Example of Assignment RuleS Script for Vulnerability Items

[Jason Stuart]

Good Afternoon,

               I am looking to see if anyone has an example of scripts used for Assignment Rules for Vulnerability Items?  This is for the Vulnerability Assignment Rules.

Basically what I am looking to do is, if the Configuration Item you are targeting does not have a support group assigned, walk up the tree until you come to a configuration item that does have the support group set - and use that.

Thanks,

Jason

[Sumedh Gajbhiye]

Hi @Chris McDevitt , do we need to add current.update() in assignment rule script to update the assignment rule? or just leave it like current.assignment_group = current.cmdb_ci.cmdb_ci.assignment_group;

[Chris McDevitt]

Hi,

You do not need current.update() for this to work.

You should consider returning a default assignment group if the one you are trying to reference via dot walking is empty.

Example:

https://gist.github.com/cmcdevitt/4ddfa24e38e0f8effb1c14b6dbd47d53

[Sumedh Gajbhiye]

Hi @Chris McDevitt, Thank you for the script. I have few other doubts, like below:

1) What if we do not provide the default assignment group in scripted assignment rules or its compulsory to provide the default assignment group when we are using scripted assignment group?

2) How does the fallback assignment rule work?

I am having one issue like, I have a scripted assignment rule called "Application-General" and a fallback assignment rule called "Qualys-fallback".

Qualys-fallback group assigns the assignment group called "Remediation owners".

From my scripted assignment rule via script, I am returning null when some conditions are not satisfied.

Now eventually, after complete assignment rules run, for a few VITs, the assignment group is updating as "Remediation Owners" and its assignment rule is updating as "Application-General".

Can you please let me know what could be the issue here?

[Jonathan Long]

I came across your thread and I was researching this very topic yesterday as well. Working with scripted assignment rules. The biggest help for me has been reviewing the "Assignment Rule Evaluation Process" found here: https://www.servicenow.com/docs/csh?topicname=vr-assignment-rules.html&version=latest

Originally, I thought the rules were each checked and if an assignment group was not "set" it would go on to next rule.  That was a mis-understanding on my part and after reading the process I now have a better understanding.

The doc states the lookup stops once an assignment rule condition is matched.  I believe that is why it's really important that the scripted rule always returns a group and must have logic to return a "default" group because no further lookup rules are evaluated. Ie there is no check that your scripted assignment rule set the assignment group or not....it matches that rules condition and stops any further rule evalulations.

The "fall back" rule is just the fact that you have some rule that is of the highest order (ie 9999) and the condition is broad or does not have a condition and so that if no other assignment rule conditions were matched it then hits that rule and assign the "default" group.

I will await Chris's reply on this topic to confirm these assumptions based on what I am reading in the docs. 

I believe the reason for the "mismtach" of an assignment rule vs. the assignement group set you'll find the other rule matched and set the group at one point, but maybe later you adjusted and the scripted rule which returned nothing does not "clear" an already set assignment group.  Best way to see all of this is just look at the history of assignment type, assignment group and assignment rule audit trail on the VIT record.  I am seeing similar results on my VITs as well, which stem from the fact I do not have a default group within the scripted logic.

So, with all of that said, I am updating my script with additional logic of returning a default group if nothing was found on my scripted lookup attempt and assure a group is used in that rule.

Hope this helps you in your endeavors, and Chris M. shout out for all of the wisdom you bring, if some of these clarifications or guidance could make it back into the product docs that would be awesome, I think the biggest ambiguity is clarification of setting the assignment group  depending on use of script, or for some reason folks bending towards thinking that the assignment group being empty that the rule evaluations continues!

Cheers!

[Chris McDevitt]

Hi,
Number one: For VR Assignment Rules, as you already know, they run in order: 100, 200, etc. Once the condition of a rule is met, no other rules are run. The rule that the condition is met is expected to return an assignment group. If no assignment group is returned, then that VIT is not assigned (i.e. an empty assignment group field), and the process starts all over again with the next VIT. If you go and look, you will see VITs that are not assigned, and if you do some backtracking, that is what you will see.

Number two: You should always have a very last rule (highest numerical order), a default / catch-all rule that makes the assignment to the VIT if none of your other rules match.

For your issue, it is hard to tell from this side of the screen. 😉
Have the rules been run before? I am going to *guess* that when you return a null, the script may fail on that cycle and possibly not finish by updating which rule was run. IDK... I would need to test through that to see what is going on.