Do the hosts in Qualys Agents have unique identifiers? I’m seeing a number of hosts that have been re-imaged with the same hostname and the vulnerabilities appear twice.
They do have unique identifiers but if you re-image the machine then you'll duplicate the identifier !
There is logic built into agent to detect this and correct it. IIRC it's called "scorched earth" by Qualys but is an emergency feature.
The solution is to deploy agent either after initial OS image or before but don't activate the agent before deploying.
This post has more info.
Retrieving data ...