A computing system comprising: a database (500, 700) disposed within a computational instance of a remote network management platform, wherein the computational instance is associated with a managed network, wherein the managed network comprises software applications installed on computing devices; and a discovery application configured to: initiate discovery of the software applications within the managed network by probing the computing devices for applications configured to execute thereon; execute one or more predetermined discovery patterns in an attempt to classify a discovered application (600, 704) of the software applications; determine that the discovered application (600, 704) is unclassified after executing the one or more predetermined discovery patterns; in response to determining that the discovered application (600, 704) is unclassified, (i) generate a configuration item representing the discovered application (600, 704) without classification and (ii) select, from within a directory corresponding to the discovered application (600, 704), a characteristic file containing attributes of the discovered application (600, 704); provide the characteristic file to a machine learning, ML, classifier, wherein the ML classifier has been trained using a plurality of characteristic files (616, 622, 628) corresponding to different software applications (614, 620, 626) to classify the different software applications (614, 620, 626) among a plurality of predetermined categories (618, 624, 630); receive, from the ML classifier, a classification of the discovered application (600, 704); modify the configuration item to include the classification of the discovered application; and store, in the database (500, 700), the configuration item as modified. a database (500, 700) disposed within a computational instance of a remote network management platform, wherein the computational instance is associated with a managed network, wherein the managed network comprises software applications installed on computing devices; and a discovery application configured to: initiate discovery of the software applications within the managed network by probing the computing devices for applications configured to execute thereon; execute one or more predetermined discovery patterns in an attempt to classify a discovered application (600, 704) of the software applications; determine that the discovered application (600, 704) is unclassified after executing the one or more predetermined discovery patterns; in response to determining that the discovered application (600, 704) is unclassified, (i) generate a configuration item representing the discovered application (600, 704) without classification and (ii) select, from within a directory corresponding to the discovered application (600, 704), a characteristic file containing attributes of the discovered application (600, 704); provide the characteristic file to a machine learning, ML, classifier, wherein the ML classifier has been trained using a plurality of characteristic files (616, 622, 628) corresponding to different software applications (614, 620, 626) to classify the different software applications (614, 620, 626) among a plurality of predetermined categories (618, 624, 630); receive, from the ML classifier, a classification of the discovered application (600, 704); modify the configuration item to include the classification of the discovered application; and store, in the database (500, 700), the configuration item as modified. initiate discovery of the software applications within the managed network by probing the computing devices for applications configured to execute thereon; execute one or more predetermined discovery patterns in an attempt to classify a discovered application (600, 704) of the software applications; determine that the discovered application (600, 704) is unclassified after executing the one or more predetermined discovery patterns; in response to determining that the discovered application (600, 704) is unclassified, (i) generate a configuration item representing the discovered application (600, 704) without classification and (ii) select, from within a directory corresponding to the discovered application (600, 704), a characteristic file containing attributes of the discovered application (600, 704); provide the characteristic file to a machine learning, ML, classifier, wherein the ML classifier has been trained using a plurality of characteristic files (616, 622, 628) corresponding to different software applications (614, 620, 626) to classify the different software applications (614, 620, 626) among a plurality of predetermined categories (618, 624, 630); receive, from the ML classifier, a classification of the discovered application (600, 704); modify the configuration item to include the classification of the discovered application; and store, in the database (500, 700), the configuration item as modified.