You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models) on discovered application records.

Reapplying a lookup rule

You can "Reapply Lookup Rules" for selected or filtered items in the discovered applications table.

If no filter is applied, the reapply option is disabled. After reapplying, users can receive a background job URL or an error message if the integration is running.

To reapply the rules to existing discovered applications, navigate to All > Security Operations > CMDB > Lookup Rules.
Note: Starting with v25.0.3 of Application Vulnerability Response, a new auto-close rule 'CI Decommissioned' is introduced to close the vulnerable items and detections related to decommissioned CIs.

Setting the lookup target

By default, the sn_vul.use_product_model system property is activated (set to true). Depending on how the system property is set on the CI lookup rule records, discovered application records are updated in the following manner:
  • If the Value field is set to true, product model is the lookup target for CI Lookup rules and discovered applications are updated with the product models.
  • If the Value field is set to false, Configuration item (scanned apps) is the lookup target and discovered applications are updated with the Configuration items (scanned applications).
To modify the sn_vul.use_product_model system property so configuration items are used as the target:
  1. As a user with the sn_vul.app_sec_manager role, navigate to All > System Properties > All
  2. Locate sn_vul.use_product_model.
  3. Open the record.
  4. Set the Type field to false.
  5. Select Update.
If you reset this system property, you must modify your rules so the lookup targets match the system property setting. For example, if you reset the system property so you are using the configuration item as your target, locate the rules that have the Lookup target as Configuration item.
  1. Select the Active check box for these rules and select Update.
  2. Locate the rules that use Product model as the target and deactivate them by deselecting the Active check box and selecting Update.

If you are creating a new lookup rule, you set the Lookup target for the rule on the rule form. See Create a CI lookup rule for more information.