Qualys Knowledgebase – QID Change Log Consolidation

QIDs Modified Date in Change Logs Update

We have started publishing the QID change logs for 13 fields from June 2021. We also track the change dates in two date fields KB modified date and RTI modified date. The “service modified date” is using QID “insert date” and “modified date” instead of KB modified date and RTI modified date. We do not update QID “modified date” for all the 13 fields we are tracking as part of the change log. 

Example: QID 376210, the service modified date is 05/30/2022 but the change log date shows the QID is modified on 03/03/2022 

What To Expect?

To avoid the data discrepancy which is observed in the “service modified date” and “change log date”, we will update the QID Modified (Service Modified) date for 13 fields, and any future changes in these fields will capture the Service Modified field. This will accurately capture the QID-related fields that we are tracking as part of the change logs, and the customers will not see the mismatch between the change log date and the service modified date. 

Below is the list of fields in the Change Log which will now be updated with “service modified date”. 

• Title 
• Category 
• Severity 
• PCI Flag 
• Authentication 
• Remote flag 
• CVE 
• CVSS V2 Base Score 
• CVSS V2 Temporal Score 
• CVSS V3.1 Base Score 
• CVSS V3.1 Temporal Score 
• Exploits 
• RTIs 

The above-given change is expected to be updated for 45k+ QIDs in the backlog which will get “service modified” date changes applicable. This will be automatically synced between Qualys DBs and the Qualys platforms during our sync, and the same can be observed in the Qualys Knowledgebase UI. 

This change is expected to be rolled out from 3^rd March, we will be gradually syncing the QIDs in multiple phases, and activity is expected to be completed by 12^th March 2023. 

Note: This will not have any impact on any scanning/reporting activity.

Action Required 

Post the completion of this activity from our end (ETA – 12^th March), below are actions to be taken to sync these QIDs in your API Integration Systems 

For all your API Integrations, we request all customers sync the QID Service Modified date to be related in all your integrations systems from 13^th March, hence the Knowledgebase API to be resynced with the Modified Date from 07-02-2018  00:00:00 

Use “/api/2.0/fo/knowledge_base/vuln/?action=list” API and input parameter ”last_modified_by_service_after={date}” to reflect all the changes. 

Ex: “last_modified_by_service_after={2018-02-07 00:00:00}”

Here is a sample step: 

https://{API_SERVER_URL}/api/2.0/fo/knowledge_base/vuln/ 

1. action=list 

2. details=All 

3. last_modified_after=2018-02-07T00:00:00Z 

4. show_pci_reasons=1 

5. show_supported_modules_info=1 The change log for these fields & few more fields will be tracked in the upcoming release, which is planned for the mid of the April of this year. 

6. show_qid_change_log=1 

7. show_disabled_flag=1 

8. details=All 

What’s Coming Next 

The change log for these fields & few more fields will be tracked in the upcoming release, which is planned for the mid of the April of this year. 

The next release will include the actual change log field captures for the respective attributes. 

Learn more –  

• Qualys API Best Practices: KnowledgeBase API 
• Qualys API VM/PC User Guide (refer to the KnowledgeBase at page# 200)