Hi there,
We are in Vancouver release and we are using the latest version of the Vulnerability Response plugins. We have an integration with Veracode configured and we are importing Veracode SASTs scans. The OOTB Lookup rule ("Application Name") which is tryig to lookup for CI using Porduct Model has been disabled and we have replaced it with our own Lookup rule. Our lookup rule is based on existing Application Services CIs. We have also set the System Property "sn_vul.use_product_mode" to false as per Docs here https://docs.servicenow.com/bundle/vancouver-security-management/page/product/vulnerability-app-vuln.... We can see that the Lookup rule is called (we can see it in the logs) we also can see that our code is finding the correct CI and the Lookup rule is returning the sys_id. However when the Discovered Application and the Application Vulnerability Item is created the CI is set to blank.
We also can verify that the Discovered Application has the correct Lookup rule assigned to it however the CI is still blank. As a matter of fact we updated the Lookup rule to return one hardcoded sys_id for a specific CI but still the AVIs and the Discovered Applications CI is set to blank. Any comments will be appreciated.
Many thanks
Rahman
