Hi,
one of my customers tried to create a list of all the IPs in the subscription (~1300) using the Qualys-API including following parameters:
- IP address
- DNS-Name
- Assetgroup IDs
- Assetgroupe titles
- last date of scan
- scan duration
- Host ID
- OS
- Tracking Method
However, for some of the IPs (~200) only one single assetgroup ID was delivered though every IP is listed in at least two assetgroups.
Perhaps somebody has a solution for this problem?
Thanks,
Andreas
Yes, I have validated it myself. Each IP is listed in 2 asset groups.
Can you please flesh out the details here:
What call are you doing with what paramters? Example return? Screesnhot showing the multiple AG's the asset is in. Thanks
curl -X POST -k -H 'X-Requested-With: Curl' -u "****:****" -x http://proxy-eu-server-intern.sha.vrkw.de:8080 --proxytunnel -k 'https://qualysapi.qualys.eu/api/2.0/fo/asset/group/?action=list&output_format=csv')
The CSV-Results were listed in an Excel, you can see an example below:
When I recheck the system with an asset search report, I can see that there are two asset groups for the system:
So I think your client is using the wrong api call...Unfortunately the /asset/ip/ call, which in my opinion would be the logical call to make, only appears to list the IPs in the account but can't get you the other info the client wants... I think the call you actually need to us is the /asset/host call (page 305 of the user doc https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf ). The optional parameter your would want to modify would be the "Details" one and it sounds like you would want the "All/AGs" parameter for details.
Hope that helps!
Have they manually validated there is more than one asset group associated with the IPs?