question Qualys Internal web application vulnerabilities not synched to snow in SecOps forum

Qualys Internal web application vulnerabilities not synched to snow

bharanikumar20 — Thu, 18 Jul 2024 10:16:07 GMT

Qualys web application scan has reported a Low vulnerability which was not synched with snow.

We couldn't find any VIT record created for this vulnerability.

Do we have any specific criteria to create VIT records

Re: Qualys Internal web application vulnerabilities not synched to snow

andy_ojha — Thu, 18 Jul 2024 12:42:41 GMT

Hey there,

The ServiceNow built Store Application for Qualys

Qualys Integration for Security Operations (built by ServiceNow)
Primarily focuses on Qualys VM, and uses the Qualys Host Detection APIs to import "infrastructure" flavor types of Vulnerabilities (e.g. servers, network gear, computers, - via scans, cloud agents, etc).
It can also connect to Qualys PC for Policy Compliance / secure configuration (hardening) results and findings

A separate integration approach and ServiceNow Store Application, targets the Qualys WAS

Vulnerability Response Integration with Qualys WAS
This is built and supported by Qualys
You will need to work with your ServiceNow Platform Team - to request the Store App (as it is built by a 3rd party)
- Once the request is approved, you can proceed to installation and setup
It imports Qualys Web Application Vulnerabilities into ServiceNow SecOps "Application Vulnerability Response"

Re: Qualys Internal web application vulnerabilities not synched to snow

bharanikumar20 — Thu, 18 Jul 2024 13:08:54 GMT

I would like to know the reason , why vulnerable items are not getting created for low vulnerability

Re: Qualys Internal web application vulnerabilities not synched to snow

Satishkumar B — Fri, 19 Jul 2024 18:01:56 GMT

Hi @bharanikumar20

In ServiceNow, the Vulnerability Integration with Qualys can sometimes miss synchronizing certain vulnerabilities due to specific configuration settings or criteria that filter which vulnerabilities get imported and which do not. The process involves creating Vulnerability Item Templates (VIT) records based on the data received from Qualys.

Please check you Qualys Integration Configuration for Host Detection:

……………………………………………………………………………………………………

Please Mark it helpful👍 and Accept Solution✔️!! If this helps you to understand.

Re: Qualys Internal web application vulnerabilities not synched to snow

bharanikumar20 — Mon, 22 Jul 2024 15:24:42 GMT

The Host detection configuration is enabled for all the Qualys severity levels, still the VITs are not created.

Re: Qualys Internal web application vulnerabilities not synched to snow

Satishkumar B — Mon, 22 Jul 2024 20:11:11 GMT

Hi @bharanikumar20
can you share me the below screenshot configuration which you have done.

……………………………………………………………………………………………………

Please Mark it helpful👍 and Accept Solution✔️!! If this helps you to understand.

Re: Qualys Internal web application vulnerabilities not synched to snow

bharanikumar20 — Wed, 24 Jul 2024 14:06:47 GMT

Hi @Satishkumar B , Thanks for your time, Here is the screenshot which you have requested.

Re: Qualys Internal web application vulnerabilities not synched to snow

Satishkumar B — Wed, 24 Jul 2024 14:08:56 GMT

Hi @bharanikumar20
Looks good for me. we can connect if you need any help.