ServiceNow Qualys Integration Guide

Architecture Overview

Implementation Steps

// Configure vulnerability import with date filtering
var dateFilter = new GlideDateTime();
dateFilter.addDaysLocalTime(-30);

var importParams = {
    'connection': 'Qualys VMDR Connection',
    'filters': {
        'since': dateFilter.getDisplayValue(),
        'status': 'New,Active,Fixed'
    },
    'batch_size': 100
};

// Log import parameters for troubleshooting
gs.info('Starting Qualys vulnerability import with parameters: ' + JSON.stringify(importParams));

// Response rule script for critical vulnerability incident creation
(function() {
    var vulnGR = new GlideRecord('sn_vul_vulnerable_item');
    vulnGR.get(current.sys_id);
    
    var incident = new GlideRecord('incident');
    incident.initialize();
    incident.short_description = 'Critical Vulnerability: ' + vulnGR.vulnerability.title;
    incident.description = 'CVSS Score: ' + vulnGR.vulnerability.cvss3_score + '\nAffected Asset: ' + vulnGR.configuration_item.name;
    incident.priority = '1';
    incident.category = 'Security';
    incident.assignment_group = vulnGR.configuration_item.support_group;
    incident.configuration_item = vulnGR.configuration_item;
    incident.insert();
    
    gs.info('Created incident ' + incident.number + ' for critical vulnerability ' + vulnGR.vulnerability.cve);
})();

// Script to update Qualys vulnerability status after ServiceNow remediation
var updateQualys = new sn_ih_orchestration.IntegrationHub();
var qualysAction = updateQualys.getAction('Qualys', 'Update Vulnerability Status');

qualysAction.setParameter('connection_alias', 'Qualys VMDR Connection');
qualysAction.setParameter('vulnerability_id', current.external_id);
qualysAction.setParameter('status', 'FIXED');
qualysAction.setParameter('comments', 'Remediated via ServiceNow incident ' + current.incident.number);

var result = qualysAction.execute();
if (result.getStatusCode() == 200) {
    gs.info('Successfully updated Qualys vulnerability status for ' + current.vulnerability.cve);
} else {
    gs.error('Failed to update Qualys vulnerability status: ' + result.getErrorMessage());
}

// Integration health monitoring script
var healthCheck = new GlideRecord('u_integration_health');
healthCheck.initialize();
healthCheck.integration_name = 'Qualys VMDR';
healthCheck.last_successful_run = new GlideDateTime();

// Check for recent vulnerability imports
var vulnCount = new GlideAggregate('sn_vul_vulnerable_item');
vulnCount.addQuery('sys_created_on', '>=', gs.daysAgoStart(1));
vulnCount.addQuery('source', 'Qualys');
vulnCount.query();

healthCheck.daily_record_count = vulnCount.getRowCount();
healthCheck.status = vulnCount.getRowCount() > 0 ? 'Healthy' : 'Warning';
healthCheck.insert();

gs.info('Integration health check completed: ' + vulnCount.getRowCount() + ' vulnerabilities imported today');

Common Use Cases

Troubleshooting

Pro Tips

• →Configure vulnerability import workflows to run during maintenance windows to minimize impact on system performance, and implement circuit breaker patterns that automatically disable imports if error rates exceed 10% to prevent cascade failures. Use ServiceNow's scheduled script execution monitoring to track import job performance and set up automated alerts when processing times exceed baseline metrics.
• →Leverage ServiceNow's transform map scripting capabilities to enrich Qualys vulnerability data with business context during import, such as adding asset owner information from CMDB relationships or calculating business risk scores based on service dependencies. This real-time enrichment eliminates the need for post-processing workflows and improves response team efficiency.
• →Implement sophisticated asset correlation logic that accounts for dynamic IP addressing and cloud environments by combining multiple matching criteria including MAC addresses, AWS instance IDs, and custom Qualys asset tags. Create fallback correlation rules that create placeholder CIs for orphaned vulnerabilities to ensure no security findings are lost due to correlation failures.
• →Design incident auto-assignment rules that consider current team workloads and on-call schedules by integrating with ServiceNow's workforce optimization features, preventing vulnerability remediation bottlenecks during peak periods. Include escalation paths that automatically reassign stale incidents to backup teams if primary assignees don't acknowledge critical vulnerabilities within defined SLA timeframes.
• →Set up advanced reporting dashboards that combine Qualys vulnerability trends with ServiceNow change management data to identify correlations between system modifications and new security findings. Use ServiceNow's predictive intelligence capabilities to forecast vulnerability discovery patterns and proactively adjust scanning schedules and remediation resource allocation.
• →Configure webhook-based real-time integration for critical vulnerabilities by setting up Qualys to send immediate notifications to ServiceNow when high-severity findings are discovered, bypassing scheduled import delays. Implement intelligent filtering to prevent alert fatigue while ensuring zero-day exploits and actively exploited vulnerabilities trigger immediate incident creation and notification workflows.

Known Limitations

• —The Qualys API enforces strict rate limiting of 300 requests per hour per service account, which can significantly impact large-scale vulnerability imports requiring careful batch sizing and scheduling coordination. Organizations with extensive asset inventories may need multiple service accounts or extended import windows to accommodate these restrictions without causing integration failures.
• —Asset correlation between Qualys scan results and ServiceNow CMDB depends heavily on accurate and up-to-date configuration item data, particularly IP addresses and hostnames that frequently change in dynamic cloud environments. Poor CMDB data quality can result in correlation rates below 70%, requiring significant data cleanup efforts and ongoing maintenance to achieve acceptable matching performance.
• —The integration does not support bidirectional data synchronization for vulnerability remediation verification, meaning ServiceNow cannot automatically trigger Qualys rescans or update vulnerability status in the Qualys platform without additional custom development. This limitation requires manual coordination between security teams for vulnerability lifecycle management and may impact compliance reporting accuracy.
• —ServiceNow's Vulnerability Response application requires Integration Hub Professional licensing for advanced orchestration capabilities, adding significant cost overhead for organizations that only need basic vulnerability import functionality. The spoke actions also have limited customization options without modifying the underlying IntegrationHub flow definitions.
• —Real-time integration capabilities are constrained by Qualys webhook limitations and ServiceNow's inbound processing capacity, typically introducing 5-15 minute delays between vulnerability discovery and ServiceNow record creation even in optimal configurations. High-volume environments may experience longer delays during peak scanning periods when API queues become congested.

Frequently Asked Questions