All assets from Qualys are not imported into ServiceNow

[User1234]

i'm having an issue with importing data from Qualys into ServiceNow. Multiple assets are not showing up in the Security Operations CMDB, nor as Vulnerable Items. I have given my ServiceNow API user access to read the "All" asset group, and most assets do import fine into ServiceNow. There are just a few of them that I can see in Qualys, but not in ServiceNow. What could be the reason for this? I have reviewed the XML files in the import in ServiceNow as well, and found no reference to the assets there.

[User1234]

The user has the role "Reader". It is part of the business unit "Unassigned". The asset group it has access to is "All". I have checked the CMDB, and can't see it there.

[andy_ojha]

Hey there,

As you've already set the Host Detection import date back in ServiceNow, and reviewed "Discovered Items" with no luck, I would say the next step is to reach out to Qualys for help.

If you've confirmed that this user has the "API" checkbox set, and has access to the appropriate "Asset Groups" in Qualys, I would look at opening a Qualys Support Ticket to ask for assistance here, and mention that you are querying the Qualys VM Host Detection API, (Endpoint = /api/2.0/fo/asset/host/vm/detection/), using <xyz> creds, and not see the payload include Detections for (Qualys Asset ID <123>).

You could try to switch the user account to one using the "Manager" role, just to further troubleshoot this and perhaps isolate this to a user / asset group permission, but this is may not likely be the culprit.

You could also look at using tools like 'curl' or 'Postman', and making the same API requests to Qualys with the same user account (if you wanted to double check the payload).

If you get a win, please share what the issue was.

[User1234]

I debugged this further, and it turns out that a Qualys user with the "Reader" role and access to all assets doesn't actually see all assets. So I gave the user the "Manager" role, and now it can import all assets. Very strange.