ITOM Architect
1Discovery, Service Mapping, Event Management, Mid Server architecture, protocol integrations (SNMP, WMI, SSH, vCenter)
Modernization path
Equip IT supervision with ServiceNow ITOM.
ServiceNow ITOM deployment: Discovery, Service Mapping, Event Management, Orchestration. IT estate mapping and 24/7 monitoring with event correlation.
Key figures
3-8
monitoring tools aggregated on average in a large-enterprise patchwork
-70 to -90%
typical reduction of incident volume after correlation rules go live
6-12 months
typical duration for Discovery + Service Mapping + Event Management
ATLAS methodology applied
From scoping to deployment, five structured phases.
Each phase aggregates one or more of the ten ATLAS steps. No phase starts until the previous one has delivered its validated artefact. The ATLAS methodology makes AS/400 migration predictable and auditable.
- 01Phase 1
Scoping & inventory
ATLAS stepsE1 Intake · E2 Initial Discovery · E2b Functional specMap the Discovery perimeter (network, IP ranges, OS, applications, vCenter), inventory monitoring sources to integrate (Nagios, Zabbix, SCOM, Prometheus, Datadog…), define priority business services for Service Mapping. Validate privileged credentials and CyberArk governance.
Phase deliverableSigned perimeter + sources inventory + credentials governance matrix - 02Phase 2
Discovery preparation
ATLAS stepsE2e Capture · E3 Dependency mappingDeploy Mid Servers on target network zones, validate credentials, test Discovery on a sub-perimeter, measure response times, adjust IP ranges and scheduling to remain non-blocking for production.
Phase deliverableMid Servers in production + Discovery validated on sub-perimeter - 03Phase 3
Discovery & Service Mapping
ATLAS stepsE4 Target architecture · E4b Pre-deployment testsIndustrialize Discovery across the whole perimeter, enrich CMDB with detected CIs, top-down Service Mapping from critical business services, validate parent/child relationships and business impacts.
Phase deliverableEnriched CMDB + signed business services map - 04Phase 4
Event Management & correlation
ATLAS stepsE5 Migration · E6 Parity validationConnect monitoring sources via native or REST connectors, deploy the correlation rules catalog (deduplication, parent/child, maintenance suppression, CMDB enrichment), measure incident volume reduction, fine-tune to reach -70 to -90% vs source tools.
Phase deliverableOperational Event Management + rules catalog + on-call dashboard - 05Phase 5
Run & handover
ATLAS stepsE7 DeliveryTrain on-call teams on the unified ITOM dashboard, deploy targeted Orchestration automations (auto-remediation on repetitive incidents), hand operations over to the client team with documentation and runbooks.
Phase deliverableTrained on-call teams + Orchestration automations + autonomous client team
Who is concerned
Business context and modernization stakes.
Why ITOM after ITSM
ServiceNow ITOM naturally follows as the logical sequel to a successful ITSM deployment. Once ITSM is in place with a governed CMDB, ITOM brings three missing building blocks: automatic Discovery which enriches the CMDB with technical CIs (servers, databases, applications, network), Service Mapping which models dependencies between business services and infrastructure, and Event Management which consolidates alerts from existing monitoring tools to create qualified incidents. The target: reduce alert noise (correlation, deduplication) and accelerate diagnosis (end-to-end view of dependencies).
The typical context: a monitoring patchwork
Most large organizations operate a patchwork of 3 to 8 monitoring tools: Nagios for network, Zabbix for Linux, SCOM for Windows, Prometheus + Grafana for containers, AppDynamics or Dynatrace for APM, plus sectoral tools and homegrown scripts. Result: redundant alerts, lack of cross-layer correlation, on-call teams overwhelmed by noise, slow diagnosis because engineers navigate across 5 consoles. ServiceNow ITOM Event Management does not replace these tools — it aggregates them via connectors and applies a layer of correlation and CMDB enrichment.
Source platform
Fragmented monitoring tools (Nagios, Zabbix, SCOM, custom)
Scoping reference
Typical duration and team for this path.
A ServiceNow ITOM deployment is typically structured over six to twelve months depending on the Discovery, Service Mapping, and Event Management scope. The cell combines an ITOM architect, two to three ServiceNow Discovery / Service Mapping consultants, a monitoring integrations engineer, an infrastructure referent on the client side. For an estate of a few thousand CIs and 5 to 10 event sources, plan eight to ten months with a cell of four to five people.
Challenges
- Consolidating multiple monitoring tools onto a single platform.
- Automatically mapping business services and their dependencies.
- Correlating events to reduce alert noise.
ATLAS approach
- Discovery and Service Mapping deployment on the target perimeter.
- Event Management configuration with correlation rules.
- Orchestration automations for remediation.
Expected outcomes
- Unified view of the IT estate and business services.
- Reduction of alert noise (-70 to -90% typically) and MTTR.
- Discovery and Service Mapping continuously up to date without manual entry.
Identified pitfalls and ATLAS response
What we learned on this migration path.
Pitfall 01
Launching Discovery without network preparation. Discovery probes the IT via privileged credentials and protocols (SNMP, WMI, SSH, vCenter) — without preparation, massive failures and team frustration.
ATLAS response
Dedicated Discovery preparation phase: Mid Servers deployed and authorized on the network, credentials governed via CyberArk or equivalent, target IP ranges defined, Discovery schedule non-blocking for production. Tests on sub-perimeter before industrialization.
Pitfall 02
Activating Event Management without correlation rules. Without rules, ServiceNow merely copies alerts from source tools — no gain.
ATLAS response
Catalog of correlation rules established by incident class: deduplication (identical alert within 30 min), parent/child grouping (one server down = N consolidated service alerts), suppression (planned maintenance alerts), CMDB enrichment (auto-calculated business impact). The goal: reduce by 70 to 90% the volume of incidents generated compared to source tools.
Cell composition
A specialized cell for this modernization path.
Several distinct profiles, mobilized over the full program duration. Reproducing this cell internally is rarely realistic — the legacy skills shortage and ATLAS expertise depth make outsourcing structurally faster and less risky.
Duration
6 to 12 months depending on Discovery / Service Mapping / Event Management scope
Volume
4 to 6 people for a few thousand CIs and 5 to 10 event sources
Profiles
ServiceNow ITOM Tech Lead
1ServiceNow ITOM administration, JS scripts, correlation rules, REST/MID integrations
Discovery / Service Mapping consultants
2Mid Server configuration, Discovery patterns, top-down Service Mapping from business services
Monitoring integrations engineer
1Connectors Nagios, Zabbix, SCOM, Prometheus, AppDynamics, Datadog to Event Management
CMDB referent
1CMDB data model, CI governance, automatic enrichment via Discovery, relationship quality
Client infrastructure referent
1Network topology, privileged credentials (CyberArk), target IP ranges, Discovery schedule non-blocking for production
Frequently asked questions
What decision-makers ask about this path.
Does ITOM replace my existing monitoring tools (Nagios, Datadog, etc.)?+
No. ServiceNow ITOM aggregates alerts from existing tools rather than replacing them. The tools continue to monitor the technical layers they handle effectively (Datadog for APM, Prometheus for containers, Nagios for network). ITOM Event Management collects these alerts via native or REST connectors, applies correlation rules, enriches with the CMDB, and creates qualified ServiceNow incidents. Engineers work in ServiceNow rather than navigating between N consoles.
Should we have ServiceNow ITSM in place before ITOM?+
Strongly recommended. ITOM relies on the ITSM CMDB to enrich events and create qualified incidents. Without a minimal CMDB (at least critical business services, the most exposed servers and applications), ITOM can technically work but loses most of its value. Typical scenario: deploy ITSM + CMDB in year 1, extend to ITOM in year 2.
How much does a ServiceNow ITOM deployment cost?+
For a scope of a few thousand CIs and 5 to 10 monitoring event sources, plan three hundred to six hundred thousand euros of implementation in nearshore co-delivery, plus ServiceNow ITOM licenses (Discovery, Service Mapping, Event Management) varying with volume. Operational gains (MTTR reduction, decrease in on-call activations) are measured from the first year.
Considering a ServiceNow ITOM deployment?
Three concrete ways to start — from a Discovery POC to a full ITOM program. Our approach builds on the ATLAS methodology and a proven Event Management correlation rules catalog.
Case studies
Client cases on this technology
Other paths in the same pillar