Hey there,
Given that the datasets are separated without a direct reference to dot-walk, I can think of two comprehensive approaches worth considering:
One way would be to create a database view (https://docs.servicenow.com/bundle/london-performance-analytics-and-reporting/page/use/reporting/concept/c_DatabaseViews.html) which is a little tricky to learn at first, but quite powerful. The slightly downside to this method would be that it will take the report a little while to run since the view is constructed at report time.
Another option would be to maintain a custom date field on the cmdb_ci table, such as "u_last_qualys_scan" and keep populate that updated with a business rule on the sn_vul_vulnerable_item that has this basic logic:
On update/insert when state is not closed/deferred/etc and last_found (or last updated by Qualys) is not blank:
Update current.cmdb_ci.u_last_qualys_scan (or the name of your field) with the value of current.last_found (or last updated by Qualys)
Consider using setWorkflow(false) to prevent business rules and workflows from firing when you find and update the current.cmdb_ci record.
Once this data is on the cmdb_ci table it would easier to directly run a report on that table. The downside of this would be that you wouldn't have the data available right away, but it would trickle in with each Qualys update.
Hope this helps!
Alex
