{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45838,"path":"security-management/vulnerability-response/advanced-modifications.md","title":"Advanced Qualys configurations and modifications","bundle":null,"doc_type":null,"release":"australia","body":"\n# Advanced Qualys configurations and modifications\n\nConfigure advanced optional modifications and streamline some of the data specifically for the Qualys integration. Most of these modifications require coding or advanced ServiceNow or Qualys Cloud Platform expertise.\n\nFor more tips for Qualys imports, see the [Performance tuning tips for Qualys import jobs](https://support.servicenow.com/nav_to.do?uri=%2Fkb%3Fid%3Dkb_article_view%26sysparm_article%3DKB0863634) knowledge article in the HI Knowledge Base.\n\n## Modify the Qualys to ServiceNow priority and state mapping values\n\nModify mapping values for priority and state for your requirements.\n\n### Before you begin\n\nRole required: admin\n\n### About this task\n\nThis is an advanced customization option.\n\n### Procedure\n\n1. Navigate to **All** > **System Definition** > **Business Rules**.\n\n2. Search for **Map Qualys Values** and open it.\n\n3. Click the **Advanced** tab.\n\n4. Modify per your requirements.\n\n The most common modifications include adding new state values or revising criticality or priority.\n\n5. Click **Update**.\n\n\n## Restrict the ability to write to a record based on an assignment group\n\nYou can restrict write/read rights on records based on membership to an assigned group. Modify conditions and script based on specific requirements.\n\n### Before you begin\n\nRole required: security\\_admin \\(elevated role from admin\\)\n\n**Note:** This action is performed in the Vulnerability scope.\n\n### Procedure\n\n1. Navigate to **All** > **System Security** > **Access Control \\(ACL\\)**.\n\n2. Search for ACLs that start with `sn_vul`.\n\n3. Choose an Access Control record, for example, `sn_vul_vulnerable_item`, **Operation** **write**.\n\n4. Check the **Advanced** box in the record, if necessary, to display the **Role** entries.\n\n5. Modify the **Role** script for your requirements.\n\n Script Example of modifying access by group.\n\n ```\n answer = (current.assigned_to == gs.getUserID() || isMemberOfForScopedApp(current.assignment_group));\n // Note: standard 'isMemberOf' does not work within Scoped App\n // gs.getUser().isMemberOf(current.assignment_group);\n function isMemberOfForScopedApp(groupID){\n var result = false;\n if (groupID != ''){\n var userID = gs.getUserID();\n var now_GR = new GlideRecord(\"sys_user_grmember\");\n gr.addQuery(\"group\", groupID);\n gr.addQuery(\"user\", userID);\n gr.query();\n if (gr.next()){\n result = true;\n }\n }\n return result;\n }\n ```\n\n6. Click **Update**.\n\n\n## Set up scanner appliances\n\nIf you are initiating scans from your ServiceNow AI Platform® instead of directly from Qualys, you can set up scans for IP address ranges.\n\n### Before you begin\n\nThe data comes from the Qualys integration based on Qualys asset groups and their related default appliances \\(scanners\\).\n\nIf no appliances are configured for the targeted IP address ranges, the appliance that is set as the default for the integration instance is used for the scan.\n\nRole required: sn\\_vul\\_qualys.admin\n\n### Procedure\n\n1. Navigate to **All** > **Qualys Vulnerability Integration** > **Scanner Appliances**.\n\n2. Fill in the fields on the form, as appropriate.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nAppliance name\n\n\n\nYou are prompted to fill in this field when you create a record manually.\n\n Enter the name for the Qualys scanner appliance to be used for invoking scans for matching configuration items.\n\n Use the `External` value when you want the scan to be launched with an external scanner.\n\n
\n\nAppliance ID\n\n\n\nEnter the appliance identifier for the Qualys scanner appliance to be used for invoking scans for matching configuration items.\n\n You are prompted to fill in this field when you create a record manually.\n\n Use the `0` value when you want the scan to be launched with an external scanner.\n\n
\n\nAppliance status\n\n\n\nDisplays the last status of the scanner appliance on the data returned by the Qualys integration. For manually created records, the status is updated only if a valid **Appliance ID** is specified.\n\n
\n\nAsset group ID\n\n\n\nDisplays the Qualys asset group identifier that created this record. This field displays a value only for records created by the Qualys integration.\n\n
\n\nAsset group name\n\n\n\nDisplays the Qualys asset group name that created this record. This field displays a value only for records created by the Qualys integration.\n\n
\n\nOrder\n\n\n\nEnter a value to be used for determining scanning priority. For appliance that have conflicting criteria, an appliance with a lower order value is given a higher priority.\n\n
\n\nManually created\n\n\n\nIndicates whether this record was created manually by the user.\n\n
\n\nUse filter group\n\n\n\nSelect this check box to specify a filter group for finding matching configuration items for scanning.\n\n
\n\nFilter group\n\n\n\nSelect the filter group you want to use for finding matching configuration items for scanning. This field appears only if you selected **Use filter group**.\n\n
\n\nIPs\n\n\n\nA comma-separated list of IP addresses or ranges of IP addresses to be used by this appliance when invoking scans.\n\n
\n\nIntegration instance\n\n\n\nThe Qualys integration instance associated with this appliance.\n\n
\n\nOption profile\n\n\n\nSelect the option profile you want to use for scans for matching configuration items.\n\n
3. Click **Update**.\n\n\n## Configure and manage Qualys vulnerability scanners and scans\n\nQualys vulnerability scans can be performed to find software vulnerabilities that affect your CIs. You can initiate scans from a vulnerable item record or by creating a scan record directly for configuration items \\(CIs\\) and IP addresses.\n\nIf you scan Qualys vulnerable items directly from the Vulnerable Items screen, you also have the option of scanning multiple vulnerable items at the same time.\n\nIf Security Incident Response is activated, you can also initiate a scan from the security incident catalog, a security incident record, or a security scan request.\n\nScans submitted from Qualys vulnerable items, the Security Incident Catalog, security incidents, or security scan requests are performed by the default Qualys scanner.\n\nYou can select the option profile you want to use for scans for matching configuration items.\n\n- Option profiles contain Qualys scan settings.\n- An option profile is required when you initiate a Qualys scan from your ServiceNow AI Platform®.\n\n### Configure the ServiceNow-initiated Qualys IP scan\n\nThe Qualys scanner included with the base system provides a baseline integration to initiate scans based on IP addresses.\n\n#### Before you begin\n\nYou can select the option profile you want to use for scans for matching configuration items.\n\n- Option profiles contain Qualys scan settings.\n- An option profile is required when you initiate a Qualys scan from your ServiceNow AI Platform®.\n\nRole required: sn\\_vul\\_qualys.admin\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n#### Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Vulnerability Scanning** > **Scanners**.\n\n2. Open the Qualys record.\n\n3. Select the**Active** and **Default** check boxes.\n\n Selecting **Active** is required to use the Qualys scanner to scan Qualys VIs automatically. You also don't need to select **Default** to have it run automatically.\n\n Prior to v12.0, **Active** is required to use the scanner. If **Default** is also selected, the scanner is automatically used without having to be selected during scanning.\n\n4. For the Source integration field, click the search icon and select the option for **Qualys**, for example, **Qualys Cloud Platform**.\n\n5. Click **Update**.\n\n6. Navigate to **All** > **Qualys Vulnerability Integration** > **Administration** > **Primary Integrations**.\n\n7. Open the **Qualys Asset Group List Integration**.\n\n 1. Select the **Active** check box.\n\n 2. Click **Execute Now**.\n\n8. Follow these steps to populate your scanner appliances.\n\n **Note:** You might prefer to run the Option Profile List Integration after an import from the Search Lists Integrations, the Qualys Dynamic Search List, and Qualys Static Search List Integrations, so that you can see which search lists are associated with option profiles.\n\n 1. Open the **Qualys Option Profile List Integration**.\n\n 2. Select the **Active** check box.\n\n 3. Click **Execute Now**.\n\n 4. Follow the steps listed in [Set up scanner appliances](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/advanced-modifications.md) to configure your scanner appliances.\n\n Return here after you complete those steps to continue with the configuration.\n\n 5. Navigate to **All** > **Qualys Vulnerability Integration** > **Administration** > **Primary Integrations**.\n\n 6. Open the **Qualys Appliance List Integration**.\n\n 7. Select the **Active** check box.\n\n 8. Click **Execute Now**.\n\n Your Qualys scanner appliances are now correctly populated.\n\n\n**Related topics** \n\n\n[Understanding the Qualys Vulnerability Integration]()\n\n### Scan multiple Qualys vulnerabilities or vulnerable items\n\nYou can simultaneously scan multiple Qualys vulnerabilities or vulnerable items that contain at least one affected configuration item \\(CI\\) or an IP address populated on the form.\n\n#### Before you begin\n\nRole required: sn\\_vul.vulnerability\\_write\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n#### Procedure\n\n1. Do one of the following:\n\n - Navigate to **All** > **Vulnerability Response** > **Remediation Tasks**.\n - Navigate to **All** > **Vulnerability Response** > **All Vulnerable Items**.\n2. Select the check boxes for the records you want to scan.\n\n3. Click the **Actions on selected rows** list, and click **Re-scan for Vulnerable items**.\n\n A message appears with a link to the scan and the work notes are updated.\n\n4. Click the link to see the progress or results of the scan.\n\n\n### Configure the Qualys auto scan for resolved remediation tasks\n\nYou can schedule the scan that runs automatically to update your Qualys vulnerable items.\n\n#### Before you begin\n\nAfter a remediation task is transitioned to **Resolved**, a scan is initiated automatically to update the state of the associated vulnerable items.\n\n- The scan is disabled by default.\n- Enable the scan with the **scan\\_on\\_resolved** integration instance parameter in the **Qualys** record located at **All** > **Qualys Vulnerability Integration** > **Integration Instances** > **Qualys**. See the following steps for more information.\n- This scan is instance-specific. If you have multiple instances and you want to enable or disable this scan, you must disable the **scan\\_on\\_resolved** parameter in the integration instance parameters in each instance you want changed.\n- When the scan is enabled, you can initiate the scan on-demand, or you can schedule the scan to run only within a specified time window. See [Configure Qualys rescans to run only within scheduled intervals](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/advanced-modifications.md) for how to set the start and end times for the time window.\n\nRole required: sn\\_vul\\_qualys.admin\n\n#### Procedure\n\n1. Navigate to **All** > **Qualys Vulnerability Integration** > **Administration** > **Integration Instances**.\n\n2. Select **Qualys** to open the record.\n\n The Integration Instance Parameters for Qualys are displayed on a tab.\n\n3. To enable the auto scan, locate the **scan\\_on\\_resolved** parameter.\n\n4. In the Value column for the property, enter `true`.\n\n5. Click **Update**.\n\n\n### Configure Qualys rescans to run only within scheduled intervals\n\nFor the Qualys Vulnerability Integration, set the scan start and end time parameters so that rescans run, or are available, only during the hours that you want.\n\n#### Before you begin\n\nThis configuration applies to both scheduled rescans and the rescans you initiate manually in the Qualys product from your ServiceNow AI Platform® instance.\n\nSetting the scan start and end time parameters for integration instances permits you to specify time windows when rescans in the Qualys product are available. For example, you might prefer to specify that rescans are only available during off-hours, for example, midnight to 10 AM.\n\nThis setting is instance-specific. If you have multiple instances, you must configure the scan\\_start\\_time and scan\\_end\\_time values in the integration instance parameters in each instance you want to change.\n\nRole required: sn\\_vul\\_qualys.admin\n\n#### Procedure\n\n1. Navigate to **All** > **Qualys Vulnerability Integration** > **Integration Instances** > **Qualys**.\n\n2. Click **Qualys** to open the record.\n\n The integration instance parameters for Qualys are displayed.\n\n3. For the scan\\_start\\_time parameter, in the Value column, enter the time in the UTC time zone in 24 hour format \\(00:00 through 24:00\\) for the start time of the window that you want rescans available.\n\n4. For the scan\\_end\\_time, in the Value column, enter times in the same format \\(00:00 through 24:00\\) for the end time of the available window.\n\n For example, if you enter a start time of 00:00 for the scan\\_start\\_time parameter, and an scan\\_end\\_time of 10:00 AM that same morning, scans scheduled or manually launched outside of the midnight to 10 AM time window are queued and launched at the start time of the following day's time window, 00:00.\n\n In the same example, if a remediation owner manually initiates a rescan at 11:00 AM, the rescan is not immediately launched, because it lies outside of the available configured scan times. The scan request remains queued until the start of the following day's time window, in this example, \\(00:00\\).\n\n5. Click **Update** to save your settings.\n\n\n### Qualys vulnerability scan rate limits\n\nYou can define the rate that different types of scans are performed to limit the number of requests that are sent to an external scanner. After you have defined rate limits, you can apply them to the Qualys scanners.\n\n#### Define Qualys scan rate limits\n\nYou can define the rate that different types of scans are performed to balance the load in your scan queue. Conditions defined in the rate limit determine whether the rate limits are applied to queued entries.\n\n##### Before you begin\n\nRole required: sn\\_vul.admin\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n##### Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Vulnerability Scanning** > **Rate Limit Definitions**.\n\n2. Click **New**.\n\n3. Fill in the fields on the form, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Name|Provide a descriptive name that identifies the conditions the queue entry must meet. For example, scans per minute|\n |Queue conditions|Enter conditions used to determine whether a queued scan entry is subject to this rate limit. The conditions should not be specific to a particular scanner.|\n |Evaluation script|Write a script with the logic to evaluate the queued entry. It is important that the script return true/false to define whether the entry is processed. Also, base the evaluation script on the queued entry being evaluated.|\n\n4. Click **Submit**.\n\n\n#### Apply scan rate limits to Qualys scanners\n\nAfter you have defined scan rate limits using **Rate Limit Definitions**, you can apply rate limits to specific Qualys scanners.\n\n##### Before you begin\n\nRole required: sn.vul\\_admin\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n##### Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Vulnerability Scanning** > **Scanner Rate Limits**.\n\n2. Click **New**.\n\n3. Fill in the fields on the form, as appropriate.\n\n |Field|Description|\n |-----|-----------|\n |Scanner|Select the scanner to which you want to apply a rate limit.|\n |Rate limit|Select the rate limit you want to apply to this scanner.|\n |Threshold|Enter the threshold that you want to subject the selected scanner to for the selected rate limit. For example, if the scanner allows 4 scans per minute, and the rate limit is defined as requests per minute, the threshold would be 4.|\n\n4. Click **Submit**.\n\n\n### View the Qualys vulnerability scan queue\n\nVulnerability scan requests submitted to Qualys vulnerability scanning integration are queued so as not to overload system resources. You can view the status of queued requests, as needed.\n\n#### Before you begin\n\nRole required: sn\\_vul.vulnerability\\_admin or sn\\_vul.admin \\(deprecated\\)\n\nPersona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see [Assign the Vulnerability Response persona roles using Setup Assistant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-assign-personas_SA.md). For more information about managing granular roles, see [Manage persona and granular roles for Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_manage_granular-roles.md).\n\n#### About this task\n\nIn the list of queued scans, each scan includes an automatically generated scan name that identifies the CI that was scanned.\n\n#### Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Vulnerability Scanning** > **Scan Queue**.\n\n All Qualys scan requests that have been submitted are shown in a list. The **State** column shows the current state of each queued entry. A state of **Complete** indicates that the scan has left the queue. It does not necessarily indicate that the scan has completed processing. When the scans have been completed or if they failed, the **Processing** column shows the appropriate work notes text.\n\n **Note:** If a hash value was submitted for scanning and the scanner fails to find a result, the **State** shows **Complete** and the work note in the **Processing** column indicates **Unknown**.\n\n2. After a scan has finished processing, click a queued record to view details for the scan request.\n\n\n### Enable base system filter for confirmed detection imports\n\nEnable a default filter using integration parameters to import only confirmed detections from Qualys Cloud Platform.\n\n#### Before you begin\n\nRole required: sn\\_vul\\_qualys.admin, sn\\_vul.vr\\_import\\_admin\n\n#### About this task\n\nA base system integration instance parameter “include\\_only\\_confirmed” is available to import a filtered list of detections from Qualys Cloud Platform. By default, this parameter is set to *FALSE*, and all detections whether potential, confirmed, or informational are imported.\n\n#### Procedure\n\n1. Navigate to **All** > **Qualys Vulnerability Integration** > **Administration** > **Integration Instances**.\n\n2. Open the Qualys Cloud platform integration from the Integration instances list.\n\n3. From the Integration Instance Parameters list, open the '**include\\_only\\_confirmed**' parameter.\n\n4. Update the default value to *True*.\n\n5. Click **Update**.\n\n You have enabled the filter to import confirmed detections from the Qualys Cloud Platform integration.\n\n\n#### Result\n\nBy default, only confirmed detections from the Qualys Cloud Platform integration are imported when the next Qualys Vulnerability Import runs. All other detections such as informational and potential are ignored and not imported. For more information, see [View Vulnerability Response vulnerable item detection data](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr_view_detection.md).\n\n### Initiate rescan for the Qualys Vulnerability Integration\n\nVerify your vulnerable items have been remediated between scheduled scanning cycles by initiating rescans in the Qualys product from your ServiceNow AI Platform on-demand.\n\n#### Before you begin\n\nYou can initiate rescans from the Vulnerability Response workspaces. For more information, see [Rescan records and remediation tasks in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-rescan-vi-VMGR.md) and [Rescan vulnerable items and remediation tasks in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/vr-ws-rescan-vi-rt.md).\n\nFor rescans in the classic environment, see the following sections for how to initiate rescans.\n\nRequired setup for rescans in the Qualys product initiated from your ServiceNow AI Platform:\n\nYou can initiate a rescan on-demand for vulnerable items for the Qualys product from your ServiceNow AI Platform® instance.\n\nTo help reduce the overhead and volume involved with scheduled, full scans, remediation owners, IT specialists, vulnerability analysts, or vulnerability managers can initiate targeted rescans on-demand for specific vulnerabilities on assets \\(configuration items\\) in their environments. You can initiate rescans in the Qualys product from vulnerable item \\(VI\\), remediation tasks \\(RT\\), third-party entry \\(TPE\\), or discovered item records from your ServiceNow AI Platform instance.\n\nRescans permit you to verify that your remediation activities, patches, and other actions have successfully fixed specific vulnerabilities on your configuration items \\(CIs\\).\n\nUse case:\n\nAs an example, say your entire environment is scanned once every three weeks. The most recent full scan was completed a week ago, but you applied a patch yesterday to fix a critical vulnerability. Due to the nature of this vulnerability, you cannot wait two weeks for the next scheduled scan to verify that it has been remediated. To verify that your patch successfully fixed a critical vulnerability discovered during an earlier scan, you can initiate a targeted rescan from your ServiceNow AI Platform for Qualys vulnerable items.\n\nYou can initiate rescans for VIs that have Qualys as the source in states other than closed. See [Rescan records and remediation tasks in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-rescan-vi-VMGR.md) and [Rescan vulnerable items and remediation tasks in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/vr-ws-rescan-vi-rt.md).\n\nVerify you have completed the following setup required for rescans. See the steps starting with Configure and manage Qualys vulnerability scanners and scans listed in the previous sections for more information.\n\nRole required: sn\\_vul\\_manually\\_initiate\\_rescan\n\n#### Procedure\n\n1. Navigate to **All** > **Vulnerability Response** > **Vulnerable items**.\n\n2. Locate the vulnerable item record that you want to trigger a rescan from and open it.\n\n **Note:** You can only initiate rescans for VIs with Qualys as the source. Verify Qualys is displayed in the **Source** column on the VI List views, or in the **Source** fields on individual records. You can use the condition builder to group VIs by Source. Or, if the Source column is not displayed on the VI List view, in the upper left of the list, click the**Personalize List** icon \\(Gear icon\\) and use the Slushbucket to move **Source** from **Available** to **Selected**.\n\n3. Alternatively, navigate to **All** > **Vulnerability Response** > **Remediation Tasks**, **Vulnerability Response** > **Libraries** > **Third-Party**, or to **Discovered items** for the remediation task, third-party entry, or discovered items records, respectively, that you want to use for the rescan.\n\n Depending on your choice, the **Rescan** button is available on the following records:\n\n - On a single VI record, the VI must be from the Qualys product and in any state other than **Closed**. For multiple VI records, all the VIs must have Qualys as the source and in any state other than **Closed**.\n - On an RT record, the remediation task can be in any state other than **Closed**, and all the associated VIs must have Qualys as the source.\n - On a third-party entry \\(TPE\\) record, the record must have at least one associated VI record in any state other than **Closed** with Qualys as the source.\n - On a discovered item record, the configuration item has at least one associated VI with Qualys as the source in any state other than **Closed**.\n4. In the upper right of the record you chose, click **Rescan**.\n\n In the dialog that is displayed, choose one to continue.\n\n\n
\n\nOption\n\n\n\nDescription\n\n
\n\nSelect the **Specify option profiles** check box.\n\n\n\nFrom the list, choose the option profile for the Qualys scanner you want to use for the rescan. These are the appliances \\(scanners\\) you have configured and listed at **Qualys Vulnerability Integration** > **Scanner Appliances**.\n\n
\n\nClear the **Specify option profiles** check box \\(not selected\\).\n\n\n\nThe Qualys option profile for the scanner you have set as your default scanner on the Scanner Appliances list is used for the scan.For more information about setting the default scanners you initiate from your ServiceNow AI Platform, Setup scanner appliances listed in the previous section for more information.\n\n
5. Select **Request Scan**.\n\n A message is displayed that indicates your scan is being processed. Status for all rescans can be found at any time under the Scan related lists on the VI, RT, TPE, and discovered item records you used to launch the rescans. In the message, click **View details** to view the status of the rescan and view any other rescans launched from a given record.\n\n Your instance tracks the rescan status until it successfully completes, or until the set tracking period times out, whichever happens first. The time-out does not stop the scan. The time-out refers to when the ServiceNow AI Platform stopped tracking your rescan status, not when the actual rescan stopped.\n\n After the rescan is successfully completed, the Qualys Host Detection Integration is automatically initiated to update your vulnerable items. Depending on how many VIs you have, your detections, VIs and RTs are updated after the completion of the Qualys Host Detection Integration scan. Navigate to these records to view the updates after the Host Detection Integration is completed.\n\n This scan is instance-specific and can be disabled. For more information about the Qualys integrations and how to view the integrations, see [Understanding the Qualys Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/c_QualysVulnIntegration.md).\n\n\n#### What to do next\n\nYou can view a .csv attachment on the scan record to see details about the rescans.\n\nAs shown in the previous image, during the rescan, if hosts \\(configuration items\\) in your environment are not accessible, any detections and VIs associated with these assets are not updated when the rescan is completed. To help you understand why they are not included, after the rescan is completed, the asset IP addresses for these CIs are listed on Vulnerability records in the Hosts not scanned field.\n\n"}}