Firstly, this is related to a post by fjimenez who wrote a very good article on scan time management.
My question, which I haven't been able to answer, is when does Qualys start counting the time period from?
Eg: An asset (TestAsset01, is scanned at 01:00 Local Time. Scan completes at 01:20 Local Time. At 09:00 Local, I log on and search for: "Assets Scanned Within 1 Day". In my list i see an entry for "TestAsset01".
If I then log on again the following day at 00:30 (Sad Insomniac), I would expect to see the asset still there? Likewise, if I searched at 01:30 (Now a tired, sad insomniac), I would expect TestAsset01 to be missing from my list. This indicates that an assets last scan time is taken from when the individual asset either starts or finishes its scan.
Continuing on this theme, if my scan contained 100 Assets (Which for ease of explaining just happened to be scanned sequentially) and TestAsset50 was scanned at 01:29, then it too would NOT be in my list when I look at 01:30 the following day.
Is Qualys scan time expected to be this accurate (To within a minute/second/nano second) or is "Scanned Within 1 Day" more of an approximate day based within the region of 24 hours? Or is it based on a Calendar day from the timezone in which the scan was set to run from?
As always, appreciate any comments/replies.