CI Lookup Rules for Tenable.sc?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-31-2022 10:39 AM
Hi,
I have CI lookup rules OOTB for Tenable.io (type Host Name, Tenable.io)
I want to create a CI lookup rule HOSTNAME and DNS for Tenable.sc. What type should I use, custom? Should it be the same script shown here?
- Labels:
-
Vulnerability Response

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-31-2022 11:00 AM
Yes, you can start by using this CI Lookup rule.
If incoming data does not provide you with Hostnames, then create a custom rule and transform the data to your needs.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-31-2022 11:05 AM
I just want to confirm that I can use the same script from ootb HOSTNAME Tenable.io and create a custom CI lookup rule for HOSTNAME for Tenable.sc?
The same I have to do for DNS Tenable.sc
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-31-2022 11:16 AM
I have checked Discovered items and there are no records that match this CI lookup rules.
I think I need to create a custom rule. So my question is where should I start creating a custom rule and what should the rule look like? Are there any examples?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-31-2022 01:46 PM
I see,
Yes, create a custom rule and COPY the closest script that you see as a starting point.
Example script:
https://gist.github.com/cmcdevitt/f587fd766df71e76f025047a65b9e580
I just loaded v16 and the CI Lookup Rule script got a bit complicated. So, my sample is old but still a good starting point.
If you need more examples let me know.
Also,
John just posted a good article:
https://community.servicenow.com/community?id=community_article&sys_id=38219f8ddb6ec510da1999ead396195a