Hey there,
It's driven by the Qualys PC attributes ...
"Change in status" -- means change in the Qualys PC Result Status -- the filtering here is based on data in Qualys PC not ServiceNow
Let's say on your Qualys PC Result Job - the `Import Since` is set to May 1, 2022
- This translates to the API request going to Qualys PC as "hey Qualys, give me all compliance posture results, that have had a status change since May 1, 2022..."
- This will bring in Qualys PC Results (Compliance check for a control on a host) - where the Qualys PC Result Status has changed since May 1, 2022
- This will exclude Qualys PC results that had their status change prior to May 1, 2022 -- even if they are continuously evaluated every single day from May 1 to May 26 as FAILED over and over again
- For example, Qualys PC FAILED Results that had their Status initially set or last changed in Jan 2022, Feb 2022, March 2022 -- would not be brought into ServiceNow
- For Qualys PC Results that were in a FAILED Status long before May 1, 2022 - those would not be brought into ServiceNow
- Even if those same Qualys PC Results are evaluated every day as FAILED over and over again - between May 1 and May 26 - they would not be brought into ServiceNow
- Change in Qualys PC Status maps to the Qualys PC Result (FAILED <-> PASSED <-> ERROR)
Backdating the 'Import since' on the Qualys PC job for the very first import can be used to initially set the benchmark / pre-seed the data, and from that point forward only delta updates are bought in daily.
After the first initial import (with the back dated 'Import since') -- actionable data will be brought into ServiceNow from that point forward... i.e. Qualys PC results with a status change (FAILED <-> PASSED <-> ERROR)...
Keep in mind - this will also impact how the the 'Last seen' field on ServiceNow CC Test Results is maintained due to the filtering limiting Qualys PC Results based on 'Status changes since'... ('Last seen' won't be updated every time a host is evaluated against a control over and over, unless the Status of the Qualys PC Result changes)...
