--- sourceDocument: Yokohama Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Creating CIs using the Identification and Reconciliation engine # Creating CIs using the Identification and Reconciliation engine {#ariaid-title1} Release version: Yokohama Updated July 31, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Creating CIs using the Identification and Reconciliation engine ServiceNow customers can create Configuration Items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation Engine (IRE) API. This approach prevents duplicate CIs and ensures that only authoritative data sources update CI attributes, enhancing data integrity within the CMDB. Show full answer Show less ## Using IRE for CI Creation If no matching CI is found in the Discovered Items list or CMDB, the system creates a CI in the Unmatched CI class (**snseccmnunmatchedci**). Starting with Vulnerability Response v24.0.6, any exceptions preventing CI creation are detailed in the Additional Information field to help diagnose and resolve issues. Between Vulnerability Response versions v12.2 and v18.0, unmatched assets are sent to IRE and placed into either the Unclassed Hardware or Incomplete IP Identified Device classes. From v18.0 onward, a new **Cloud Resource** class is also available for unmatched cloud assets, which can be configured for preferred categorization. ## CMDB CI Classes To utilize the new CI classes, customers must activate the **CMDB CI Class Models** plugin. Without this plugin, unmatched CIs default to the Unmatched CI class. The key CI classes include: * **Incomplete IP Identified Device (*cmdbciincompleteip*)**: For CIs created when only an IP address is available from scanner data. * **Unclassed Hardware (*cmdbciunclassedhardware*)**: For CIs created when host information includes hostname, IP, DNS, NETBIOS, or MAC address. Network adapter and IP address CIs are related if MAC and IP addresses are present. * **Cloud Resource (*cmdbcicmpresource*)** : For CIs created when a Cloud Resource ID is present in the scanner data. Note that if the scanner integration asset type is Hybrid and the system property *snseccmn.unmatchedcloudresourceenabled* is false, cloud resources are created as Unclassed Hardware instead. ## Additional Important Details When IRE is active, manual reclassification from discovered items is unsupported; the system automatically assigns unmatched CIs to the appropriate class. Exceptions during CI creation also cause CIs to be placed in the Unmatched CI class. ## Practical Benefits for ServiceNow Customers * Prevents duplicate and inconsistent CI entries in the CMDB by leveraging authoritative data sources. * Provides clear exception details to troubleshoot CI creation issues efficiently. * Supports categorization of unmatched assets into appropriate CI classes, improving asset management and visibility. * Enables handling of cloud resources distinctly from hardware assets, aiding cloud asset management. * Requires activation of the CMDB CI Class Models plugin to take full advantage of enhanced CI classification. You can create configuration items (CIs) in the Configuration Management Database (CMDB) using the Identification and Reconciliation engine (IRE) API. By using the IRE API to create CIs, you can prevent duplicate CIs from being created and you can reconcile CI attributes by allowing only authoritative data sources to write to CMDB. A CI class (table) is the original table name in the instance database. CMDB contains base system classes that store data about CIs. ## Using IRE for CI creation {#sem-ci-creation-using-IRE__section_q1r_1m5_lnb} If a matched CI isn't found either in the Discovered Items list or CMDB, a CI is created in the Unmatched CI class (`sn_sec_cmn_unmatched_ci`). For more information, see [Unmatched CIs](https://www.servicenow.com/docs/Wu~3w_Hes3fsKYc6Q4NpYw "Configuration items (CIs) are automatically matched to CIs in the Configuration Management Database (CMDB) when they are imported. By default, the Security Operations > CMDB > Discovered Items module lists those configuration items without a match."). Starting with v24.0.6 of Vulnerability Response, if IRE encounters exceptions that prevent the creation of CIs, the specifics of these exceptions are recorded in the Additional Information field. By examining the details in this field, you can determine the root cause and implement the necessary corrections to ensure the CI is successfully created. Starting with Vulnerability Response v12.2 to v18.0, if no match is found when the CI lookup rules are applied, the asset information is sent to IRE and a CI is created in one of the Unclassed Hardware and Incomplete IP Identified Device classes. Starting from Vulnerability Response v18.0, a new class, Cloud Resource is also included. For more information on how to configure the categorization of unmatched cloud resources into your preferred CI class, see [Updating CI class for unmatched cloud assets](https://www.servicenow.com/docs/wDDkyc6SQk0WcuzAxqA4Fw "Starting with Vulnerability Response v20.0, you can categorize the unmatched cloud assets from Qualys, Rapid7 and Tenable scanners into Unclassed Hardware by using the sn_sec_cmn.unmatched_cloud_resource_enabled system property."). ## CMDB CI classes {#sem-ci-creation-using-IRE__section_acq_czt_knb} Note: To use the new classes, activate the CMDB CI Class Models plugin. Otherwise, CIs are created in the Unmatched CI class. If the host that you imported from a third-party scanner can't be found in the Discovered Items list or CMDB, it's created in one of the following new CMDB CI classes.{#sem-ci-creation-using-IRE__table_nxb_kyt_knb__entry__2} | CMDB CI Class | Description | |-|-| | Incomplete IP Identified Device (cmdb_ci_incomplete_ip) | CI is created in this table if only the IP address is available in the host information that is received from the scanner. | | Unclassed Hardware (cmdb_ci_unclassed_hardware) | CI is created in this table if any of the following information is available in the host information that is received from the scanner: * Host name * IP address * DNS * NETBIOS * MAC address {#sem-ci-creation-using-IRE__ul_ngp_3sw_lnb} Note: If the MAC address is available, the network adapter entry is created and related to the unclassed hardware CI. If both the IP and MAC addresses are available, the IP address CI is also created and related to the unclassed hardware CI. | | Cloud Resource (cmdb_ci_cmp_resource) | CI is created in this table if Cloud Resource ID is available in the host information that is received from the scanner. Note: If the Asset Type of a scanner integration is Hybrid and the sn_sec_cmn.unmatched_cloud_resource_enabled system property is false, the CIs are created in the Unclassed Hardware class but not in the Cloud Resource class. | [Table 1. CMDB CI classes] {#sem-ci-creation-using-IRE__table_nxb_kyt_knb} If the Identification and Reconciliation engine (IRE) is activated, the reclassify option from discovered items is not supported. The system automatically uses an Unmatched CI class if one of the following occurs: * The CMDB CI Class plugin is not activated. * IRE raises an exception while creating a CI.For more information, see [Unmatched CIs](https://www.servicenow.com/docs/Wu~3w_Hes3fsKYc6Q4NpYw "Configuration items (CIs) are automatically matched to CIs in the Configuration Management Database (CMDB) when they are imported. By default, the Security Operations > CMDB > Discovered Items module lists those configuration items without a match."). {#sem-ci-creation-using-IRE__ul_gzm_pq5_dnb} * **[Updating CI class for unmatched cloud assets](https://www.servicenow.com/docs/BoTseOKZLVyCIKt_00SaEQ)** Starting with Vulnerability Response v20.0, you can categorize the unmatched cloud assets from Qualys, Rapid7 and Tenable scanners into Unclassed Hardware by using the sn_sec_cmn.unmatched_cloud_resource_enabled system property. **Related topics** * [CMDB CI Class Models store app](https://www.servicenow.com/docs/access?context=cmdb-ci-class-models&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US) * [Identification and Reconciliation engine (IRE)](https://www.servicenow.com/docs/access?context=ire&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US)