Qualys CMDB Sync App not working as expected. Pulling data and creating duplicates

[Luis Garcia]

We have installed the Qualys CMDB Sync application (2.2.0) latest version. We have detected that it creates duplicate CI's and we don't know how to prevent this. We have read all the Qualys Cloud Platform documentation when installing it on our test instance. The application is connected with Qualys without problem. There are scheduled jobs that run and get information from Qualys and create new CI's and that is where the duplicates are created. I will describe the following scenario so that you can understand it.

• The scheduled job "Software Catalog Sync" is fetching information from the platform. We are using the Identification Engine in the application. Using the CI Class Manager we use in the Software table (cmdb_ci_spkg) the Identifier Entry "Key" (Out of the Box) but it still creates duplicates and this rule is sometimes skipped. I changed the Identifier Entry to "Name" but the App Log tells me there is an error. I will leave images here so that you can visualize this scenario.

  

We haven't started with the data import yet but I'm sure when we start there will be duplicate CI's and I could see that one of the problems is the "Auto Approval Processor" scheduled job but I'm not sure why.
Please any contribution you could give me would be appreciated or if you can refer me to a solution that has already been posted previously

[#2]

The Qualys CMDB Sync is developed and maintained by Qualys.  You may need to reach out to their support for help on the store listing.

It could help the community here if you post examples of the duplicates you are seeing.  I would recommend that you don't change the OOTB IRE rules.  The key field on the cmdb_ci_spkg table follows a very specific format and is set by the Update key field business rule.  Within this business rule you can see the format that is expected.

Without any further detail my guess would be that the Qualys CMDB Sync application doesn't properly follow the format for the key field on cmdb_ci_spkg.  If it doesn't, the business rule will kick in and modify the value, then a duplicate will come in because the values out of Qualys's application do not follow said format and the business rule has changed what Qualys sent.  If that is the case I would ask Qualys to fix this within their application as any changes to IRE rules or business rules will cause issues as other integrations will likely expect those to be OOTB.

[Luis Garcia]

I put the images here as examples of what is duplicated. As you can see, the Ci's have the same name but a different version. I'm not sure how the CMDB works but I was as expecting to update the CI's instead of creating a new one. According to what you explained to me, the BR "Update key field" would be adding the values to these CI's if they met the conditions. I momentarily disabled the BR to prove this point, but even so the CI's were created with the format that you can see in the images which means that Qualys sends the data that way. What could it be then? Thanks for the help.

[Luis Garcia]

Just to clarify, using the Identification Engine method in Qualys is problematic. So I just change it to Tranform Maps and only in this way I could make progress in implementing the application in ServiceNow. So with this I close the question. Thanks

[dick1]

Luis, thanks for sharing this, I ran in to the same issue here, and indeed setting it to transform map helps.
only thing now is that it sets the discovery source to servicenow instead of qualys