Austin Buono's ServiceNow Solutions
Austin Buono's ServiceNow Solutions
When any Vulnerability Response integration runs the imported vulnerabilities run against CI LookUp rules. Out of box (OOB) the CI LookUp rules are contained in table sn_sec_cmn_ci_lookup_rule and the code that is contained in each of the rules will determine which configuration item should be matched with the vulnerability or should an Unmatched CI (sn_sc_cmn_unmatched_ci) be created to be aligned to the vulnerability. Once a CI LookUp rule is matched to a Configuration item a record is created in table sn_sec_cmn_src_ci and going forward anytime that CI is imported via the Vulnerability Response integration the same configuration item will be aligned without the execution of the CI LookUp rules. Keep this in mind because when you reimport the Vulnerabilities the CI LookUp rules will NOT rerun if the CI has already been matched to a CI LookUp rule. This makes testing extremely difficult because if you want to make changes to a CI LookUp rule you are required to delete the matching record in table sn_sec_cmn_src_ci and then rerun the whole VIR integration which can be very time consuming. To work around this and enable fast testing you can navigate to this table sn_sec_cmn_src_ci and in the field 'Source Data' (source_data) will be a JSON payload. This JSON Payload represents the data that was imported from the integration. Copy the JSON Payload and you can us the function below in a background script to identify which CI LookUp rule will be matched with this inbound payload going forward this is critical/helpful because it will allow you quickly tweak your CI LookUp rules and then rerun the background script and identify if the correct outcome has been achieved because it will return the matched CI Lookup rule and the CI that it matched to.
Copyright © Austin Buono ServiceNow Solutions - All Rights Reserved.