Reformatting MAC Address in CI Lookup rules

[jslee102]

Having an issue with the MAC Address match for our Tenable and Microsoft TVM integrations.  As far as I can tell, our CMDB has a format of 0E1234ABD423 and the integrations are bringing them in as 0E:12:34:AB:D4:23.  Can anyone suggest code that I can use to reformat the value coming in before the query?

Here is an example of the Tenable IO Mac Address rule

// _queryMatch function checks if the query returns 0, 1 or more than 1 CI.
// it returns:
// null: if no CI found
// ci record: if a unique CI was found
// the first CI record found: if more than 1 CI was found and log a duplicate error message
// To avoid specific CI classes ,add the class names, comma separated, to the property sn_sec_cmn.ignoreCIClass
(function process(rule, sourceValue, sourcePayload) {
var sourceField = {};
var ignore = global.SecProperty.getProperty("sn_sec_cmn.ignoreCIClass", "");
sourceField[rule.source_field] = sourceValue;

var nic = new GlideRecord("cmdb_ci_network_adapter");
nic.addQuery("mac_address", "IN", sourceValue);
nic.query();

nic = _queryMatch(nic, rule, sourceField);

if (nic && nic.cmdb_ci)
return nic.cmdb_ci;

// If not found in the controllers, check the ci record itself
var cmdbci = new GlideRecord("cmdb_ci");
cmdbci.addQuery("mac_address", "IN", sourceValue);
if (!gs.nil(ignore))
cmdbci.addQuery('sys_class_name','NOT IN', ignore);
cmdbci.query();

cmdbci = _queryMatch(cmdbci, rule, sourceField);

if (cmdbci)
return cmdbci.getUniqueValue();

return null;
})(rule, sourceValue, sourcePayload);

I tried to add in a line before

sourceField[rule.source_field] = sourceValue;

to say sourceValue = replace (sourceValue,":","");

to hopefully remove the colons, but it appeared not to work when I reapplied rules on a device.  I may be misinterpreting how the query works or even how the replace works so any suggestions are welcome.

Thank you!

[piyushsain · Accepted solution]

Hi @jslee102 

After getting the 

sourceField[rule.source_field] = sourceValue;

convert the sourceValue into ServiceNow format

sourceField[rule.source_field] = sourceValue;
sourceValue = sourceValue.toString();
sourceValue = sourceValue.replaceAll(':','');

[SangeethaRam]

Hi @piyushsain 
I have a question, regarding executing ci lookup rules in background script.
How to test _queryMatch function.

Could you please help on this?