Discovery Sources - how to get information which source populated CI fields?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-16-2022 03:02 AM - edited 10-16-2022 03:05 AM
Hi,
I have multiple discovery sources integrated.
I can see in Security Operations>Discovered Items some payloads for matched hardware, but it seems not every information that was populated is in those payloads. Is this data stored somewhere else?
How to get information which source populated particular CI fields?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-16-2022 03:19 AM
Hi @Wojciech Werysz ,
It depends on how the sources are updating the CMDB. But have a look at Multisource CMDB. It's a great function to keep track of multiple sources. At least the ones using IRE.
Regards,
Niklas
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-16-2022 03:53 AM - edited 10-16-2022 03:54 AM
Thanks, I am using this option and it shows some data for matched CIs. Do you have any idea how to get information about unmatched CIs? Is only the payload in Discovered Items the form where I can find it?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-16-2022 04:19 AM
Yes, if there is a problem with classification then you need to look into the discovery logs to find the cause. In the case of information not being populated by the patterns then look into the Discovery Pattern log.
Regards,
Niklas
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-16-2022 04:44 AM
I will try to figure it out, thanks.
Do you know is there similar information set about imported vulnerabilities data as for CI information in "Multisource Data Preview"?
