Qualys API's for Web Application scanning and PC

[Steve160]

We are an MSP,  a client is considering using his Qualys investment for Web Application (WAS) and CIS benchmark (PC) scanning to support FedRAMP accredidation requirements.   We are told by Qualys that API’s do not currently exist for importation of the WAS, and PC scan data but it is on the ServiceNow Roadmap as SN develops the API’s not Qualys.  Can you advise if it is on Roadmap and a target release date?

[Alex Cox · Accepted solution]

Hi there,

ServiceNow's Configuration Compliance app supports Qualys Policy Compliance (PC) today in the London and Kingston releases, out of the box - so that's some good news for you!

ServiceNow's APIs are comprehensive and do support the ability to load web application scan data as well. Ultimately two tables should be loaded:

• Third Party Vulnerabilities - a table designed to save vuln definitions from vendors like Qualys
• Vulnerable Items - a table to pair vuln defs with a given CI or hostname

These tables can be loaded via the REST API from a Qualys --> ServiceNow standpoint,  or instead as a pull from Qualys REST API to ServiceNow.  See Data sources, Import Sets and Transform Maps in Docs for more info on these techniques.

Unlike Policy Compliance, there is not an out of the box connector for this info at this time, but it is certainly possible to establish using the methods above. I imagine you would like this feature, so I'll forward a request on your behalf to Product Management.

Alex

[Steve160]

Hello Alex,

Thanks very much for the insights and direction.  It is greatly appreciated.  Our engineering team made terrific progress this past weekend thanks to your guidance.   Best regards Steve

[ESkogquist]

Alex,  Also working to have Qualys Policy and Compliance data brought into the VR application.  If you could please add another vote for this enhancement, that would be appreciated.

Interested in if there is any advancement, as we will be looking to build this REST API call in the coming months.  Thanks!

[Alex Cox]

Hello devsite,

There is now support for Qualys Policy & Compliance data, using the Configuration Compliance application.  This works very similarly to VR, but the data model is quite different!

Here is a link to the docs landing page for that application:

https://docs.servicenow.com/bundle/orlando-security-management/page/product/vulnerability-config-com...