Qualys Host Detection Integration deletes Discovered Items' Resource TagsIssue Starting Qualys Integration for Security Operations v10.3, Qualys Tags are shown as host_tag in the Discovered Items table. If you have Qualys Integration Instances configured in your instance and run Qualys Host List Integration followed by the Qualys Host Detection Integration, you might notice that Resource Tag ("host_tag") populated in the Discovered Items table by Qualys Host List Integration is subsequently deleted by the Qualys Host Detection Integration run. ReleaseTested in Qualys Integration for Security Operations v12.15.3CauseThe issue is caused by missing <TAGS> for the <HOST> in the XML payload received for Qualys Host Detection Integration. The XML payload attachment can be found in the Data Source of Qualys Host Detection Integration: https://__INSTANCE_NAME__.service-now.com/sys_data_source_list.do?sysparm_query=nameSTARTSWITHQualys%20Vulnerability%20Import&sysparm_view= If <TAGS> element is missing in the XML payload of the Qualys Host Detection Integration, Resource Tag ("host_tag") of the corresponding Discovered Item will be set to null even though Resource Tag was previously imported using Qualys Host List Integration. The reason for this behavior is ideally there should always be tags coming in from the scanner. The intention is to keep the latest data and if there are no tags coming from the scanner, the same will reflect on the Discovered Item.Resolution Check and confirm Integration Parameter import_tags is set to true (Default):https://__INSTANCE_NAME__.service-now.com/nav_to.do?uri=sn_sec_int_config.do?sys_id=2e5dd0bde74303006b3663c343f6a994 In the Outbound HTTP Log, make sure HTTP Query Parameter show_tags=1: If the scanner is still not returning any tags, check with your Qualys admin for any data issue. Note: Script Include QualysHostDetectionIntegration2 [sys_script_include.do?sys_id=d69e2184ff900300c68c9f783894face] references implementation configuration: https://__INSTANCE_NAME__.service-now.com/sn_sec_int_impl_config_list.do?sysparm_query=implementation%3D11418f71db9bf5501295a08d13961931&sysparm_view= , and sets the HTTP Query Parameter showTags in the following line: 183. // set the http query parameters by implementation configuration 184. restMessage.setStringParameter("showTags", this.config.import_tags ? "1" : "0"); You can also hardcode the HTTP Query Parameter show_tags Value to 1 instead of variable ${showTags} in the post method of Rest Message Qualys Host Detection - Standard:https://__INSTANCE_NAME__.service-now.com/nav_to.do?uri=sys_rest_message_fn.do?sys_id=a9d2e1369f21120034c6b6a0942e70ed Related LinksPRB1821921How to use the new Qualys tag framework