Tenable Scan

[Tyler36]

The tenable scan is running and bringing in new CI, when the CI come in the IP address is automatically setting itself to the name where we want the domain name to set itself to the name. How do i switch this?

[jing3]

Hi Tyler

Check the CI lookup rules 

Make sure the one with the FQDN or HOSTNAME are evaluated first (have lowest sequence number)

see attached example

[andy_ojha · Accepted solution]

Hey there,

It looks like the the Transform Map, delivered in the Tenable IO for Assets app - uses NetBIOS as the first preference for setting the CI's <Name> (if the asset coming in has a valid NetBIOS value - i.e. not empty)...

From your screenshot, it appears that for that particular CI -> the NetBIOS was actually set to the IP address value as well.

You may want to reach out to Tenable (developers of the Tenable IO for Asset Import App) - to see how they would recommend moving forward:

1) Adjust the Transform Map script, to include more filtering criteria other than (NetBIOS is not empty)
2) Adjust the Transform Map script, to use a different order for NetBIOS vs DNS Name / FQDN for setting the CI Name

3) Validating that Tenable is setup appropriately, and that the IP Address in the examples you have, are expected to be present in the NetBIOS value

Reference - Tenable IO for Assets -> CI Transform Map Script