Filtering the oldest data from SGC Tanium ... and IHE usage

[Sebastien7]

Hi Community,

In the case of SGC Tanium usage, Tanium provide the last 90 days data.
We can found in some cases, several records for the same servers.
We want to filter the oldest records to prevent flip-flap on Cis records.
We installed the IntegrationHUB ETL (IHE).

At the beginning, i thinked to modify the SGC Tanium data treatment via IHE :

• create a custom field via "prepare source data for mapping" to validate via an edit/transform that the "last_seen_at" date is oldiest thant a value (48 hours for example) and push a true/false value on the custom attributs
• apply a filter on the following step "Select CMDB Classes to Map Source Data" to exclude the data

But i found that we can't change, add or delete (inactivate only) new filter conditions.
The only way seems to create a new map source and deactive the previous.
That doesn't seem very flexible.

Do you know a way (the more standard possible) to change a filter on a basic class ?
Do you known if an idea have been created on this ?

In the meantime, we are moving towards a business rule on the [sn_tanium_integ_sg_tanium_import].
It's not the more effecticient way from my point of view, but pending more user-friendly management via the IntegrationHub ETL interface...

Thks

[pr8172510]

Hi @Sebastien7,

 the OOTB Map Source and its filter conditions are not intended to be modified directly. This is to keep the connector upgrade-safe.

If you need additional filtering (for example, excluding records where last_seen_at is older than 48 hours), the supported approach is to

• Create a custom Map Source based on the OOTB one.

• Apply your custom filter or transformation in the custom Map Source.

• Disable the OOTB Map Source instead of modifying it.

Using a Business Rule on the import table will work as a workaround, but it is generally less preferred because it processes records after import rather than filtering them within the ETL pipeline.

If CI "flip-flopping" is the primary concern, also review

• IRE Identification Rules

• Reconciliation Rules

• Data Refresh Rules (where applicable)

creating a custom Map Source is the recommended approach when additional filtering is required

[Sebastien7]

Hi,

Thanks for the feedback.

That is exactly what I described earlier in different manner (I didn't go into detail about IRE rules, reconciliation rules, etc., but they were indeed checked).

I can understand not being able to modify an OOB source map.

However, it is also impossible to do so with a 100% custom integration.

B.R.