Does Discovered Items Classification rule runs every time the asset is updated?

[sath]

Hi,

We have created a Classification rule on Discovered Items that sets the classification type to External if the resource tag of discovered item(asset) contains 'External'. Does this rule runs only once or each time an asset is updated? Also if an asset gets classified as external but then we remove the resource tag ''External', does there need to be a rule to change it back to Internal?

[andy_ojha · Accepted solution]

Hey there ...

One thing to watch for when using Resource Tag -> that is a special type of field in ServiceNow, referred to as a GlideList field -> it stores a list of SYS_IDs .. and not the actual names of the Tags from the Scanners.  

The reason this is important to note, is that if we leverage the DI.Resource Tags in any of our logic / core configs - like Classification Rules, Assignment Rules, Reports - we need to make sure that the SYS_IDs persist between all of our ServiceNow Instances...   If you don't, the Resource Tag of "External" will have a different SYS_ID in each ServiceNow Instance - and the logic / core config won't work as you expect.   A way to handle this is to XML export out of the table 'sn_sec_cmn_host_tag` from the instance you are building on - and promote that forward to the rest of our instance(s) and up to PROD.

Baseline - the Classification type for the Discovered Item -> is simply set once and never changes.

I suspect you are asking though, what happens to a DI that does not have the Resource Tag containing, External?   In that case, you can make a fallback Classification Rule -> and infer, that it is "Internal" if it does not have the External Tag (use the Execution Order)