How to bring only the devices which are tagged under 'SecOps' tag in Qualys to servicenow?

[Kruthik M Shiva]

Hi All,

I have a requirement like ServiceNow VR should only ingest devices which are tagged under 'SecOps' tag in Qualys .what all need to be done in order to do this how to do these if anyone has pointers on this please do share.

Thanks in advance.

[Yousaf]

Hi,

Refer to this link: https://docs.servicenow.com/bundle/sandiego-security-management/page/product/secops-integration-vr/qualys/concept/c_QualysVulnIntegration.html#d985341e845

This might help:

Host tags

All host tags are imported as part of the Qualys Host List integration. Host tags are used primarily for filtering in Vulnerability Response Assignment and Vulnerability Group Rules. They are displayed in the Discovered Item form.

Note: The Qualys Host List integration should be run prior to creating Assignment or Vulnerability Group Rules in Vulnerability Response so that all tags can be present in the rules and before vulnerable items are imported and grouped.

• Tag storage is not case sensitive. If a San Diego tag is created, then a SAN DIEGO tag cannot be stored in the Host tag table. “San Diego” and “SAN DIEGO” are considered to be the same host tag. Whichever tag was imported first wins.
• Using host tags as a Group Key in a Vulnerability Group Rule can have unexpected results. Host tags are intended for use only in the Condition builder.
• Host tags are controlled by the global system property sn_vul.import_host_tags. This property is set to true by default. Turning tags off turns them off across all instances.

Host tags (also called asset tags) are used for organizing and tracking the assets in your organization. You can assign tags to your host assets. Then, when launching scans, you can select tags associated with the hosts you want to scan. The Host Tags module allows you to download host tag data from Qualys to your instance on a scheduled basis.

Data retrieval limitations

By default, there are no restrictions on how data is retrieved from Qualys. Many records can be related to low severity vulnerabilities that a customer is not willing to remediate using their vulnerability response process. Updating the corresponding REST message/method parameters can modify this behavior.

The REST message/method responsible for this update is Qualys Host Detection – Standard/post. To update the values, add a new HTTP Query Parameter to the post method with the following values:

• Name: severities
• Value: 3-5 (or whatever appropriate severities are desired)

[Shivam Sarawagi]

If you want to filter and bring only assets which are having specific tags you can apply below HTTP param in the REST message.

tag_include_selector=any

tag_set_by=id

tag_set_ include= 

https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf