An embodiment may involve a computational instance including persistent storage, the persistent storage containing representations of virtual machines previously discovered in a server cluster. The embodiment may also involve one or more processors configured to perform operations involving: (i) transmitting, to the server cluster, a request for an event log, the event log containing events related to virtual machines configured in the server cluster; (ii) receiving, from the server cluster, the event log; (iii) determining that the event log contains one or more significant events related to a particular virtual machine from virtual machines configured in the server cluster; (iv) performing a discovery pattern on the server cluster, wherein output from performing the discovery pattern includes a characterization of the particular virtual machine; and (v) causing an update to be written to the persistent storage, wherein the update includes the characterization of the particular virtual machine.