Skip to content

Instantly share code, notes, and snippets.

@cmcdevitt
Last active April 3, 2022 11:00
Show Gist options
  • Select an option

  • Save cmcdevitt/72033b66335c2ab00af30214f76e4c2e to your computer and use it in GitHub Desktop.

Select an option

Save cmcdevitt/72033b66335c2ab00af30214f76e4c2e to your computer and use it in GitHub Desktop.
How to use sn_vul.ImportHost().hostImport
/*
hostImport:
(1) It trys to match on an existing CI
(2) If no match is found, it transforms the host{} data into an IRE Payload and passes it to the IRE to handle
(3) It returns the Configuration Item (eather the one it matched or the new one the IRE created)
(4) It then creates and entery in the Discovered Items module
Notes:
The "host" Object PLUS the 'Host Import Maps' table is the bridge between the Integration fields and the target CMDB table fields
The Integration 'fields' become properties in the ==> host{} <== and they represent the 'Source' field on Host Import Maps [sn_sec_cmn_src_cmdb_map]
The 'Source Field' [source_field] (String) on Host Import Maps [sn_sec_cmn_src_cmdb_map] table == Integration field/property on "host" Object
The 'Target Field' [target_field] (Field Name) on Host Import Maps [sn_sec_cmn_src_cmdb_map] table == the field name on the target CMDB table. i.e. cmdb_ci_unclassed_hardware
The 'target_table' [target_table] (String) on Host Import Maps [sn_sec_cmn_src_cmdb_map] == the target table on the CMDB i.e. cmdb_ci_unclassed_hardware
"Target Fields" (name,ip_address are the mimimum)
Unclassed Hardware [cmdb_ci_unclassed_hardware]
dns_domain,fqdn,ip_address,mac_address,name
Incomplete IP Identified Device [cmdb_ci_incomplete_ip]
dns_domain,fqdn,ip_address,mac_address,name,network_partition_identifier
Data Flow
Incomming data -> Host object
Arguments:
var matchResults = new sn_vul.ImportHost().hostImport(
sourceInstance :: sys_id from Third Party Integration[sn_sec_int_integration]
host :: host Object
uniqueID :: the property in the host{} that uniquely identifies the resource i.e. host.id
integrationRun :: sys_id from Vulnerability Integration Run[sn_vul_integration_run] note:you can make one up also
);
*/
//Build the host Object
var host = {};
host.id = "123456789";//A unique identified for this host. Becomes the Source ID on Discoverd Items
host.host = "bilbo"; // Source Field = 'host' & Target Field = 'name'. i.e. the CI name will be 'bilbo'
host.ip_address = "10.10.10.10"; //Source Field = 'ip_address' & Target Field = 'ip_address' i.e. the IP Address will be 10.10.10.10
host.some_custom_field = "foo bar"; // Skip for the Source/Target mapping becouse no CMDB field: But this ends up in the Discovered Item Source Data Field
//Gather the Integration and Integration Run sys_ids
var sourceInstance = "56b751c287698d10455cb809cebb35ba"; //Integration Instance [sn_sec_int_impl]
var integrationRun = "2a29ed5f87d58510455cb809cebb35ac"; //Vulnerability Integration Run [sn_vul_integration_run] can be made up
//Call the function
var matchResults = new sn_vul.ImportHost().hostImport(sourceInstance,host,'id',integrationRun);
//Check the output :: For Testing
keys = Object.keys(matchResults);
for (i=0; i < keys.length; i++) {
gs.info(keys[i] + "::" +matchResults[keys[i]]);
}
/*
Returned Properties:
'sys_id' = New / Matched sys_id of CI
'insert' = true/false
'update' = true/false
'ignore' = true/false
'disc_item_id' = sys_id of the Discovered Item record
*/
/*
Third Party Integration [sn_sec_int_integration] -- aka Parent
-This needs Lookup by Network Partition = True
-This needs Multi-source supported = True
Integration Instance [sn_sec_int_impl] -- aka Child
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment