--- sourceDocument: Australia Security Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud # CI lookup rules for Microsoft Defender for Cloud Integration for Security Operations and Palo Alto Prisma Cloud {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CI Lookup Rules for Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud The CI Lookup rules module enables the identification of resource types in the Configuration Management Database (CMDB) for Microsoft Defender for Cloud and Palo Alto Prisma Cloud integrations. These rules are essential for mapping applications and their releases, ensuring that all assets are uniquely identified by their object ID, cloud account, and logical datacenter in ServiceNow. Show full answer Show less ## Key Features * **Object ID Formats:** Different formats are used to populate the Objectid column for various resource types. Using the correct format is crucial for accurate asset lookup. * **CI Lookup Rules:** Predefined rules exist for common resource types, such as AWS::S3::Bucket and AWS::ElasticLoadBalancing::LoadBalancer, facilitating easier identification of CIs. * **Custom Rules:** If existing rules do not yield results, customers can create custom CI lookup rules tailored to their specific resource types. * **Order of Execution:** Priority can be set for CI lookup rules, allowing customers to control which rules are applied first based on their order value. ## Key Outcomes By effectively utilizing CI lookup rules, ServiceNow customers can ensure accurate asset identification within the CMDB, enhancing their ability to manage and monitor cloud resources. Customers can expect improved matching results for various resource types when using the correct object ID formats and defining appropriate lookup rules tailored to their needs. You can use the configuration item (CI) lookup rules for the Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud integrations to find a correct match to commonly used resource types in the Configuration Management Database (CMDB). ## Overview {#cloud-ci-look-up-for-ms-paloalto__section_c1l_rqf_qwb} The CI Lookup rules module contains the rules that help you to define the fields that have the matching data in the Configuration Management Database (CMDB). You can use these rules to identify the applications and application releases. All Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud assets are uniquely identified by the combination of their object ID, cloud account, and logical datacenter in the ServiceNow platform. ServiceNow discovery populates the resource ID in the `Object_id` column of the CMDB in different formats for the different resource types. The following table shows the object ID formats of commonly used resource types that the discovery service uses to populate in the `Object_id` column of the CI. Any scanner that wants to look up an asset of a particular resource type must search by using the right object ID format. You can get the right object ID format by looking into the object ID column of corresponding CMDB CI class and then try to construct the object ID using the values that are received from scanner.{#cloud-ci-look-up-for-ms-paloalto__table_prw_sg4_rwb__entry__2} | Resource Type | Format | |-|-| | AWS::EC2::Instance | Object ID | | AWS::ElasticLoadBalancing::LoadBalancer | Load balancer name | | AWS::S3::Bucket | arn:aws:s3:::\ | [Table 1. Object ID format for various resource types] {#cloud-ci-look-up-for-ms-paloalto__table_prw_sg4_rwb} The CI match for a test result may not be found accurately in the Configuration Management Database (CMDB) unless the same format of the `object_id` is used in the lookup rule. Most of the times, the OOB CI lookup rules find a match for the most commonly used resource types for Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud. If the following CI lookup rules aren't finding the CIs in the CMDB for your test results, you can create a CI lookup rule for a resource type. For more information on how to create a CI lookup rule, see [Create a CI lookup rule](https://servicenow-prod.fluidtopics.net/DQQBP6USedqPaEVrEOS8cg "The CI Lookup Rules module contains rules that are used to find the matching record for host information received during third-party vulnerability integration imports. The host information is matched with the discovered items, unmatched configuration item classes, and the Configuration Management Database (CMDB)."). ## CI lookup rules {#cloud-ci-look-up-for-ms-paloalto__section_yks_3hk_nwb} The following CI lookup rules are specific to the Microsoft Defender for Cloud Integration and Palo Alto Prisma Cloud. S3 Bucket : This lookup rule attempts to find the CI in the CMDB by the value that was obtained by concatenating the `arn:aws:s3:::` and resource name. The obtained value is looked up in the `object_id` column of the `cmdb_ci_cloud_object_storage` table. This lookup rule applies only when the resource type is AWS::S3::Bucket.​ Name : This lookup rule attempts to find the CI in the CMDB by name. The name, which is looked up in the `Object_id` column of the CI class, corresponds to a resource type in the `sn_capi_resource_type` table. Note: For the Palo Alto Prisma Cloud application, this CI lookup rule runs only for the `AWS::RDS::DBInstance`, `AWS::ElasticLoadBalancing::LoadBalancer`, and `AWS::CloudTrail::Trail` resource types. You can add the resource types that you want to execute this CI lookup rule for. Resource Id : This lookup rule attempts to find the CI in the CMDB by the resource ID. The resource ID, which is looked up in the `Object_id` column of the CI class, corresponds to a resource type in the `sn_capi_resource_type` table. Note: You can set the priority for a CI lookup rule in the Order field. The CI lookup rule with the least order value is executed first.