Robust Import Set Transformers - intune

[JvS001]

Hello, when you implement the Service Graph Connector for Intune (or also some other SGC, like Defender). The installed and used Robust Import Set Transformers have a "Transformer Definition" where you have the option to add a 'Before" script to use as a filter. Servicenow even already added an example to use. This pre-defined script provided by SN itself (fully 're-marked out', so it does not run), gives an opportunity to filter Machines based on the name. The example literally says:

"// Skip all payloads which have a computer starting with name as 'TEST-' //"

However if I break down the script a try to run it, it does not filter anything. Anybody an idea here?

My script (ES12 is turned on):

(function(input, runId) {
    for (var i = 0; i < input.length; i++) {
        // Skip all payloads which have a computer starting with name as 'TEST-'
        if (!isComputerNameValid(input[i].payload)) {
            input[i].status = 'SKIPPED';
            input[i].reason = 'Skipping IRE processing of this payload.';
        } else {
            // Add optional modifications here
            // Example: Add relationships, modify descriptions, etc.
        }
    }
})(input, runId);

function isComputerNameValid(payload) {
    for (var i = 0; i < payload.items.length; i++) {
        if (payload.items[i].className === 'cmdb_ci_computer') {
            let name = payload.items[i].values?.deviceName || '';
            if (name.startsWith('TEST-')) {
                return false;
            }
        }
    }
    return true;
}

:

[stevevandermeer · Accepted solution]

Hi, 

Can you be sure the script is matching the payload coming from Intune/Defender ?

Check the Payload Structure
The payload structure you’re assuming (payload.items[i].values.deviceName) may not match the actual structure of what’s coming in.

The correct field might not be deviceName — it might be name, hostName, or something else depending on the source system and how the data is mapped.

Try and use gs.info(JSON.stringify(payload)); temporarily to check the payload and ensure it's matching the script.

[goutham10]

Hi  @stevevandermeer ,

I'm using similar use case for sg connector for crowdstrike to filter certain CI's with name starts with IP and AKS, but the filter is not working, not abel to check the logs to debug the issue too.

below is the code used in before script field in robust transform defintion,

(function (input, runId) {
for (var i = 0; i < input.length; i++) {
if (!isServerNameValid(input[i].payload)) {
input[i].status = 'SKIPPED';
input[i].reason = 'Skipping IRE: Server CI name starts with IP- or AKS-';
}
}
})(input, runId);

function isServerNameValid(payload) {
for (var i = 0; i < payload.items.length; i++) {
if (payload.items[i].class_name === 'cmdb_ci_linux_server') {
let name = payload.items[i].values?.hostname || '';
if (name.startsWith('IP-') || name.startsWith('AKS')) {
return false;
}
}
}
return true;
}

[JvS001]

@stevevandermeer , thanks, that was it. Not 'deviceName' from the sourceTable, with 'name' (from mapped fields) it works...

[goutham10]

@JvS001 can you please help with this issue, I'm also trying same method but it's not filtering