FQDN is not cleansed properly by SG-Tanium - Support and Troubleshooting

FQDN is not cleansed properly by SG-Tanium Issue This article is about an update you can make in the Tanium Service Graph Connector integration:

https://www.servicenow.com/docs/bundle/yokohama-servicenow-platform/page/product/configuration-management/concept/cmdb-integration-tanium.html

In the Tanium SG Connector integration with ServiceNow, the Fully Qualified Domain Name (FQDN) is not being cleansed properly from the Name field for certain servers. Specifically, servers like "xyz.corp" retain the full FQDN in the Name field, whereas others like "abc.com" are correctly parsed to just the hostname (xyz).

Release Noticed in Washington.

Cause Notice in the IRE input payload that only "abc" (as in abc.com) has been split from the FQDN to its Name field & "xyz.corp" doesn't get split into "xyz".

--> Go through the script responsible for splitting the FQDN. https:// .service-now.com/sys_rte_eb_operation_type.do?sys_id=9a94ebf4735500102b6265a751ab9e93

(if you don't find this script with the URL above, navigate to the "sys_rte_eb_operation_type" table and search for the name "Process Name, Domain, FQDN, DNS set") --> On line 18 of the script, splitting is done with the code in the "processNameDomainFqdnDnsSet" method of the "CmdbIntegrationHardwareNameUtil" Script Include. --> Script Include "CmdbIntegrationHardwareNameUtil": https:// .service-now.com/sys_script_include.do?sys_id=c989228d732100102b6265a751ab9e86

(Again, if you can't find the Script Include with the above URL, navigate to sys_script_include table and search for the Name "CmdbIntegrationHardwareNameUtil".) --> In this Script, the function responsible for splitting the FQDN into a name and domain is: "_pullNameAndDomainFromFqdn()" defined in line 71 & called in line 62 of the above script include. This uses the regex from "glide.discovery.fqdn.regex", which is by default: ^([^.]+)\.((?:[^.]+\.)+[^.]+)$ --> This regex captures the first segment before a dot as the hostname & captures the rest as the domain. --> The string "abc.com" matches the pattern: First segment (abc) → hostname Remaining (com) → domain --> It passes the regex cleanly, so: this.nameOut = this._applyCase(groups[1]); // ABC (converted to uppercase) ---> Line 81 this.dnsDomainOut = this._applyCase(groups[2]); // COM ---> Line 84 --> But for "xyz.corp", it might fail because, even though "xyz" is a valid-looking hostname, this part breaks on line 235 : var suffixCheck = this.domainSuffixReg.test(fqdnIn); --> The domain suffix regex is a huge list of valid TLDs and known suffixes. Problem: .corp is not part of the suffix list by default. So when the regex checks whether .corp is a valid suffix, it fails. --> To validate, you can run this in Background scripts and it works:

var util = new CmdbIntegrationHardwareNameUtil(); // Test input values var nameIn = ''; // Or pass a name directly var domainIn = ''; var fqdnIn = 'sn234234.dc.lemonade.com'; var dnsIn = ''; // Process var result = util.processNameDomainFqdnDnsSet(nameIn, domainIn, fqdnIn, dnsIn); // Log results gs.info('--- Test Output ---'); gs.info('Name: ' + result.nameOut); gs.info('FQDN: ' + result.fqdnOut); gs.info('DNS: ' + result.dnsOut); --> The output is:

sn_cmdb_int_util: --- Test Output --- sn_cmdb_int_util: Name: SN234234 sn_cmdb_int_util: FQDN: SN234234.DC.LEMONADE.COM sn_cmdb_int_util: DNS: --> However, if your run the above script with:

var fqdnIn = 'HELLO.WORLD.CORP';

then the output is empty:

sn_cmdb_int_util: --- Test Output --- sn_cmdb_int_util: Name: sn_cmdb_int_util: FQDN: sn_cmdb_int_util: DNS: Additional Insights : So shouldn't FQDNs have a ".corp" suffix in general? Not necessarily. '.corp' used to be a common internal-use domain suffix (like .local) in enterprise environments. It was never an officially registered top-level domain (TLD) — at least not on the public internet. Organizations used it internally for things like Active Directory (e.g., server1.company.corp).

Resolution You can simply update the regex in the system property "sn_cmdb_int_util.domain_suffix_regex" to include .corp as a valid suffix in the Script Include "CmdbIntegrationHardwareNameUtil". This allows the parsing logic to recognize internal domains ending in .corp and split the FQDN correctly.

However, instead of updating the OOB Script Include, you can:

Create a copy of the Script Include Name it "CmdbIntegrationHardwareNameUtilCopy" You can use it in line 3 of the RTE Operation in place of the OOB script include "CmdbIntegrationHardwareNameUtil" if you would like to have the FQDNs with suffixes ".corp" to be parsed like the other suffixes: https:// .service-now.com/sys_rte_eb_operation_type.do?sys_id=9a94ebf4735500102b6265a751ab9e93 An important detail to this solution: If you change the script of the OOB RTE operation, and further upgrades to plugin will skip that specific file upgrade. So, you may have to manually revert to OOB, upgrade it & then modify that specific file again. So OOB, it doesn't support ".corp" by default.

Also, if you'd like us to consider adding this as a new feature, we encourage you to propose this in the Ideas Portal, https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156757