CI Lookup Rules

tapasvi · ‎12-14-2020

Hi Folks,

I am troubleshooting an issue where in i need to understand the CI mapping rules for VM Rapid & data import.

Issue - Rapid7 (Intsights VM) has scanned a asset with URL - xyz.com however when the VI got created it was created with IP address, Shouldn't it create the VI with URL name in CI field?

Do we have 1-1 mapping for CI under CI mapping rules or is it 1-many.

Example: If an Asset is scanned in Rapid7 with IP address then will it only search its match in the CMDB IP class or will it do a complete search in CMDB table.

I am assuming that even if i have 1 attribute (IP or FQDN or MAC or Hostname) in the scanned source data it should populate the related CI under VI table configuration field.

SM6 · ‎06-01-2021

Example:

Case1: I have CI's which has HOST Name that matches FDQN. But the actual name of the CI is different from the HOST Name (All these are server class). Foe these kind of CI's I was writing the code

  cmdbci = new GlideRecord("cmdb_ci_server");
    cmdbci.addQuery("host_name", "IN", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

Case2: Tenable Asset with FQDN is with the Domain name that is FQDN.domain.xx.xx. So to validate this I have add these following lines.

 cmdbci = new GlideRecord("cmdb_ci_server");
    cmdbci.addQuery("host_name", 'STARTSWITH', sourceValue + ".");
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

"Now the validation has to occur from the two sections of the code which is where they're failing." - Can you please tell me where is the code failing and how to I rewrite this to validate it without failing. But I need those exact conditions.

I have also tried by separating them into individual Lookup rules. Still not use.

Thank you.

SM6 · ‎06-02-2021

Hi Chris, Any updates on how do I fix the Lookup Rule?

Chris McDevitt · ‎06-02-2021

I assume that you are matching on nothing?

if so....

/*

Case1: I have CI's which has HOST Name that matches FDQN.

But the actual name of the CI is different from the HOST Name

(All these are server class).

(CI) Name Host name FQDN

abc_different abc abc.foo.com

*/

//Example 1

cmdbci = new GlideRecord("cmdb_ci_server");

cmdbci.addQuery("fqdn", sourceValue); //abc.foo.com

//Example 2 (This might fix your Case2 also)

//Get host name from fqdn

var host_name = sourceValue.split('.');

sourceValue = host_name[0];

cmdbci = new GlideRecord("cmdb_ci_server");

cmdbci.addQuery("host_name", sourceValue); //abc

//Example 3

var host_name = sourceValue.split('.');

sourceValue = host_name[0];

cmdbci = new GlideRecord("cmdb_ci_server");

cmdbci.addQuery("name", sourceValue); //abc -> for hosts that have the same host name as CI Name

SM6 · ‎06-02-2021

Hi Chis. Thank you so much for all the help and support. Here is how I added the code that you provided.

List of Active Lookup rules in sequential order.

I split the FQDN codes into 2 Rules.

Rule: FQDN/NAME

(function process(rule, sourceValue, sourcePayload) {
    var sourceField = {};
    var ignore = global.SecProperty.getProperty("sn_sec_cmn.ignoreCIClass", "");
    sourceField[rule.source_field] = sourceValue;

    var cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("fqdn", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();
	
	 cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("ref_cmdb_ci_server.host_name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    return null;
})(rule, sourceValue, sourcePayload);

Rule 2: FQDN/HOST NAME

(function process(rule, sourceValue, sourcePayload) {
    var sourceField = {};
    var ignore = global.SecProperty.getProperty("sn_sec_cmn.ignoreCIClass", "");
    sourceField[rule.source_field] = sourceValue;

    var host_name = sourceValue.split('.');
    sourceValue = host_name[0];

    var cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("fqdn", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();
	
	cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("ref_cmdb_ci_server.host_name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    return null;
})(rule, sourceValue, sourcePayload);

Rule 3: NETBIOS/NAME

(function process(rule, sourceValue, sourcePayload) {
    var sourceField = {};
    var ignore = global.SecProperty.getProperty("sn_sec_cmn.ignoreCIClass", "");
    sourceField[rule.source_field] = sourceValue;
    //var sourceVal = sourceValue.split("\\")[1];
    var netbios_name = sourceValue.split('\\'); // domain\host
    if (netbios_name.length == 2) {
        sourceValue = netbios_name[1];
    }

    var cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    cmdbci = new GlideRecord("cmdb_ci");
    cmdbci.addQuery("ref_cmdb_ci_server.host_name", sourceValue);
    if (!gs.nil(ignore))
        cmdbci.addQuery('sys_class_name', 'NOT IN', ignore);
    cmdbci.query();

    cmdbci = _queryMatch(cmdbci, rule, sourceField);

    if (cmdbci)
        return cmdbci.getUniqueValue();

    return null;
})(rule, sourceValue, sourcePayload);

jstrickland · ‎04-07-2025

When you say "the first rule to match wins", does that mean it evaluates the script.. or the source + source field + conditions?