Qualys has a great Article that outlines the different asset / entity IDs they employ:
- https://success.qualys.com/support/s/article/000006216
One thing to keep in mind with the QG_HOSTID aka the GUID in Qualys
- This is not used on every single asset that Qualys is assessing
- Most importantly, this won't apply to devices hit with an unauthenticated scan
- This applies to devices that are using the Qualys Agent or hit with an authenticated scan
In the ServiceNow Qualys VR integration, the Source ID of the Discovered Item record - uses the Qualys Host ID
The Qualys Host ID is present across the board -> for assets hit with an unauthenticated scan, authenticated scan, agent, etc, and refers to an IP interface on that host / asset.
You may see some devices with multiple IP interfaces, having multiple Source IDs but a single GUID as described in that Qualys article. In turn, you would see multiple Discovered items pointing to the same Host / CMDB CI in ServiceNow.
