Best approach to limit CI discovery from Qualys VR integration based on a specific Qualys Tag

[AB6]

Hello Community,

I'm looking for recommendations on the best way to limit the CIs discovered by the ServiceNow Vulnerability Response (VR) integration with Qualys based on a specific Qualys Tag.

Our goal is to prevent assets associated with a particular Qualys Tag from being discovered or created as CIs in ServiceNow.

The main reason is to reduce the number of discovered CIs and optimize our licensing costs, since these assets are not relevant for our CMDB or Vulnerability Response processes.

Has anyone implemented a solution like this?

Specifically, I'm interested in understanding:

• Is there a supported way to exclude assets based on a Qualys Tag before they are processed by ServiceNow?
• Can this be achieved through the Qualys integration configuration, API filters, Transform Maps, Identification Rules, or another supported mechanism?
• What is considered the best practice to prevent these CIs from being created while maintaining a supported integration?
• Are there any limitations or potential side effects of filtering assets in this way?

For example, we'd like to exclude all assets that belong to a specific Qualys Tag, so they are never imported into ServiceNow and therefore do not create or update CIs.

If anyone has implemented this approach or can share documentation or recommendations, I would greatly appreciate your guidance.

Thank you!

[andy_ojha]

Hey there,

Given your requirement is to limit the asset (and other findings like vuln detections), we'd have to modify the query parameters on the actual REST msg (POST) that is used in the API call.   

You can specify the Qualys compatible parameters here - such as 'tag_set_exclude' alongside dependent parameters Qualys specifies in their API docs (e.g. 'use_tags').

It is a bit involved, as you'll want to modify the POST method (query params) for BOTH:
- Qualys Host List - Standard (used to fetch just the assets and create discovered items)
- Qualys Host Detection - Standard (used to fetch assets + vuln detections)
 -> this is used for the delta and comprehensive jobs 

That would get you into a spot where the Qualys Host List (Asset/Disc Items) and Qualys Host List Detection (Asset/Disc Item and Vuln Detections) -> bring in what you want and exclude Qualys Assets with the Host Tags you specify in the query params for both jobs.

There are other jobs and POST methods to consider to (E.g. for Configuration Compliance if you are using that)

You will also want to keep in mind, that the Qualys API versions used by the ServiceNow Store App were changed recently to use a more modern Qualys API (v5.0), I believe that was in the March 2026 Store App release (12.21.0 for Non-USEM and 30.3.0 for USEM)... If you are on an older version of the Store App, the changes you make now to the query params may need to be done again after you upgrade (or at least tested again) if you upgrade to the newer Qualys Store App after.. Just a heads up to keep in mind.

Reference - Qualys API Docs 
- https://cdn2.qualys.com/docs/qualys-api-vmpc-user-guide.pdf