Hello Qualys Community,
Trying to fine tune our Asset Tracking process and was wondering if Qualys had a Informational QID that showed when an asset was created?
Any assistance would be greatly appreciated.
Here's more info:
We are working with Light Inventory Scanning and wanted to know how to tell when something is new? There is no created date QID (at least not yet) and I can't use Host Scan time because the Light Inventory Scan would be it's last scan time. Also, there is no First Detected Date in the Light Inventory Scan either.
So we are looking to find solution to this. Any help would be awesome.
Just a thought, but each QID entry for an asset I believe has the first detected date and last detected date among others; what about finding one of the Information QIDs that pretty much always picks up something and using one of them to create a TAG.
Something like TAG New where QID.Contents.first_detected-now =1
Obviously pseudo code but you think it would work? You would need to decide how long is something "NEW"
Just to clarify, do you mean newly found on your network or newly built systems?
If newly built, would QID 91074 - Microsoft Windows Install Date and Time work for you? Qualys has to authenticate to get the data from the registry.
In AssetView, can you search for created: [now-1d ... now-1s]?
These might be helpful:
Query optimization for performance: created > now-1d
Retrieving data ...