Have you performed an initial load of the Qualys Host Detection Data already, and are now working towards trimming down the amount of data brought in for delta / subsequent loads? Or, are you trying to perform the initial Qualys import for the first time to begin with?
I think there is potentially an issue with the <date> parameters being used here. The API query is specifying two different date / time filters (i.e. API Parameters) that may be conflicting with each other, depending on the scenario of initial load vs subsequent load, and your particular use-case.
https://qualysapi.<qualys>.eu/api/2.0/fo/asset/host/vm/detection/?output_format=XML&detection_updated_since=2018-07-18T17:36:33Z&show_tags=1&action=list&vm_scan_since=2018-07-18T17:36:33Z&truncation_limit=500&status=New,Fixed,Active,Re-Opened
Referring to the Qualys docs, <detection_updated_since> is used to filter on detections where a change in status has occurred since a specified date (regardless of how many times you've scanned the asset, it will only bring in data for the assets where vulnerability finding's statuses have changed between New, Fixed, Active and Re-Opened, in Qualys).
So, if the states for Qualys Host Detections / findings have not changed since Jul 18, 2018, no data will be pulled into the payload that is returned based on the API parameter being passed here.
This API parameter could be beneficial for delta / subsequent loads, after an initial load has been performed so that you limit the data periodically being brought in.
As per Qualys Docs --> detection_updated_since={date}
(Optional) Show only detections whose detection status have
changed since a certain date. For detections that have never
changed the date is applied to the last detection date. Valid date
format is: YYYY-MM-DD format (UTC/GMT), like “2016-01-11”
One of these parameters may be specified in the same request:
detection_updated_since, max_days_since_detection
vm_scan_since
This parameter works at the host level, not at the vulnerability finding level. This works to bring in findings for hosts that have been scanned & processed since a certain time. All vulnerabilities from previous scans will be included (by default) since the Host List Detection API leverages Host Based Findings.
Qualys has some good documentation that reviews <vm_scan_since> here:
- https://blog.qualys.com/technology/2014/07/23/download-your-vm-data-faster
Also, check out "Modify REST message parameters to affect data retrieval" - Step 6 from the SN Docs page, going over steps to add <detection_updated_since> and deleting <vm_scan_since>:
- https://docs.servicenow.com/bundle/kingston-security-management/page/product/secops-integration-qualys-vulnerability/concept/optional-modifications.html#modify-rest-msg-params
I do not see <severities> values specified in the API call. You may want to validate which severity values should be brought in from Qualys (i.e. 5, 4, 3, 2, 1) and ensure it is configured on the REST API call made from ServiceNow (following the instructions from the SN Docs page above).
Lastly, if you have not checked it out already - Postman is a good tool to use for ensuring your credentials work and your API call + parameters are tuned appropriately. Check out the Postman section at the bottom of the page here:
- https://community.qualys.com/docs/DOC-4523-qualys-api-client-examples#jive_content_id_Web_browser_Chrome_Postman
