has anybody used tag_exclude_selector parameter in Qualys integration with ServiceNow

[Abhijeet Dutt]

Hello All,

We have a requirement where in we do not want certain CI record to be created in Configuration Compliance and Vulnerability Response.

We are thinking to make the filteration at API level.

I read and found out that we can use tag_exclude_selector parameter to exclude the CI's with a certain tag attached to them in Qualys.

lets say the tag on Qualys is :  ABC

I want to understand how to write the parameter in the rest message :

[chrismcdevi]

I'm wondering if you need to add:

use_tags parameter when using the tag_exclude_selector

https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf

page 469

[Voona Rohila]

I did this and now it's also asking for tag_set_include value

[cmcclendon]

Hi @Rohila Voona / @Chris McDevitt. This is another weird anomaly with the Qualys API. With a tag_set_exclude, you must also have a corresponding tag_set_include. I had to find a tag that is present in all hosts to satisfy this requirement. If you cant find one tag in all hosts, you will have to use the ANY condition and include several tag IDs.

Example

tag_include_selector: any

tag_set_include: 1111111,222222, 333333

tag_exclude_selector: all

tag_set_exclude: 123456,234567,345678

Qualys does mention this in the very fine print...

-Chris M

[Voona Rohila]

Hi @cmcclendon 

Thank You for the info

So there is no other way around right? I have around 700 tags and I want to exclude only two tags, I need to either find list of all common tags or ask qualys team to give a common tag for all the assets.

[Vinita Nair1]

Hi Rohila,

Did you find a way out? What worked?