Qualys Host Import (cmdb_ci) transformation map does not utilize the cmdb 'Identification and Reconciliation' engine and could lead to duplicates - Known Error

Qualys Host Import (cmdb_ci) transformation map does not utilize the cmdb 'Identification and Reconciliation' engine and could lead to duplicates Description Qualys primary and supporting integrations enrich the vulnerability data on your instance by retrieving data from the Qualys integration.

When using CMDB, SCCM and Qualys to import CMDB CI records, there is potential for duplicate CI's, due to Qualys not calling the cmdb 'Identification and Reconciliation' engine when performing the CI lookup upon transformation.

Steps to Reproduce

1. Import data from Qualys with a record with a name not in the CMDB but available as reconciliation alias on CMDB.

2. Transform the data. A new duplicated CMDB record will get created.

Workaround After carefully considering the severity and frequency of the issue, and the cost and risk of attempting a fix, it has been decided to not address this issue in any current or near future releases. We do not make this decision lightly, and we apologise for any inconvenience.

The transformation map 'Qualys Host Import (cmdb_ci)' runs a source script invoking the ' QualysSimpleCITransform ' script include, with the ' lookupSysId ' function attempting the field-coalesce:

lookupSysId: function(source) { return sn_vul_qualys.QualysUtil.get().lookupCISysId(source.u_qg_hostid + "", source.u_id + "", source.u_ip + "", source.u_dns + "", source.u_netbios + "", false); }, Both CMDB and SCCM call the engine so that there is no conflict when processing tries to insert/update cmdb ci records. However, since the Qualys HOST import does not cal the IRE engine, there is the possibility of duplicates.

To avoid the problem, customize the QualysSimpleCITransform script include adjusting to meet the case requirements.