Discovery Sources - how to get information which source populated CI fields?

[Wojciech Werysz]

Hi,

I have multiple discovery sources integrated. 

I can see in Security Operations>Discovered Items some payloads for matched hardware, but it seems not every information that was populated is in those payloads. Is this data stored somewhere else?

How to get information which source populated particular CI fields?

[Niklas Peterson]

Hi @Wojciech Werysz ,

It depends on how the sources are updating the CMDB. But have a look at Multisource CMDB. It's a great function to keep track of multiple sources. At least the ones using IRE.

https://docs.servicenow.com/bundle/tokyo-servicenow-platform/page/product/configuration-management/c... 

Regards,
Niklas

[Wojciech Werysz]

Thanks, I am using this option and it shows some data for matched CIs. Do you have any idea how to get information about unmatched CIs? Is only the payload in Discovered Items the form where I can find it?

[Niklas Peterson]

Yes, if there is a problem with classification then you need to look into the discovery logs to find the cause. In the case of information not being populated by the patterns then look into the Discovery Pattern log.

Regards,
Niklas

[Wojciech Werysz]

I will try to figure it out, thanks.

Do you know is there similar information set about imported vulnerabilities data as for CI information in "Multisource Data Preview"?