Manage Unclassed Hardware CIs

Product Success Playbook

A step-by-step guide to analyze and remediate CMDB Data

Table of Contents

Summary

Goal of this Playbook

Audience

Problem Overview

Executive Summary

How this playbook can help you achieve business goals

How this playbook is structured

Problem Analysis

Upstream Causes

Downstream Consequences

Impact on Your Business

Engagement Questions

Remediation Plays

Summary

Play 1: Review your data

Play 2: Analyze your CI records

Play 3: Fix Play

Play 4: Fix Play

Data Governance

References

Summary

Goal of this Playbook

This playbook helps in reducing CIs in the Unclassed Hardware class. CIs in "Unclassed Hardware" class has limited information and purpose

Details about this playbook

Author

Bibu Elias Punnachalil

Reviewer

Ravi Kumar Kanukollu

Date

12/04/2022

Addresses HSD #

HSD0011887

Applicable ServiceNow Releases

All Releases

Prerequisites

Time Required

Approximately 30 to 40 hours per integration (depending on your environment)

Audience

Vulnerability Administrator, Vulnerability Analysts, Remediation teams Configuration Manager or Configuration Management team ServiceNow Administrator or Discovery Administrator

Problem Overview

When data is imported from a third-party integration, Vulnerability Response automatically uses host data to search for matches in the Configuration Management Database (CMDB). It does this using CI Lookup Rules. If CI Lookup Rules fail to match on anything in the CMDB then the Vulnerability Integration framework may create a new record in “Unclassed Hardware”. Prioritization and assignment of VIs may be impacted if the VIs are unmatched and discovered item is getting created into Unclassed Hardware. More records on Unclassed Hardware also affects the CMDB reporting and performance

Executive Summary

How this playbook can help you achieve business goals

This playbook recognizes the need to reduce the records in Unclassed Hardware table in order to get best value from a VR implementation It will help you reclassify the unclassed and put in place processes to reduce the recurrence of this issue. This will ensure that the maximum number of vulnerabilities are communicated to the remediation teams in a timely manner for effective treatment. This, is turn, will contribute to improving the vulnerability profile of you organization.

How this playbook is structured

This Playbook will guide you through 4 plays.

Play 1 (a review data play) helps you review CI records in Unclassed Hardware class Play 2 (a remediation play) provides remediation steps required to fix VI records without remediation target Play 3 (a remediation play) provides remediation steps required to fix issues which might result in creation of VI without remediation target Play 4 (a remediation play) lists the guidelines and processes for continuing to have Vis with remediation target Play 5 (a Data Governance play) provides remediation steps required to fix issues which might result in creation of VI without remediation target

Problem Analysis

Upstream Causes

The drivers of a low DIs-to-CI matching rate are (by decreasing order of business impact):

Unprepared CMDB: - The CMDB is not VR-ready, it has not been aligned to the VR strategy

- The network ranges used to discover assets and populate the CMDB are not aligned to the network ranges used by the third party vulnerability scanner

- CIs do not exist in the CMDB to match the DIs created by the VR application

Unsuitable CI Lookup Rules - OOTB rules are not fully suited to specific environment and need to be tailored

- Rules were created after all data is imported from the scanner (sub-optimal implementation methodology)

- CI lookup rules in incorrect order

- IRE CI Identifiers needs to be adjusted

Downstream Consequences

Data Consequence

Duplicate configuration item records Operation Consequence

Support teams are unable to lookup CIs quickly App Consequence

Event Management not able to bind the CI Performance

Impact on Your Business

More CIs in Unclassed Hardware will negatively impact the effectiveness and efficiency of your Vulnerability Remediation teams, vulnerability teams and audits. Also these records

Security MTTR Delay in vulnerability identification Slower response to vulnerability remediation

Audit/Compliance

Incomplete DI data

Engagement Questions:

Consider the answers to these questions:

What is the current proportion of unmatched DIs? Does the VR strategy explicitly address CI Lookup rules? Did the VR implementation follow the "crawl-walk-run" approach? Did the CI Lookup Rules strategy use the OOTB rules first? Is there an established relationship between the VR team and the CMDB team?

Remediation Plays

Summary

The table below lists and summarizes each of the remediation plays in the playbook. Details are included later.

Play Name

Review your data

What this play is about

Review the data present in unclassed CI

Required tasks

List the CIs in Unclassed Hardware class

Fix Play: Update discovered items

What this play is about

This play helps you analyze the discovered items and assign the correct class

Required tasks

List the discovered items and manually select the appropriate class

Fix Play – Reclassify CIs manually

What this play is about

List the CIs which needs to be reclassified

Required tasks

Reclassify identified CIs

Fix Play – Retire unused CIs

What this play is about

Retire the unused CIs in Unclassed hardware items class

Required tasks

Create and run the schedule job

Data Governance

What this play is about

Monitor and maintain CIs in Unclassed hardware items class

Required tasks

Review the data and fix appropriately

Play 1 - Review your data

What this Play is about

This play helps in listing all the CIs in Unclassed Hardware

Required tasks

On the Navigator type cmdb_ci_unclassed_hardware.list. This will list the unclassified hardware CIs Group by Discovery Source to help identify from where these CIs originated Work iteratively with CMDB team to ensure that CMDB has the CIs for which VIs are getting discovered. Fix discovery issues like, Discovery credential issues Issues related to discovery IP ranges Availability of MID Servers for all the target servers

Play 2 – Update discovered items to the correct class

What this Play is about

This play helps you analyze the discovered items and assign the correct class

Repeat this process until all you have left is items that are in the “it will never match” category.

Required tasks

Adjust the columns on the Discovered Items module to also include: Host tag, NetBIOS, Operating system, DNS Name, Fully Qualified domain name Now, group by Operating system. Investigate this list by looking at that OSs with the largest count down to the smallest. Look to solve the biggest patterns first, to navigation search box, type cmdb_ci_unclassed_hardware.list. to display the CIs Ensure that the Class field is displayed in the list. If you do not see this attribute, personalize the list to add the Class field. Double-click the Class value for the CI, and select a new class. Click the green check box to confirm your selection.

Play 3 - Fix Play Reclassify CIs manually

What this Play is about

Reclassify CIs manually

Required tasks

Locate the CI that you want to reclassify and display it in a list view. You can use the application navigator. Or for example, if the CI is a server, then in the navigation search box, type cmdb_ci_unclassed_hardware.list. to display the CIs Ensure that the Class field is displayed in the list. If you do not see this attribute, personalize the list to add the Class field. Double-click the Class value for the CI, and select a new class. Click the green check box to confirm your selection.

Play 4 - Fix Play : Fix Play : Retire Unmatched CIs

What this Play is about

Create a scheduled job that looks at all non "retired" Unclassed Hardware items to see if they are still in use. What I mean is, I would see if there is a reference to the Unclassed Hardware item in the Discovered Items module. If there is not a reference in the Discovered Items module to that CI, then set that CI Status to "Retired".

Required tasks

Download & upload the xml file Go to scheduled job and review the job “Retire UnMatched CIs” Make the job active

Data Governance

What this Play is about

Monitor and maintain data in Unclassed hardware

Required tasks

Regularly execute play 1 to review CIs in Unclassed Hardware Setup a process for regular maintenance of CIs in Unclassed Hardware class

References

ServiceNow Vulnerability Response CI Matching Tuning

This article is intended to help you understand how to tune your CI Matching logic to work as effectively as possible with the data that you have available

Congratulations

You have completed this Product Success Playbook .