Auto Scan from Servicenow to Qualys on state changes

[User179407]

Hello,

I would like to know how does the auto scan happen from Servicenow to Qualys and on which states is the scan triggered ?

What are the jobs that run and where can we monitor the/m?

 Update: i see that when the state changes to Resolved the auto scan is initiated.(see below link). however I dont see the workflow is initiating in my SN instance, how to i activate that auto workflow ?

https://www.youtube.com/watch?v=uAaF9o-gylg&t=190s

Thanks.

@Chris McDevitt 

@Stephen Laseau 

@./andy-b2poYQ== 

[andy_ojha]

Hey there - I don't think that is the right spot to put the `scan_options_profile`.

We need to put it in the <Value> column, of the Integration Instance Params.

This should get you moving forward:

[User179407]

I dont know how i missed this, thanks. 

Below is the error now:

Error: No default scanner appliance defined.  Provide a default scanner appliance in the integration configuration

Where can I find value for default_scan_appliance ? Please note that I have already configured the Qualys Default Appliances (see screen shot 4)

[Chris McDevitt]

Sorry I guess I am late to the party! Andy has already answered everything... Ah! I see he left one for me!

🙂 

• Vulnerability Response > Qualys Vulnerability Integration > Integration Instance [sn_sec_int_impl] then Qualys
  - Integration Instance Parameters
  — default_scan_appliance
• 

And do not worry.... There could be a document just on setting up rescan.

-Chris

[User179407]

Hey Chris,

thanks for the reply.

What should be the value for default_scan_appliance  ? 

Please note that I have already configured the Qualys Default Appliances Integration

[andy_ojha · Accepted solution]

Hey there - you need to specify a fallback appliance that will be used in the API request sent to Qualys.

The Qualys API will not accept requests for re-scan without an appliance - so this acts as the fallback (even though you've setup the Default Scan Appliances)...

In the Default Scan Appliances you can ensure the IP Ranges are mapped to the appliances you'd expect to cover the scans (that would win first).

The "default scanner appliance" you setup is the fallback, if we do not find a target Appliance from the "Default Scan Appliances" you have already setup.

You can specify either the ID or Name of the Appliance (seem to have better luck with the Name).