against the same collection server.
• Adaptive reconnection. Agents use adaptive incremental backoff when a connection drops, which keeps the population resilient without creating reconnect storms.
• Remote operations. The same agent channel also carries remote terminal, remote desktop and endpoint scripting (XDSL), so the discovery investment doubles as a remote support channel.
• Quiet footprint. The agent runs as two small services (discovery and communicator), uses named pipes for local IPC, and ships as a silent MSI for Windows or PKG for macOS.

Deployment is supported through a silent MSI on Windows, a signed package on macOS, and through PowerShell remoting or any standard software deployment tool. The agentless channel can be used to bootstrap the agent — a useful way to roll out the agent population across an existing LAN without touching every endpoint manually.

What Gets Discovered

Hardware and software inventory collected by xAssets Discovery covers the usual ground — make, model, serial number, chassis type, virtual or physical, CPU, cores, memory, logical and physical disks, network adapters, MAC and IP addresses, operating system, service pack, last boot, installed software titles and versions, logged-on user, domain, and last-seen timestamp. SNMP targets return the sysObjectID-derived equipment type, interfaces, location and contact. Mac-specific fields (System Integrity Protection state, FileVault, XProtect, hardware model codes) are collected natively on macOS.

Other integrations

xAssets Discovery isn't the only possible source of Asset data. You can use xAssets to centralize data from any other integrations, and then feed that centralized data into ServiceNow. No more need to pay a kings ransom for "xyz connector" - xAssets supports integration to any data source and the services needed to create integrations are usually minimal.

Feeding the ServiceNow CMDB

Once discovered, records flow through the xAssets matching and classification pipeline. The ServiceNow integration then pushes them to the appropriate CI class — using POST for new records and PATCH for updates, so existing CI attributes that other processes manage are not disturbed.

The same integration also handles installed software: every endpoint's application list becomes a set of cmdb_software_instance records linked to a centrally maintained software catalogue in cmdb_ci_spkg. This turns xAssets Discovery into a full software-inventory feed for the CMDB, not just a hardware feed.

Data Normalisation and Deduplication

Discovery data from any source tends to contain variations — the same manufacturer written half a dozen different ways, the same model encoded with and without trim codes, and software titles that differ by build number, locale or installer flavour. xAssets runs every discovered record through its recognition engine before it reaches ServiceNow, which resolves these variations to a canonical set.

The push pipeline extends this into the CMDB itself. xAssets reads ServiceNow's existing manufacturer and model records, maps them to canonical xAssets names, and then writes new assets against those resolved sys_ids. The practical effect is that the CMDB stops accumulating duplicate manufacturer and model records over time.

Security and Firewall Posture

The agent's outbound-only, single-port design is the most commonly cited security advantage in customer reviews, because it avoids the parts of agentless discovery that modern zero-trust segmentation tends to block (SMB 445, WMI 135 plus dynamic RPC, SSH 22). Agentless is kept for LAN-reachable infrastructure equipment where installing software is either impossible or unwanted, and the agent handles everything else. Credentials are held in an encrypted credential vault, installation codes and transport are AES-256 encrypted, and every agent command is signed.

Scale

The collection server uses a single WebSocket listener for all agents, with idle connections carrying no traffic. This is what allows a single collection server to handle very large populations — the architecture has been load-tested against a theoretical ceiling in the order of a million concurrent agents. In practice, customers size for growth rather than for a hard limit.

Summary

A ServiceNow CMDB is most useful when it is complete and clean. xAssets Discovery is a way to close coverage gaps, particularly for remote and home workers, Macs, Linux machines and SNMP infrastructure equipment. The agent is modern, outbound-only, cross-platform and designed for scale; the agentless channel handles the long tail of LAN infrastructure. Data flows into the ServiceNow CMDB through the same integration used for the pull and workflow scenarios, with normalisation and deduplication applied on the way in.

Further Reading

• Modernise ServiceNow Asset Workflows with xAssets ITAM and SAM
• Centralize Tanium Data with xAssets IT Asset Management
• Add value to Intune with an IT Asset Management toolset
• View Intune Asset Data in JIRA Tickets
• Best Practices in Software Asset Management
• Temporal Software Asset Management Calculation