Qualys Vulnerability Integration - Need few suggestions from experts

[James234]

Hi Secops Experts,

I am planning to integrate ServiceNow vulnerability application with Qualys Vulnerabilities for pulling in data to ServiceNow. What is your suggestion for this integration on data consideration.

1) Should I pull all vulnerabilities or based on some date configuration or vulnerability priority? Where would I find a configuration to consider the date range for vulnerabilities?

2) Is it required to consider -  Qualys Appliance List Integration, Qualys Asset Group Integration, Qualys Dynamic Search List Integration, Qualys Host Detection Integration, Qualys Knowledge Base, Qualys Knowledge Base (Backfill), Qualys Static Search List Integration

Please highlight is there is anything else that I need to consider for managing vulnerabilities in ServiceNow?

[jonathanwalker]

Yes, the CI field on the Vuln. Item record will always be populated.

It can be populated in 1 of 2 ways...

1. SNOW has that CI in the CMDB and it has been matched to a Qualys found CI upon host import, then matched & populated in the CI reference field on the Vuln. Item record because Qualys has found a vuln. on that CI
2. SNOW does not have that CI in the CMDB...in that case, when there is no match to what's in the CMDB & what Qualys has, then a new CI will be created in the sn_vul_qualys_ci table...Then that CI will the one referenced in the CI field in the vuln. item record

[James234]

Also Jonathan - Can you confirm should I use Group rules for creatin vulnerability groups based on Vulnerability or Configuration Item or both?

In base platform, Group Rule with Vulnerability is already provided.

Appreciate your time and support.

[jonathanwalker]

The use of group rules allows you to create them to match your "remediation ownership" methodology.  So you can dot walk to use any field from the vulnerability, or CI.  For instance some customers remediation ownership methodology aligns by "OS" (IE:  windows patch team, linux patch team, network device, etc...)  Some customers use the CI owner, or application owner, or business service owner.

But based on your previous question about CI population on the Vuln. Item record, and not having CI's in the CMDB...this exercise may be challenging for you at 1st, with no defined CI ownership in the CMDB.

[James234]

Exactly. As of now, we do not have CMDB setup. So I was thinking to provide one of the below solution. 1) Group Rule with just vulnerability (Base Rule) 2) Group Rule with Vulnerability and CI. What do you think, which one should I go with? Do you have any other recommendations till we setup CMDB data?

[jonathanwalker]

How do you want the data grouped?

• A Vuln. Group that has all vulnerable items grouped with ONLY that one vulnerability but that vulnerability on all CI's it's been found on? (BASE RULE)

---OR--

• A Vuln Group that has all vulnerable items grouped with any & all vulnerabilities found, but on only one CI?

For your scenario I'd probably go w/ the 2nd option.

If you can group the CI's by naming convention or subnet or something and know you'd want to assign those to a specific remediation owner...you may be able to use a filter condition to get some better grouping.

You may want to just setup the integration & take a look at the data that comes in both for the Qualys created CI's & the vulns...and then come up w/ the best methodology you can (understanding the data & your organizational intricacies) for setting up the group rules.