How to run "Reapply CI lookup Rule" to a specific VIT?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-23-2022 06:30 AM
Hi,
I am facing a scenario in which 150 VIT's were associated to one Discovered item and some of the VIT record's "Configuration item" field and "DNS name" field under initial detection section is different.
I am referring to the below issue
How Initial detection DNS name and Configuration item in Vulnerable item is different ?
Reason: This is because the CI has been updated through Discovery.
Solution: Run "Reapply CI Lookup Rule" UI action for the associated Discovered Item
Issue Faced: Every time is the manually work to identify the CI mismatch issue in the VIT and find the appropriate Discovered item to Run "Reapply CI Lookup Rule" UI action.
My Requirement: A scheduled job has to be created that finds the VIT with CI Mismatch issue and Run "Reapply CI Lookup Rule" UI action only for the specific affected record (VIT), Not to the entire VIT associated with Discovered item.
I have found that the below code helps to create a background job to reapply CI lookup rule.
var job = util.createBackgroundJob('sn_sec_cmn_src_ci', 'Reconcile unmatched discovered items', JSON.stringify(discItems), "", "", "sn_sec_cmn.reconcile_unmatched_discovered_items");
sn_sec_cmn_src_ci - Table name of Discovered Item
Reconcile unmatched discovered items - Job Type
JSON.stringify(discItems) - Contains the sysid of selected Discovered item
sn_sec_cmn.reconcile_unmatched_discovered_items - Job configuration ID
How can I modify the parameter or include new parameter to execute the "Reapply CI Lookup rule" only for affected VIT record and not for all VIT associated with the Discovered Item.
Please help!!!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-24-2022 03:10 PM
A Discovered item is always associated to only one CI. That being the case, how would you expect to update only one VIT associated with that Discovered item? If you update the CI associated with the Discovered item then all VITs associated with it will automatically change.
If you want to change only one CI on it then set the CI field manually to the CI you choose.