Returns a list of host instance vulnerabilities that match the provided criteria. These vulnerabilities are returned when the hosts are visible to the user (i.e. in the user’s scope).
Limit your results - Use the optional “fields” parameter to limit the amount of information returned for each vulnerability. Learn more about limiting your results
Pagination - A maximum of 100 instances are returned by default. To customize this specify a “preferences” tag in the POST body of your request.
Permissions required - Managers with Full Scope. Users without Full Scope must have these account settings: 1) scope includes the requested asset, and 2) permissions include: Access Permission “API Access” and Asset Management Permission “Read Asset”.
Click here for available operators
|
Parameter |
Optional/ Mandatory |
Data Type |
Description |
|---|---|---|---|
|
id |
long |
The primary host instance vulnerability key. |
|
|
hostAssetId |
long |
The ID of the host asset where the vulnerability was found. |
|
|
created |
date |
The date the vulnerability was added to the KnowledgeBase. |
|
|
found |
boolean |
Set to true if the QID was detected on the host by the latest scan of that host. |
|
|
firstFound |
date |
The date/time the vulnerability was first detected on the host. |
|
|
lastfound |
date |
The most recent date/time the vulnerability was detected on the host. |
|
|
lastScanned |
date |
The most recent date/time the vulnerability was tested for the host. |
|
|
qid |
long |
The Qualys vulnerability ID of the vulnerability. |
|
|
disabled |
boolean |
Set to true if the QID is marked as disabled in your subscription. Set to false if the QID is not marked disabled. |
|
|
fqdn |
string |
The fully qualified domain name of the host. |
|
|
ssl |
boolean |
Set to true if the vulnerability was detected over SSL. Set to false if the vulnerability was not detected over SSL. This element is not returned for information gathered. |
|
|
updated |
date |
The last date/time the vulnerability data was updated for the host. |
|
|
ignored |
boolean |
Set to true if the QID/host/port is marked as ignored in your subscription. Set to false if the QID/host/port is not marked ignored. |
|
|
protocol |
string |
The protocol the vulnerability was detected on. TCP, UDP, ICMP. |
|
|
port |
integer |
The port number the vulnerability was detected on. |
|
|
source |
string |
The vulnerability source. HOST, ORACLE, HSSQL, OTHER. |
Find all vulnerabilities that were previously detected on a host, and that have since been resolved
API request
curl -u "USERNAME:PASSWORD" -H "content-type: text/xml" -X "POST" --data-binary @- "<qualys_base_url>/qps/rest/2.0/search/am/hostinstancevuln"
<file.xml
Note: file.xml contains the request POST data
Request POST data
<ServiceRequest>
<filters>
<Criteria field="hostAssetId" operator="EQUALS">12345</Criteria>
<Criteria field="found" operator="EQUALS">false</Criteria>
</filters>
</ServiceRequest>
Response
<?xml version="1.0" encoding="UTF-8"?>
<ServiceResponse
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="<qualys_base_url>/qps/xsd/2.0/am/hostinstancevuln.xsd">
<responseCode>SUCCESS</responseCode>
<count>1</count>
<data>
<HostInstanceVuln>
<id>9534081</id>
<hostAssetId>12345</hostAssetId>
<qid>38167</qid>
<port>25</port>
<ssl>true</ssl>
<found>true</found>
<ignored>false</ignored>
<disabled>false</disabled>
<updated>2012-10-19T21:56:23Z</updated>
<protocol>TCP</protocol>
<source>HOST</source>
</HostInstanceVuln>
</data>
</ServiceResponse>
<platform API server>/qps/xsd/2.0/am/hostinstancevuln.xsd