From f257cfad88a78e355f9a89fa418ee89fc9c64543 Mon Sep 17 00:00:00 2001 From: Jordan Ramos Date: Wed, 17 Jun 2026 14:58:01 -0600 Subject: [PATCH] Skip BU history entries when previous_bu is unknown Only record BU reassignment in ivanti_finding_bu_history when the previous_bu is a known managed BU (from EXPECTED_BUS). Findings that were never in our sync cache show as UNKNOWN which provides no actionable insight for asset movement tracking. Closes #28 --- backend/routes/ivantiFindings.js | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/backend/routes/ivantiFindings.js b/backend/routes/ivantiFindings.js index 6d75c5e..2e0576d 100644 --- a/backend/routes/ivantiFindings.js +++ b/backend/routes/ivantiFindings.js @@ -798,12 +798,17 @@ async function runBUDriftChecker(newlyArchivedIds, apiKey, clientId, skipTls, pr if (classification === 'bu_reassignment' && found) { try { // Determine previous BU from the pre-sync snapshot (passed in from syncFindings) - const previousBu = (previousBuMap && previousBuMap.get(id)) || 'UNKNOWN'; - await pool.query( - `INSERT INTO ivanti_finding_bu_history (finding_id, finding_title, host_name, previous_bu, new_bu, detected_at) - VALUES ($1, $2, $3, $4, $5, NOW())`, - [id, found.title || '', found.hostName || '', previousBu, found.bu] - ); + const previousBu = (previousBuMap && previousBuMap.get(id)) || ''; + + // Only record if we have a known previous BU — "UNKNOWN → X" entries + // provide no actionable insight for asset movement tracking. + if (previousBu && EXPECTED_BUS.has(previousBu)) { + await pool.query( + `INSERT INTO ivanti_finding_bu_history (finding_id, finding_title, host_name, previous_bu, new_bu, detected_at) + VALUES ($1, $2, $3, $4, $5, NOW())`, + [id, found.title || '', found.hostName || '', previousBu, found.bu] + ); + } } catch (err) { console.error(`[BU Drift Checker] Error recording BU change for finding ${id}:`, err.message); }