rapid7 / nexpose-client

DEPRECATED: Rapid7 Nexpose API client library written in Ruby
https://www.rapid7.com/
BSD 3-Clause "New" or "Revised" License
150 stars 103 forks source link

job failure in servicenow #323

Closed ravio closed 5 years ago

ravio commented 5 years ago

I am a ServiceNow dev with no experience in ruby development. we have the Nexpose integration setup with ServiceNow using the Rapid7 Nexpose ruby gems and its been working fine since 11/2018 but since past few weeks, we are seeing some job failures in ServiceNow.

Expected Behavior

jobs shouldn't fail. expecting no fail logs in the SN sn_vul_integration_run table.

Current Behavior

seeing failures in sn_vul_integration_run table and new data is not being imported.

Possible Solution

Steps to Reproduce (for bugs)

very random. almost always happens when the jobs are scheduled. happens less frequently when the jobs are manually executed from ServiceNow.

see attached logs we see in ServiceNow

image001 image002 image003 image004 image005 image006

image0011
zyoutz-r7 commented 5 years ago

Thanks you for the submission @ravio. An end-of-life announcement was recently made public for the integration that you are speaking of and the nexpose-client that it depends on is currently deprecated. The EOL announcement can be found her: https://kb.help.rapid7.com/docs/servicenow-ruby-gem-end-of-life-announcement. This announcement explains the options available for moving forward, specifically the newest SecOps related integration for Nexpose and InsightVM that can be found on the ServiceNow store.

While we are not aware of any current issues with the previous SecOps app or the gem it depends on, the issue you are running into appears to be due to an improper filter being sent to the nexpose client when generating a report. This could be due to the app's configuration, which I would recommend checking. Overall, the best next steps are to upgrade to the latest version of the SecOps app which has improvements and supports pulling data directly from the InsightVM API or through Data Warehousing.