AnsweredAssumed Answered

Scheduled Report Scope Not Updating

Question asked by derekv on Aug 2, 2019
Latest reply on Aug 8, 2019 by DMFezzaReed

FYI, 

 

This was a gotcha I just came across and thought I would share to ensure others are aware and don't pull their hair out trying to figure the issue out...

 

My org is a pretty heavy user of scheduled scans and reports... Recently, deployed some agents out to a new group of systems in the cloud and have a special tag that gets associated to them on activation. We run a report on a frequent basis to pull the data we want to report on out of Qualys into our reporting tool. As such, I updated the scope of the report template that is associated with our scheduled report to include the new assets based on the new tag.... Didn't think much of it until the customer that was expecting said data in the reporting tool couldn't find it.... I knew for a fact that they had reportable vulns so I started second guessing what I did... I back tracked and validated that the tag was in the report template, the template was associated to the scheduled report, the hosts actually had reportable vulns, the works. While I was reviewing the scheduled report, I realized my new tag wasn't reflected in there... Odd I thought... I clicked edit and "re-selected" the template... And nothing updated... Changed to a different template and the scope changed... So then I changed back to the desired template, and still the scope was still the old scope and lacked my new tag I added to the template...

 

I added the tag manually but the itch was there... So I created a new scheduled scan using the template and poof, the scope was right... So it looks like Qualys, in my opinion, has a logic flaw when it relates to scheduled reports where they are not updating already scheduled reports if you change aspects (at least the scope) of the associated template... I didn't test changing other things in the template or monkeying with scheduled scans... Will leave that up to Qualys QA or someone on here that is bored. 

 

I have a case open for the issue and hope the flaw will be corrected as I would expect my scheduled report should always be updated to match the current associated report template...

Outcomes