Computers from SG-Intune have lowercase names

MarLoi · 3 weeks ago

Hello!

One of the Service Graph Connectors used in our instance is SG-Intune.
This year, we have noticed that most computer names in the [cmdb_ci_computer] table ingested by SG-Intune are in lowercase, even when the corresponding values in the deviceName field of the import table contain uppercase letters.

However, there are also some computers for which the correct capitalization is preserved.

We investigated the glide.discovery.hostname.case system property, but it is set to "Lower case" and was last updated by ServiceNow in 2011.

It doesn't explain why some computers have the correct capitalization, instead of lowercase.

Through the IntegrationHub ETL, we also looked into the associated RTE Entity Script Operation [sys_rte_eb_script_operation], Script Operation - u_devicename, which transforms the import value into the value of the computer name field.

However, this was last updated by ServiceNow in 2024.

Are there any other possible leads we could investigate that might explain this inconsistency?

For example, could there be another conversion, normalization, or processing step taking place between the import table and the cmdb_ci_computer record that we should look into?

Thanks in advance for your help!

#discovery #sgc #intune #ci #computer #cmdb #ingestion

drbob · 3 weeks ago

Is anything else updating these CIs ?
If you change the hostname (make some characters upper case) are they reset by the next import ?

Does the audit log (history) on the CI show the update and was it done by the user running the import ?

That will confirm it _is_ the import that is at fault not any other process (though it could still be some business rule that runs as a result of the import or other process rather then the import itself).

If it's confirmed to be the import process (whether the ETL or a business rule or something else) compare one of the ones that got set to lowercase against one that didn't - any significant differences (anything that in context you recognize someone might have written a business rule for, for example ...or something more obvious like it ended up in a different class). Any workflow or flow firing against it ?

Kiruthiga Kumar · 2 weeks ago

We are also facing the same issue. Could anyone please suggest the fix for it?

matrixtushar · 2 weeks ago

If you want to make any alterations to the hostname or field values on data fetched by a Service Graph Connector, then i would suggest you to do the following:

1. Look for the Data Source

2. On the Data Source, find the related Robust Transformer / Transformer in the related list.

3. Go to the Robust Transformer Definition and Enable the "Execute Before Script"

4. Write the script that normalizes the data before its sent into the IRE through that transformer.

We have a lot of bogus machine serial number like - , --, 000000, To be filled by OEM etc... and following is a way we are achieving the normalization by finding such a serial number and replacing it with the hostname itself.

(function(input, runId) {

for (var i = 0; i < input.length; i++) {

var payload = input[i].payload;

if (!payload || !payload.items)

continue;

for (var j = 0; j < payload.items.length; j++) {

var item = payload.items[j];

if (item.className != 'cmdb_ci_computer')

continue;

if (!item.values)

continue;

var values = item.values;

var serial = (values.serial_number || '').toString().trim();

var normalized = serial.toLowerCase();

var isInvalid =

normalized === '' ||

normalized === '-' ||

normalized === '_' ||

normalized === 'default string' ||

normalized.indexOf('system serial number') > -1 ||

normalized.indexOf('int2ifc59t001p') > -1 ||

/o\.?e\.?m/i.test(normalized) ||

/^[0]+$/.test(normalized);

if (!isInvalid)

continue;

// Prefer the CI name

var newSerial = (values.name || '').toString().trim();

// If name is unavailable, try the related CrowdStrike hostname

if (!newSerial && item.related && item.related.length > 0) {

var relatedValues = item.related[0].values || {};

newSerial = (relatedValues.hostname || '').toString().trim();

}

if (newSerial) {

gs.info("[CrowdStrike RTE] BEFORE : " + serial);

gs.info("[CrowdStrike RTE] NEW : " + newSerial);

item.values.serial_number = newSerial;

gs.info("[CrowdStrike RTE] AFTER : " + item.values.serial_number);

}

})(input, runId);

matrixtushar · 2 weeks ago

If you want to make any alterations to the hostname or field values on data fetched by a Service Graph Connector, then i would suggest you to do the following:

1. Look for the Data Source

2. On the Data Source, find the related Robust Transformer / Transformer in the related list.

3. Go to the Robust Transformer Definition and Enable the "Execute Before Script"

4. Write the script that normalizes the data before its sent into the IRE through that transformer.

We have a lot of bogus machine serial number like - , --, 000000, To be filled by OEM etc... and following is a way we are achieving the normalization by finding such a serial number and replacing it with the hostname itself.