ITOM Architect
1Discovery, Service Mapping, Event Management, Mid Server architecture, protocol integrations (SNMP, WMI, SSH, vCenter)
Loading...
Loading...
ServiceNow ITOM deployment: Discovery, Service Mapping, Event Management, Orchestration. IT estate mapping and 24/7 monitoring with event correlation.
Each phase aggregates one or more of the ten ATLAS steps. No phase starts until the previous one has delivered its validated artefact. The ATLAS methodology makes AS/400 migration predictable and auditable.
Map the Discovery perimeter (network, IP ranges, OS, applications, vCenter), inventory monitoring sources to integrate (Nagios, Zabbix, SCOM, Prometheus, Datadog…), define priority business services for Service Mapping. Validate privileged credentials and CyberArk governance.
Deploy Mid Servers on target network zones, validate credentials, test Discovery on a sub-perimeter, measure response times, adjust IP ranges and scheduling to remain non-blocking for production.
Industrialize Discovery across the whole perimeter, enrich CMDB with detected CIs, top-down Service Mapping from critical business services, validate parent/child relationships and business impacts.
Connect monitoring sources via native or REST connectors, deploy the correlation rules catalog (deduplication, parent/child, maintenance suppression, CMDB enrichment), measure incident volume reduction, fine-tune to reach -70 to -90% vs source tools.
Train on-call teams on the unified ITOM dashboard, deploy targeted Orchestration automations (auto-remediation on repetitive incidents), hand operations over to the client team with documentation and runbooks.
ServiceNow ITOM naturally follows as the logical sequel to a successful ITSM deployment. Once ITSM is in place with a governed CMDB, ITOM brings three missing building blocks: automatic Discovery which enriches the CMDB with technical CIs (servers, databases, applications, network), Service Mapping which models dependencies between business services and infrastructure, and Event Management which consolidates alerts from existing monitoring tools to create qualified incidents. The target: reduce alert noise (correlation, deduplication) and accelerate diagnosis (end-to-end view of dependencies).
Most large organizations operate a patchwork of 3 to 8 monitoring tools: Nagios for network, Zabbix for Linux, SCOM for Windows, Prometheus + Grafana for containers, AppDynamics or Dynatrace for APM, plus sectoral tools and homegrown scripts. Result: redundant alerts, lack of cross-layer correlation, on-call teams overwhelmed by noise, slow diagnosis because engineers navigate across 5 consoles. ServiceNow ITOM Event Management does not replace these tools — it aggregates them via connectors and applies a layer of correlation and CMDB enrichment.
Fragmented monitoring tools (Nagios, Zabbix, SCOM, custom)
A ServiceNow ITOM deployment is typically structured over six to twelve months depending on the Discovery, Service Mapping, and Event Management scope. The cell combines an ITOM architect, two to three ServiceNow Discovery / Service Mapping consultants, a monitoring integrations engineer, an infrastructure referent on the client side. For an estate of a few thousand CIs and 5 to 10 event sources, plan eight to ten months with a cell of four to five people.
Launching Discovery without network preparation. Discovery probes the IT via privileged credentials and protocols (SNMP, WMI, SSH, vCenter) — without preparation, massive failures and team frustration.
Dedicated Discovery preparation phase: Mid Servers deployed and authorized on the network, credentials governed via CyberArk or equivalent, target IP ranges defined, Discovery schedule non-blocking for production. Tests on sub-perimeter before industrialization.
Activating Event Management without correlation rules. Without rules, ServiceNow merely copies alerts from source tools — no gain.
Catalog of correlation rules established by incident class: deduplication (identical alert within 30 min), parent/child grouping (one server down = N consolidated service alerts), suppression (planned maintenance alerts), CMDB enrichment (auto-calculated business impact). The goal: reduce by 70 to 90% the volume of incidents generated compared to source tools.
Several distinct profiles, mobilized over the full program duration. Reproducing this cell internally is rarely realistic — the legacy skills shortage and ATLAS expertise depth make outsourcing structurally faster and less risky.
Discovery, Service Mapping, Event Management, Mid Server architecture, protocol integrations (SNMP, WMI, SSH, vCenter)
ServiceNow ITOM administration, JS scripts, correlation rules, REST/MID integrations
Mid Server configuration, Discovery patterns, top-down Service Mapping from business services
Connectors Nagios, Zabbix, SCOM, Prometheus, AppDynamics, Datadog to Event Management
CMDB data model, CI governance, automatic enrichment via Discovery, relationship quality
Network topology, privileged credentials (CyberArk), target IP ranges, Discovery schedule non-blocking for production
No. ServiceNow ITOM aggregates alerts from existing tools rather than replacing them. The tools continue to monitor the technical layers they handle effectively (Datadog for APM, Prometheus for containers, Nagios for network). ITOM Event Management collects these alerts via native or REST connectors, applies correlation rules, enriches with the CMDB, and creates qualified ServiceNow incidents. Engineers work in ServiceNow rather than navigating between N consoles.
Strongly recommended. ITOM relies on the ITSM CMDB to enrich events and create qualified incidents. Without a minimal CMDB (at least critical business services, the most exposed servers and applications), ITOM can technically work but loses most of its value. Typical scenario: deploy ITSM + CMDB in year 1, extend to ITOM in year 2.
For a scope of a few thousand CIs and 5 to 10 monitoring event sources, plan three hundred to six hundred thousand euros of implementation in nearshore co-delivery, plus ServiceNow ITOM licenses (Discovery, Service Mapping, Event Management) varying with volume. Operational gains (MTTR reduction, decrease in on-call activations) are measured from the first year.
Three concrete ways to start — from a Discovery POC to a full ITOM program. Our approach builds on the ATLAS methodology and a proven Event Management correlation rules catalog.