Discovered Items for Configuration Compliance

Assets are automatically matched to configuration items (CIs) using CI lookup rules, when they are imported using the host and test results integrations. Discovered Items give you visibility into how asset identification is mapped to CIs in the CMDB.

Discovered Items are considered Matched, Unmatched, or Reclassified. Identified CIs are in the Matched state.

To make it easier to find potential matching issues, the CI Lookup Rule that matched the CI appears in the CI matching rule field.

Note:

CI matching rule field support is available only for the Qualys integration.

If a match was not found, a CI is created in the Unmatched CI class [sn_sec_cmn_unmatched_ci], [cmdb_ci_unclassed_hardware], or [cmdb_ci_incomplete_ip] of the CMDB. If the original unmatched CI was reclassified, Discovered item records are updated to reflect that state. For more information, see Unmatched CIs and View and reclassify unmatched configuration items for more information.

By default, the Security Operations > CMDB > Discovered Items module lists unmatched configuration items. You can view all discovered items from an import by removing the filter.

For a description of the fields in Discovered Items, see Discovered Items form fields.

• CI changes for discovered items for Configuration Compliance
  The default value of the property sn_sec_cmn.update_on_ci_change is true. So, when the configuration item (CI) for a discovered item is updated, the test results are updated as well.
• Reconcile unmatched discovered items for Configuration Compliance
  Create a schedule job to reconcile unmatched discovered items. When a test result is created, the configuration item (CI) added to it at the time of creation might be an outdated one.
• Reapply CI lookup rules on selected discovered items for Configuration Compliance
  Reapply configuration item (CI) lookup rules on selected discovered items from the discovered item list view select actions. The administrator might have to edit or update a lookup rule for multiple reasons. If the lookup rule changes, they can reapply them on the discovered items.