Merge pull request #22 from polarityio/develop

Fix asset searches so not all assets are returned, add warning on invalid incident fields
polarityio · Sep 28, 2024 · d48ae3d · d48ae3d
2 parents c203a52 + 7c4407d
commit d48ae3d
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/config/config.js b/config/config.js
@@ -99,7 +99,7 @@ module.exports = {
       key: 'incidentQueryFields',
       name: 'Incident Query Fields',
       description:
-        'A comma separated list of fields to search when querying for Incidents.  Incident searches are done for IPs, domains, CVEs, annotated entities and any added custom types. NOTE: If a field is not in this list, it will not be searched for Incident Queries.',
+        'A comma separated list of fields to search when querying for Incidents.  Incident searches are done for IPs, domains, CVEs, annotated entities and any added custom types. IMPORTANT -- ServiceNow does not return an error if invalid fields are provided and will instead return all records.',
       default: 'short_description, description, work_notes',
       type: 'text',
       userCanEdit: false,

diff --git a/config/config.json b/config/config.json
@@ -103,7 +103,7 @@
     {
       "key": "incidentQueryFields",
       "name": "Incident Query Fields",
-      "description": "A comma separated list of fields to search when querying for Incidents.  Incident searches are done for IPs, domains, CVEs, annotated entities and any added custom types. NOTE: If a field is not in this list, it will not be searched for Incident Queries.",
+      "description": "A comma separated list of fields to search when querying for Incidents.  Incident searches are done for IPs, domains, CVEs, annotated entities and any added custom types. IMPORTANT -- ServiceNow does not return an error if invalid fields are provided and will instead return all records.",
       "default": "short_description, description, work_notes",
       "type": "text",
       "userCanEdit": false,

diff --git a/src/querying/queryAssets.js b/src/querying/queryAssets.js
@@ -7,7 +7,7 @@ const queryAssets = async (entity, options, requestWithDefaults, Logger) => {
       get('assetTableFields'),
       split(','),
       map((field) => `${trim(field)}CONTAINS${entity.value}`),
-      join('^OR')
+      join('^NQ')
     )(options);
 
     const requestOptions = {