How to distinguish between object types when importing Discovery to Insight?

[Alex Kodnar]

Hello.

I was wondering how I can make Insight or Discovery recognize what kind of asset is is importing.

For example, if I import a Server, it will nevertheless get imported as a Host.

I tried to create an Object type mapping for the object type "Server" saying ["Operating System" like Server] . I tried to achieve, that if for example the OS is "Windows Server 2012R2", it will recognize the "Server" and map it.

But unfortunately it didn´t work.

I have the same issue with Printer devices.

Thanks for helping,

best regards, Alex

[Steve S_]

There is a work around for this - the main issue is that you cannot filter on a referenced object - but that doesn't mean you cannot use the object hash information to filter, you just need to create a default text attribute that can save that hash information and then filter on that.

Scenario:

Discovery import is pulling Windows machines, and the objects have various Operating Systems.  "Operating Systems" is a child object type under the "Host" object and therefore the attribute Host>Operating Systems is a referenced object.  When I click on the "Operating Systems" object, I see the name of the objects, but I also see the attribute "Object Hash" for each different type (i.e. "Windows 10 Pro" has a unique object hash that all machines with that operating system shares).  

Problem:

If I open up the Discovery object mapping and copy the "Host" mapping and name it something like "Server" so that only the objects with a Windows Server Operating System are mapped to, I will not be able to simply filter on its imported attribute of "Operating System" because "Operating System" is its own object type (even if the JQL is a valid statement).

Solution:

a) Create the "Server" object type under "Host" so that the soon to be filtered objects have a place to go (make it easy - simply copy the Host object and keep the attributes you care about).

b) Create an additional attribute called "OS" that is a default-text (you now have 2 attributes, "Operating System" that is a referenced object, and "OS" that is default-text).

c) Copy the "Host" object mapping and call it "Server".

d) Update the "Server" object mapping for "Operating System" by first renaming it to "OS" and then removing the AQL associated to it (i.e. data source and destination field both = "OS"). 

Now the attribute "OS" imported will be the object hash unique identifier data.

e) Update the object type mapping for "Server" to filter on your AQL statement (i.e. "OS" in (<object hash value>).

When you run your Discovery import it will now only import the objects into the "Server" object with those unique object hash identifiers that you specified.

NOTES: You will have to do a one-time manual update of the "Operating System" to match the "OS" object hash and update new objects that are imported.  Alternatively, you can automate this with a rule for when new objects are imported. 

You will also have to decide if you still want "HOST" to be enabled once you break out the data into the new object types - in my personal opinion, if you aren't importing anything near your data limitations I would keep HOST mapping enabled so that you can see if you are missing anything as new data is imported by matching the HOST data count to the newly created object type counts.

[Steve S_]

I am interested to see if this helps anybody - please post a reply if it worked for you or if you can summarize these steps more efficiently.

[Christian_Solle]

Hi Alex,

yes you are right.

Actually this is not possible because the references were set "after" the import.

So it is not possible to filter on them during the import.

https://documentation.riada.se/insight/latest/insight-manager-s-guide/import-and-synchronization/general-import-concepts

I have created a feature request ticket for it, because I can see the use case for it.

https://jira.riada.se/browse/ICS-693

Follow and vote for the feature.

// Christian

[Alex Kodnar]

Hey Christian,

thanks for your answer and for the feature request.

Is there any other possibility for Discovery or Insight to automatically recognize Servers as Servers or to distinguish between Hosts and Servers? 

[Christian_Solle]

Not per "default" because there is "no" difference when you scan a system.

Also ith your solution if a "host" have installed a Operating System that contains "server" in the name it will be mapped to the server object.

Also iti s possible to install a "non" server OS to a "server" system.

Of course not the normal use case.

Any ways, it would be possible to add aa custom pattern for hosts that will check the operating system name and add a "extended information" attribute to the host.

Based on that extended information you can add the IQL.

If you need support for that pattern, please create a feature request ticket for it and we will help you.

// Christian

[Alex Kodnar]

Alright, thanks a lot.