Hello @PurushothKumar 

The problem you've described, where a Vulnerable Item (VI) is incorrectly mapped to an IP Switch class instead of the correct Server class. This problem is very much rooted in the fundamental principles of CI Classification, Reclassification, and Identification, which are discussed in detail in the blog post Mastering CI Classification, Reclassification, and Deduplication in ServiceNow CMDB 

1 Weak or Ambiguous Identification Rules
As emphasized in discussions around CMDB health, Identification Rules are the bedrock of accurate CI management. These rules define how ServiceNow uniquely identifies a CI. For a server, this might involve attributes like its name, serial number, or a specific IP address. For a network switch, different attributes would be primary identifiers. If the identification rules for your IP Switch and Server classes are too similar, or if they rely on common, less unique attributes (like a single IP address), the IRE might incorrectly match the incoming vulnerability data to an existing IP Switch CI before it can correctly identify the Server CI. This can happen if the scanner provides limited data, and the IRE finds a match with an IP Switch first based on the available information.
2. Incorrect CI Classification

CI Classification is the act of placing a CI into its proper category within the CMDB hierarchy. Incorrect classification will prevent CIs from inheriting the proper properties and relationships. If the data gathered from the vulnerability scan is inadequate or deceptive, it could lead to the system incorrectly classifying the CI, or an existing CI could be incorrectly classified. The presence of a server being mapped to an IP Switch class suggests a rather large discrepancy in the initial classification of the asset as a server.

3. Stale Data and Deduplication Issues

While not necessarily the root cause, problems with CMDB Deduplication can contribute to this problem. If there are duplicate CIs for the same physical or virtual resource (such as two entries for the same server, or an outdated entry for an IP Switch with an IP address that is currently assigned to a server), the data from the vulnerability scan could inadvertently match against the wrong one. Proper deduplication will ensure that there is only one authoritative entry for a CI.

Remediation Strategy: A Step-by-Step Approach

1 Review Vulnerability Response CI Lookup Rules
2 Strengthen CMDB Identification Rules (IRE)
3 Remediate Incorrectly Mapped Vulnerable Items
4 Implement Reclassification Restriction Rules
5 Perform CMDB Deduplication

If you found this article useful, please mark it as Helpful. It helps others find the content more easily 👍