Host Import

The Qualys Host Import (cmdb_ci) transform map is used to transform data returned from the Host Detection API call to cmdb_ci records. Changes to this transform alter how the host information is processed and inserted into the system. Unmatched hosts are stored in the Qualys CIs (sn_vul_qualys_ci) table.

To access this transform map, navigate to Qualys Vulnerability Integration > Import Set Tables > Host Import.

The table contains the fields currently being transformed.

Table 1. Qualys host import fields
Source field Target field Description
[Script] sys_id Provides logic to find an existing cmdb_ci record to update.

If no existing cmdb_ci record is found, it returns null or an empty string. A new record is created.

The lookupSysId() function in the QualysSimpleCITransform script include is used.

u_ip ip_address Maps the IP address from the API call to the ip address field on a cmdb_ci record.
u_dns fqdn Maps the DNS field from the API call to the fqdn field on a cmdb_ci record.

In addition to field mappings, there are also two transform scripts that are executed during the transformation process.

The table shows when these scripts run and what they are used for.

Table 2. Script timing and purpose
When the script is run Purpose of the script
onBefore (before the target record is inserted) Defines additional fields to populate that depend on specific data in the source data (from the API).

The logic that handles this script is in the QualysSimpleCITransform script include onBeforeTransformScript() function. If special processing (such as changing CI classifications) is required to fine-tune how CIs from Qualys are inserted, either the script or script include can be modified.

onComplete (after an import set has completed transformation) Reprocesses the import set for detections.

For internal use. Modifying or deleting is not recommended.