How does Servicenow VR update CVSS score updates from the vendor?

[AndrewP]

How specifically does Servicenow VR account for vulnerability CVSS risk score changes for the Qualys integration? We have noticed QIDs update CVSS scores at Qualys, but not in ServiceNow. Qualys does not always update its Modified date, when a CVSS score changes.

Thanks,

[Joe Kline]

AndrewP,

Thanks for posting and asking this.  It made me go check our environment closer and sure enough I have the exact same inconsistent data.  Sadly, the root issue here is bad content/product management and consistency on the part of Qualys.  ServiceNOW, as far as I can tell, does not change any data from the vendor in terms of the way you asked this question.  The integration jobs are the way of getting vendor data brought in to ServiceNow, and they then merely process it into the appropriate table/field.  Since Qualys is not updating their data to allow the KB API to filter out changes correctly, we would have to run the KB Integration with a back date, which we can not afford to do given how long it takes to pull data over and process into place.  But I will be looking at this more in my environment to see what we can possibly do, and I would love to be able to open a case with Qualys to wake them up on the real impacts to those of us who export their data out into other systems like this, and ask them to get MUCH better at consistent data management.

Joe

[Joe Kline]

AndrewP,

Based on my previous reply to your question, I went ahead with an "Execute now" run of the KB integration, dated all the way back to 1/1/1999.  Surprisingly it only took about 3 hours to import as compared to our Daily execution that takes just a few minutes.  I was a little surprised at the run statistics and how many records were added/updated, given that we run the update daily ... 1,086 new items added and 86,676 items updated.  Apparently the misgivings of whether Qualys is updating their content consistently or not would cause me to conclude that the overall issue is bigger than just getting the kinds of updates that you described in your question.  Absent my belief that they will improve so their API actually picks up changes, I am going to collaborate with my team members that are more in tune to the API's and suggest we change our daily import to grab ALL KB records rather than only those since the last import job based on the last updated filter ...

Joe

[AndrewP]

Thanks for your time Joe. Backdating the KB integration does appear to pull the latest CVSS score values. I appreciate your help! I was also surprised at the statistics in our environment, ~1,000 new items; We also run this integration daily. When the backdated job runs, the start time adjusts back to the daily cadence, so we will have to think how we can account for this. Potentially running a backdated job on a regular basis.

It would help if ServiceNow could account for this. I have submitted a feature request with Qualys, but they do not seem open to changing their ways.

- Andrew

[Joe Kline · Accepted solution]

Andrew,

Yes, I don't expect Qualys to change, unfortunately.  We will most likely do our own account for this by changing the SN code to NOT update the start times to the previous run, then deal with the ongoing "skipped" efforts during upgrades.  Not sure it is really upon ServiceNOW to fully take on the reality of Qualys' bad habits and inconsistent data, but might be worth the ask of them to offer an out of box option to always pull all, or allow the delta.

Good luck to you on whichever route you take.

Joe