SIR LogRhythm integration fails as incorrect MID server is selected for REST Probe


Description

Servicenow uses Outbound REST Probe through MID server to connect to Logrhythm, and pulls individual alarms based on configured profiles. However, the MID server specified in the Logrhythm configuration is not honored, instead it falls back to default MID server in the instance.

Release or Environment

Orlando

Cause

The checkMidServer() method in the 'LogRhythmIntegration' is responsible for selecting the MID server. The script include is provided OOB with the integration, and it checks for the sys_id of specified MID server against the name column.


As the sys_id cannot be found in the name column, it cannot find the configured MID server and falls back to default MID server. 

Line 33 in the script include :


midGR.addQuery("name", midServer);


It should be :


midGR.addQuery("sys_id", midServer);


Resolution

Please backup the OOB script include, and try below as workaround :comment Line 33 and add below line :


midGR.addQuery("sys_id", midServer);

Also, comment lines 38 and 39 :

if (midGR.hasNext())
return midServer;

and add below:

if (midGR.next())
return midGR.getValue("name");