HI @SnowedIn ,
I trust you are doing great.

Based on the documentation you mentioned (CI Lookup Rules for identifying configuration items from Vulnerability Response third-party vulnerabilities), it states that if a matched CI is one of the following: dscy_switchport, cmdb_ci_network_adapter, cmdb_ci_nic, or cmdb_ci_ip_address, the parent CI should be returned to avoid matching on low-level networking elements.

You mentioned that you reviewed the Out-of-the-Box (OOTB) CI Lookup Rule for the Mac Address and confirmed that it does return the parent CI ("cdmb_ci") for the Network Adapter CI. However, despite this, the Discovered Item record and all the VITs still have the Network Adapter set as the CI. Although the parent CI appears in the 'Other Matched CIs' field of the Discovered Item, it does not reflect as the CI for the VITs.

If I understand correctly, you are looking for a solution to change the CI for the VITs from the Network Adapter to the correct parent CI. It's puzzling because the script you've debugged and logged seems to be returning the correct parent CI sys_id, but the matched CI remains the Network Adapter.

Given that this is a built-in functionality (and even indicates that the parent CI should be returned for Network Adapters), it is indeed confusing