VR - Need to rerun CI Lookup Rules on LARGE subsection of Discovered Items

[rita_m]

Hi All!

We're using the Vulnerability Response and Vulnerability Response with Tenable Integration applications.

I was asked to create a new CI Lookup rule, and I've done so, and it passes all testing.

I have now been asked to re-apply the CI Lookup rules to about 35K discovered items.  Please note that this is DEFINITELY NOT ALL discovered items (it's about 20% of them), so we can't just use the "Apply Changes" button ui action at the top of the CI Lookup Rules list.

And 35K records is far too many to want to re-run the lookup rules 200-at-a-time by going to the Discovered Items list, selecting all 200 in list view there, and using the "Reapply CI Lookup Rules" list ui action.  

Does anyone know how to re-run the CI Lookup rules on a portion of the discovered items list based on a query in a background or fix-script?

Thanks!

-R

[Harish V · Accepted solution]

Hello R,

Here is the code. I cannot take credit for this. I got it from @Chris McDevitt 's GIT hub here - https://gist.github.com/cmcdevitt

Also, if you can tag your questions under Topic "New customers for Vulnerability response" instead of "scripting and coding" I think it gets good visibility. Cheers!

var re_run_arr = [];
var re_run_str = '';
var di = new GlideRecord('sn_sec_cmn_src_ci');
di.addEncodedQuery('number=SDI000000001318');//Identify Items to re run the rules
di.query();
while(di.next()){
    re_run_arr.push(di.getUniqueValue());//Collect an Array of sys_id
}
re_run_str = re_run_arr.join();
new sn_sec_cmn.CILookupUtil().reRunCILookupRules(re_run_str);//Re run the rules

Thanks,

Harish Viswanathan

[rita_m]

I don't see that topic in my list, so I can't add that.  (Let me know if you know how to add that topic to my list and I'll do so.)

But the code worked!  

Thank you so much!

-R