Vulnerable Item CI lookup Rule

[Mike_R]

Hello, 

We're having some difficulty with how the Vulnerability Response module chooses CI. 

Say our cmdb looks like this:

Name	Class
ws-servera	Windows Server
ws-servera	Virtual Machine Instance
ws-servera	Storage Volume

When the VI is created it should match on Windows Server, but instead we're getting a lot of Virtual Machine Instance, DNS Name, and other matches. What's the best/cleanest way to reconcile without loosing historic data?

[Mike_R]

Also, in some cases, it shows up in sn_sec_cmn_src_ci twice, with the two different CI classes

[Chris McDevitt · Accepted solution]

Mike,

To fix this going forward, you will need to tell it to 'ignore' the classes you do not want it to match against.

https://docs.servicenow.com/bundle/orlando-security-management/page/product/security-operations-comm...

Next, you need to know that once an item is "matched" and a record is placed in the Discovered Items module, that match will be used gain. Long story short deletes the incorrect march from the Discovered Items module after using the Ignore CI Class System Property.

(This is different VR v9 vs. v10)

"What's the best/cleanest way to reconcile without losing historical data?"

I am going to assume that this is already in production?

If not you need to delete the VIT, VID (v10), M2M, Vul, and SDI records and reload.

If you already have this in production, you have a bit more of a challenge.

This is what I would do:

1. Look at the VIT and get the 'CI name' and test to see if it is in a class you do not want. Use the 'CI name' to ONLY look in the class(s) you want it to match against and update the VIT.

2. You will need to return the assignment rules (v9 you will need to script, v10 is not built-in)

3. If the underlying VIT support team is now different than the Vul Grp you will need to update the Vul Grp Assignment Group from the VIT Assignment Group. 

Assumptions

1. You VGR had Assignment Group pointing to the VIT
2. That the underlying VIT does not change the way, the VGR would have grouped them.

Go ahead and mark this as helpful or Correct!

[Mike_R]

Thank you, this is helpful. And yes, this is in production

Regarding this:

"Next, you need to know that once an item is "matched" and a record is placed in the Discovered Items module, that match will be used gain. Long story short deletes the incorrect march from the Discovered Items module after using the Ignore CI Class System Property"

>> What happens when I delete the incorrect match from the Discovered Items Module? There are VIT tied to the incorrect match, and I cannot change the CI on those VIT because the VITs are already closed.

[Mike_R]

Also we cannot delete those records