How is the CI being created?

[harsavardha]

We have an integration user (sopaonly) with roles snc_internal and soap. This user is repeatedly creating duplicate CIs in the CMDB, specifically under the Network Adapter class.

I am trying to trace the source of this data population but haven’t been able to identify where it’s coming from. The discovery schedules and known integrations don’t point directly to this user, yet it continues to create the same CI records multiple times.

Has anyone encountered this issue before? How can I track down the exact source (e.g., script, integration, probe, or import set) that is creating these CIs through this user account?

[Nehal Dhuri]

Have you verified the discovery source field value on this CI? From there, you might find the source through which the CI was created.

[harsavardha]

Yes, the discovery source is empty/unknown and I could not find any business rules that are populating cmdb_ci_network_adapter,

manual creation is also out of picture