What are the various methods to purge host data? When should I do this?
NOTE: Any data gathered utilizing the "Payment Card Industry (PCI) Options" option profile must remain in your subscription for TWO years. This data cannot be purged as this is a PCI council requirment.
Single Host: Best is to use the Host Information page and select Purge .
Purge Multiple Hosts:
1. Select VM and go to Assets > Asset Search and find the hosts you'd like to purge.
2. In the Asset Search Report, select all or some hosts under Results, and then select Actions: Purge and click Apply.
Both methods will prompt you with the following Warning:
"Purging hosts will remove all automatic host data as well as associated tickets and exceptions (scan results will not be removed). This host data will be removed from your account: vulnerability data and compliance data. None of this information will be recoverable. Are you sure you want to purge this host data? Purge the selected Hosts?"
When should you purge hosts in QualysGuard?
Best is to purge hosts when the host is being decommissioned or used completely in a new role - new OS, new applications, new purpose. Then you can make sure that data from the old host is NOT affecting the new host reporting. So the purge functionality could be tied to the company change control process and asset management process. QualysGuard can not infer from scanning hosts if the host is decommissioned, firewalled, temporarily out of service, re appropriated, etc - for that it needs insider information. Our workflows should facilitate the bulk purging and if there are shortcomings, we would like to know about them.
How to purge hosts that were last scanned over a year ago?
1. Go to Assets > Asset Search and use "Last Scan Date: not within: the past: X days" to find the hosts.
2. In the Asset Search Report, select all or some hosts and then select Actions: Purge and click Apply.
Finally, the Dashboard is also connected to the normalized (automatic) data. So if you delete old scan results via "Auto Delete Stored Data", it is not updated. If you purge hosts as described above, then the Dashboard is regenerated within some 5 minutes.
Qualys Support KnowledgeBase