Third Party Vulnerability Entry (QID)

[Khanna Ji]

I have integrated Qualys with ServiceNow and it started created items and groups with Qualys Ids (QIDs). The issue with these QIDs is that Threat and Solution fields are coming as blank. There must be some information about this third party vulnerability. 

What do you think? Is Qualys sending a blank info or I am missing something?

[andy_ojha]

You can look at the raw XML data that pertains to the Qualys Knowledge Base payload, that was sent to ServiceNow from Qualys, to do some further investigating...  You can validate if the relevant information is there, and see if there are any "API error messages" in the payload as well.

Also, have you tried running the Qualys Knowledge Base Backfill job yet?

[Chris McDevitt]

Swathi,

Here is the load order for this data:

1. Load the CWE Data: Vulnerability > Administration > Integrations Then CWE Comprehensive 2000 Integrations (Run this job)

- Wait for it to complete

2. NVD data: Vulnerability > Administration > NVD Auto-update

- Load everything it is small

- Make sure you add any missing years (copy an existing entry and update the URL: https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-2017.xml.zip)

- Wait for it to complete

3. Qualys Knowledge Base: Qualys Vulnerability Integration > Administration > Primary Integrations Then Qualys Knowledge Base (Run this job)

- Assume that you set up Qualys integration

- Wait for the job to complete

You can re-run these jobs to grab the data.

Troubleshooting:

Download Postman and pull a single KB and make sure the info is coming over:

https://qualysguard.qualys.com/api/2.0/fo/knowledge_base/vuln/?action=list&details=All&ids=176509

(Your URL may vary)

Please mark this as helpful or correct so others can benefit from our conversation.

[Khanna Ji]

1. Load the CWE Data: Vulnerability > Administration > Integrations Then CWE Comprehensive 2000 Integrations (Run this job)


- Wait for it to complete

I have done this just now but I do not see any data.

[Chris McDevitt]

Should populate here:

[Khanna Ji]

I see data here, 1138 records in my system.