AnsweredAssumed Answered

Incorrect results returning in AssetView search using asset tags

Question asked by David Garland on May 4, 2020
Latest reply on May 6, 2020 by David Garland

I'm using the two of the asset tags defined in the Qualys document https://discussions.qualys.com/docs/DOC-7166-complete-asset-tag-list

When I perform the following search in AssetView expecting to see zero results, or at least any authenticated scans that are not acting properly:

tags.name: `No OS Detected` and tags.name: `Authentication Successful`

The query result returns a lot of Windows and Linux assets that had successful scans. When I go into the details for each asset it lists the Operating System correctly.  So my question is, why is this happening and how do I fix it?

 

When I run a query on just 'No OS Detected' I get a list of assets, some are reporting correctly as 'No OS Identified' while others actually show the operating system.  So it is this one that I suspect is the culprit.

 

The dynamic asset tags are set up exactly as the link above describes for these two.

 

No OS DetectedGroovy Scriptlet
if(asset.getAssetType()!=Asset.AssetType.HOST) return false;
return asset.getOperatingSystem()==null || asset.getOperatingSystem().trim().length()<=0;

 

Authentication Successful UpdatedAsset Search Updated
<?xml version="1.0" encoding="UTF-8"?>
<TAG_CRITERIA>
<DETECTION>
<QID_LIST>
<QID>38307</QID>
<QID>70053</QID>
</QID_LIST>
</DETECTION>
</TAG_CRITERIA>

Outcomes