question Re: Identification rule not working in CMDB forum

Identification rule not working

sry — Wed, 28 May 2025 10:44:17 GMT

Hi, we are working on Armis-ServiceNow integration. we have observed an issue during Identification.

1) we import a Server CI into cmdb.

2) we change mac_address manually.

3) we import the same server CI into cmdb with original mac_address.

During the 3rd step the system is no updating the mac_address as it supposed to over write the manual change.

This issue is not reflecting on computer class CIs. the identification working on computer class but not on server class. both computer and server have the same Identification rules. please help us why the server CI is not identified by IRE rules.

please help us.

Thanks,

Sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 14:11:37 GMT

This is not an issue.
ServiceNow has configured the cmdb_ci_network_adapter table to fetch and store the MAC Address for different CI's. (In your case it is Server CI). If you open cmdb_ci_network_adapter table and search with your Server CI you will find the MAC Address there. This is because a device can have multiple MAC Address and CMDB Server table only has one field to store one value. Also, there is no pattern created by ServiceNow to update MAC Address in the CMDB Server table. To validate this, you can Retrieve the Payload from input ECC queue from HorizontalDiscoveryProbe into Pattern Designer against your Server IP or directly run the Debug against your Server IP and you will not see MAC Address in the payload that is returned from your MID Server.
If you wish to update the MAC Address into Server Table then you need to create custom pattern extending the Original Pattern and then set the parameter in the CMDB Server table. (DO NOT MODIFY THE ORIGINAL PATTERN. IT IS NOT RECOMMENDED).

How to create custom patter? See docs below. You can take example reference from below docs or open one of the OOB Pattern libraries and mimic for your requirement.
Example of creating an application pattern

Hope this helps.

Regards,
Vikas K

Re: Identification rule not working

sry — Wed, 28 May 2025 14:14:24 GMT

Hi Vikas, thank you for the prompt reply.

we are not doing discovery, it is SGC Armis integration. we have scheduled job to load the data from Armis instance (thirdparty application). The data goes through Robust transform map. i am not sure it is an issue of cmdb_ci_network_adapter.

Thanks,

Sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 14:50:54 GMT

Ah, I see!
I jumped the gun.
Well in that scenario, are you not able to see the payload received from SGC?
Before data gets transformed you can see that in the import set table. Are you not able to see the Import Set logs?
If you're getting the required value from Armis SGC, have you configured reconciliation rule to pick the data from respective import set? This is set to none by default, unless you have configured it and if more than one what is the order and precedence.

Re: Identification rule not working

sry — Wed, 28 May 2025 14:49:51 GMT

Hi Vikas, yes we can see the payload. one of them labeled API_DATA, and other field is DATA. i am not sure which one i should consider. i don't know what to do from the payload.

Thanks,

Sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 15:35:23 GMT

Open those payload records to analyze below steps.

1) If you have received the data from Armis, then you need to locate the import set record and check the logs for number of attributes received through the SGC. See if the log shows for MAC Address attribute targetting to mac_address field of CMDB Server table.
2) If you see the MAC Address in the import logs then check the transform map that transforms the data into Target Server table whether the field for MAC Address is mapped or not. If it is mapped and still data is not getting updated then you need to adjust the mapping into transform map.
3) If you have not received the data from Armis at all then you need to configure the attribute for MAC Address.

If none of the above option works then you need to contact customer service for Armis. ServiceNow won't support this app. Contact is available in the Store.

Re: Identification rule not working

sry — Wed, 28 May 2025 15:56:24 GMT

Hi Vikas,

1) we do see mac_address in the payload and it is target to hardware table.

2) i see mac_address is in the import logs. i checked transform map that transforms into hardware table.

3) we are receiving the data from Armis.

my point is even though data coming from Armis, servicenow is responsible for IRE rules right! so the Identification part should be working irrespective of Discovery source.

Thanks,

sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 15:56:43 GMT

Found this docs online for Armis Integration. In the last few pages it is documented on how to manipulate the incoming data from Armis and set in the CMDB tables. Hope this will be of some help to figure out how this SGC is configured and where you can adjust the type and attribute configurations.
You can go through this to understand where to look for required attribute
https://www.scribd.com/document/639804754/Armis-Service-Graph-Connector-Installation-Guide-1-1

Let me know if it worked.

Re: Identification rule not working

VikMach — Wed, 28 May 2025 16:30:13 GMT

On your point about - "my point is even though data coming from Armis, servicenow is responsible for IRE rules right! so the Identification part should be working irrespective of Discovery source."

Answer - I just checked the Script Include called "CMDBDynamicIREProcessor". This script does the dynamic IRE processing. As you see in the snip from Script Include, ServiceNow has not added mac_address in the cmdb_ci_win_server table. If you search the field name mac_address in the script you will see that it it matched in cmdb_ci_network_adapter table. (This is what I commented in the first reply). IRE is same for all sources, whether you use SGC or Discovery. It is just that reconciliation adds another layer of filter to allow or reject certain transformation after identification stage. Please check how many sources your instance is configured to pull the data into CMDB Server table. "If" it is more than one, then decide which can update what. If it is not configured at all then, ensure you select the right "reconciliation" source for data mapping into CMDB Server Table. I hope it helps to understand the stages.

P.S - As you mentioned mac_address is pointing to hardware table and not to the network adapter or Server table, so I don't think IRE will work automatically to fetch and set the attribute in the CMDB Server table. You need to manually adjust the mapping based on how SGC is configured.

Re: Identification rule not working

sry — Wed, 28 May 2025 17:01:15 GMT

Hi Vikas, thank you for the reply.

we see there are Reconciliation rules on server class. one of them i have created with highest priority for "Armis" discovery source.

thank you for sharing the installation document.

Thanks,

Sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 17:12:41 GMT

Ok, if you have reconciliation rule for Server class then did you check if all attributes are mapped or only few selected ones?
Also, is your import set table picking mac_address value for Server class? Is it mapped to Server class?

Re: Identification rule not working

sry — Wed, 28 May 2025 17:36:34 GMT

Vikas, reconciliation rule is set for ALL the attributes with condition as "createdby=sgcarmis" and priority 10, discovery source is SGArmis.

import set is picking mac_address. it is mapped to hardware class.

thanks,

sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 18:11:47 GMT

Then why not simply create a business rule to copy the MAC Address from hardware table to the respective Server table?
When record is created in hardware table it sets the Model Category to a respective Model Category. Let's call it "Windows Server". When the record gets created in the Hardware (alm_hardware) table, the respective CI Class will create a CI in the cmdb_ci_win_server table.
You can simple create a Business Rule on alm_hardware table to copy the MAC Address from Hardware table to cmdb_ci_win_server table.

Re: Identification rule not working

sry — Wed, 28 May 2025 18:20:42 GMT

Hi Vikas, issue is even though we are getting mac_address its not updating it on "server" class devices. without getting mac_address into cmdb_ci_hardware table we cant map it to "server" class.

thanks,

sry

Re: Identification rule not working

VikMach — Wed, 28 May 2025 18:31:36 GMT

Ok, in that scenario you need to work on your Transform Map to set the value to the correct table.

Re: Identification rule not working

VikMach — Thu, 29 May 2025 06:48:35 GMT

I just came to know that MAC Address is getting saved in a different custom related list that is created via Armis app itself. Could you check this related list if it is displaying MAC Address?

Re: Identification rule not working

sry — Thu, 29 May 2025 07:18:11 GMT

Hi Vikas, yes we do have "additional information". but i don't see mac_address field in additional information (it is referencing CI). when an armis device is created in CMDB, integration will add "Additional information", "OT Device details". Both reference the actual CI record.

our issue nothing to do with "additional information" or "OT device details".

I have tested "identification simulation" with mac_address. system able to find the "CI" matching "Name," but it's not updating mac_address.

Thanks,

Sry