{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":46060,"path":"security-management/vulnerability-response/qualys-troubleshooting.md","title":"Resolving Qualys Vulnerability Integration issues","bundle":null,"doc_type":null,"release":"australia","body":"\n# Resolving Qualys Vulnerability Integration issues\n\nSome commonly encountered issues, along with workarounds are discussed.\n\n## Attachments not appearing after import\n\nIf attachments are not appearing as expected for data sources or on a security incident after third-party integration imports, check your IP restrictions.\n\nIP access restrictions can prevent attachments from being seen unless you are logged in from a safe IP. Since a new attachment is added with each import, this can result in duplicates you have to remove.\n\nFor example, when you run a third-party host import integration, if you do not see any attachments on your data sources, check your IP restrictions and add users to the safe list prior to import.\n\n## Modify transform maps\n\nTransform maps are provided with base configurations and are sufficient usually. You can modify transform mappings depending on the needs of your organization.\n\n### Before you begin\n\nRole required: sn\\_vul\\_qualys.admin + import\\_admin\n\n### Procedure\n\n1.  Navigate to **All** > **System Import Sets** > **Administration** > **Transform Maps** to view the REST messages.\n\n2.  Filter the resulting list by application, and limit the list to the **Qualys Vulnerability Integration** application.\n\n3.  Modify the transform maps per the customer requirements.\n\n    For details on the data provided by the Qualys API, see the [Qualys API documentation](https://www.qualys.com/docs/qualys-api-v2-user-guide.pdf).\n\n\n## Check XML attachment property size\n\nVerifies that the XML attachment property is sufficient for large files.\n\n### Before you begin\n\nRole required: admin\n\n### Procedure\n\n1.  Navigate to **All** > **System Properties** > **Import Export**.\n\n2.  Scroll down to **Import Properties** > **XML Format** at the bottom of the page.\n\n    \\[Omitted image \"XMLFileSize.jpg\"\\] Alt text: Maximum file size for import\n\n3.  If necessary, change the value to 250 and click **Save**.\n\n\n**Related topics**  \n\n\n[Available system properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/r_AvailableSystemProperties.md)\n\n## Data retrieval limitations\n\nBy default, there are no restrictions on how data is retrieved from Qualys. Many records can be related to low severity vulnerabilities that a customer is not willing to remediate using their vulnerability response process. Updating the corresponding REST message/method parameters can modify this behavior.\n\nThe REST message/method responsible for this update is **Qualys Host Detection – Standard/post**. To update the values, add a new HTTP Query Parameter to the post method with the following values:\n\n-   Name: severities\n-   Value: 3-5 \\(or whatever appropriate severities are desired\\)\n\n## Resolving Qualys Knowledge Base Integration failure\n\nResolve Qualys Knowledge Base Integration failure by reducing the payload attachment size received from Qualys to the specified limit.\n\n### Before you begin\n\nRole required: sn\\_vul.vulnerability\\_admin\n\n### Procedure\n\n1.  Ensure that the payload attachment size is within the specified limit.\n\n    1.  Navigate to **All** > **Qualys Vulnerability Integration** > **Integration Instances**.\n    2.  Select the **Integration Instance Parameters** tab.\n    3.  Select **max\\_delta\\_days** and modify the default value to 3.\n2.  If the integration still fails, perform the following steps:\n\n    1.  Navigate to **All** > **Qualys Vulnerability Integration** > **Primary Integrations**.\n\n    2.  Select **Qualys Knowledge Base**.\n\n    3.  Select the **Integration Details** tab.\n\n    4.  In the **Start time** field, select the current date to skip the execution of the run for that day.\n\n    5.  Navigate to **All** > **Qualys Vulnerability Integration** > **Integration Instances**.\n\n    6.  Select the **Integration Instance Parameters** tab.\n\n    7.  Select **kb\\_backfill\\_full\\_import** and modify the default value to true.\n\n\n### Result\n\nRunning the Qualys Knowledge Base Backfill integration updates all the third-party entries \\(TPEs\\) in the system. While the Qualys Host Detection integration creates a placeholder entry, the Qualys Knowledge Base Backfill integration updates it.\n\n"}}