A system for discovering services includes a storage device and a processor. The storage device is configured to store a catalog of software installed packages. A processor is configured to scan a file system to identify configuration files associated with one or more packages found in the catalog of software installed packages; identify a subset of configuration files associated with executing processes by finding references to a configuration file in active processor memory and placing the configuration file in the subset of configuration files; and verify that a network port associated with an executing process corresponds to a designated network port as indicated in the configuration file associated with the executing process.