Discovery, Service Mapping, Event Management, Orchestration, Cloud Management — the operational layer that makes ITSM actionable.
ITOM (IT Operations Management) is what turns raw infrastructure signals into actionable operational intelligence. Discovery tells you what exists; Service Mapping tells you what depends on what; Event Management tells you what's broken; Orchestration lets you fix it.
Done right, ITOM is the multiplier for every other ServiceNow investment — the trusted CMDB, the accurate impact analysis, the auto-created incidents, the runbook automation.
VanPaulTek has been delivering IT operations tooling for over 20 years — pre-ServiceNow, we delivered it on Micro Focus, HP Openview, and homegrown platforms. That history informs how we deliver ITOM today.
Each solves a distinct operational problem. Together they form the fabric under ITSM.
Automated discovery of servers, applications, network devices, storage, and cloud resources across the estate.
Business services mapped to the infrastructure that runs them. The foundation for real impact analysis.
Correlation, deduplication, enrichment, and auto-incident creation from monitoring signals.
Automation of repeatable operational tasks — password resets, provisioning, remediation.
Multi-cloud governance — provisioning, cost, and policy across AWS, Azure, GCP.
The bridge between ServiceNow (cloud) and your on-prem environments. Fundamental for discovery and orchestration.
Design, architect, develop, implement, and support — five phases, one accountable team.
Operational goals + CMDB strategy come before tool configuration.
The network, security, and data plumbing that ITOM needs.
Configuration, integrations, patterns, workflows.
Phased rollout — infrastructure first, then services, then automation.
Continuous tuning — discovery, events, and automation drift over time.
Sample roadmap based on real implementations — adjustable to your scope, but grounded in what actually works. Not vendor marketing timelines.
Practical fixes that don't need a project charter. Ordered by timeframe and impact — the stuff experienced practitioners just do.
One-line reconciliation rule can merge dupes based on serial number / cloud instance ID. Immediate CMDB health boost.
Retired assets often still emit signals. Simple suppression rule kills 5-15% of alert noise instantly.
Service Graph Connector for AWS auto-populates 100+ CI classes. First cloud discovery run in <60 min.
Every source uses different severity scales. Normalize to a single 1-5 scale at ingestion — downstream everything gets simpler.
One CI throwing 500 events in 5 min → one incident, not 500. Basic clustering rule = 90% noise cut.
Virtual Agent → Orchestration → Active Directory. Password reset = 15-30% of L1 workload; automate 90%.
Force required fields on CI import. Prevents 90% of quality drift at the source vs. cleaning up after.
Common cases: log rotation, temp file cleanup. Orchestration executes runbook; if not resolved, escalate. Reduces P2 volume 10-20%.
Weekly automated report: over-provisioned cloud instances >2 CPU units unused. Ownership + action tracking.
Real KPIs and targets from mature implementations. Track these; if they trend the wrong way, something is off.
% of discovered CIs matching current reality. Below 90% signals credential or reconciliation issues.
Raw event count vs. correlated incidents. Well-tuned correlation cuts noise 80-90%.
% of auto-created incidents that turn into real work. Below 80% = correlation too loose.
Stale maps mislead. Should have ownership + refresh workflow.
Discovered vs. expected CIs per class. Business services should be near 100%.
% of L1 work automated end-to-end. Below 20% = orchestration underused.
MID = fabric. Uptime issues cascade into discovery drift + event backlog.
Cloud spend attributed to owner via CAM tags. Under 90% = governance failure.
Honest warnings from many deliveries — the mistakes that cost time, money, and adoption. These aren't in vendor guides.
Why it fails: Discovery scope creep = crushing amounts of low-value data, huge event volume, unusable CMDB. Data without purpose is noise.
Do this instead: Phase discovery by business value: tier-1 services first, tier-2 next quarter, tier-3 after that.
Why it fails: Applications change; maps go stale in 60-90 days without discipline. Stale maps mislead incident impact.
Do this instead: Service Map ownership + quarterly review workflow. Deprecated apps get maps retired proactively.
Why it fails: Every monitoring alert = a new incident = 1000+ open incidents/day. On-call rebels, tickets get closed unread.
Do this instead: Correlation + suppression rules before enabling auto-incident. Target 90% event → 10% incident ratio.
Why it fails: Discovery + event + orchestration workloads grow. Undersized MIDs cause discovery drift, event backlog, timeouts.
Do this instead: Capacity plan for 3-year growth + HA. Monitor MID CPU/memory + queue depth. Scale before problems.
Why it fails: Automated actions in production = one bad script = outage at scale. 'It worked in dev' has ruined careers.
Do this instead: Approval gates for high-impact + first-time automations. Gradually loosen once trust is earned.
Why it fails: Discovery credential with Admin access = huge security blast radius. Auditors love this finding.
Do this instead: Read-only cloud roles per provider. Least-privilege discovery. Rotate credentials quarterly.
Why it fails: Flat CI list = no impact analysis, no service maps, no root cause. CMDB devolves to inventory.
Do this instead: Relationship discovery in scope from day one. Depends On + Runs On + Hosted On populated.
Why it fails: Events without CI context can't be routed by ownership. On-call gets everything, ignores most.
Do this instead: Event → CI matching at ingestion. Owner routing based on CI service assignment. Alerts hit the right team.
Why it fails: Global scope = broken cross-scope calls, upgrade brittleness, permission chaos.
Do this instead: Scoped applications for orchestration. Explicit cross-scope contracts. Upgrade-safe.
Populate and maintain a trusted CMDB automatically — servers, applications, network, storage.
Map your top-20 business services to infrastructure for real impact analysis.
Cut 80–90% of alert noise via correlation, deduplication, and enrichment.
Automate password resets, VM provisioning, disk-space cleanup — reduce toil.
Discover, tag, and govern AWS + Azure + GCP from one console.
Bring Splunk + Datadog + Dynatrace + SolarWinds events into a unified operational view.
Yes — Service Mapping consumes Discovery data to build application dependency maps. They're typically implemented together, but Discovery first.
Depends on network topology, discovery volume, and security zones. Small environments: 2 (HA pair). Mid: 4–8. Large / segmented: 10+. We size this in architecture.
Yes — connectors for Splunk, Datadog, Dynatrace, SolarWinds, Nagios, PRTG, Prometheus, and custom REST integrations for anything else.
Well-tuned Event Management routinely reduces raw alert volume 80–90% through correlation, deduplication, and enrichment — while raising the signal quality of what does become an incident.
No — it augments them. Native tools are best for cloud-specific optimization; ITOM adds cross-cloud governance, ITSM integration, and provisioning-via-catalog.
Sometimes yes, sometimes no. For ServiceNow-adjacent automation, Flow Designer + IntegrationHub is powerful. For deep DevOps automation (Ansible, Terraform, custom scripts), we integrate rather than replace.
Reach out — we get back within 1 business day.
