Ingest Findings
Ingestion is the first stage in the findings pipeline: it's how a scan result or a third-party detection becomes a finding record inside ETM in the first place. Every finding you later normalize, correlate, enrich, and investigate started as a raw record from one of your connected sources.
Navigate to: Configuration > Connectors
Where Findings Come From
ETM ingests findings from several kinds of sources at once, including:
- Qualys VMDR (vulnerability scans on host assets)
- Qualys Policy Compliance (misconfiguration and control checks)
- Qualys WAS (web application vulnerabilities)
- Third-party scanners and agents, such as CrowdStrike, Microsoft Defender, and Tenable
- Generic CSV import, for teams that need to bring in findings from a source without a native connector
Because the same issue can be seen by more than one source, it's expected that raw, newly ingested records overlap with each other — that overlap is resolved later, at the correlate stage.
How Ingestion Works
Each connected source is synchronized on its own schedule. As new scan or connector data arrives, ETM creates a finding record for every detection it doesn't already recognize, carrying over the source's own fields — for example the source's vendor ID, CVE or control identifiers, affected asset, and detection timestamps.
Setting up and authenticating a connector is covered separately in Connect and Onboard Data. This topic focuses on what happens to findings once a source is already connected and sending data.
What Happens After a Finding Is Ingested
A newly ingested record isn't yet in its final shape. Before it's ready to investigate, ETM maps it onto a common set of attributes, checks it against existing findings on the same asset, and adds risk context — the next three stages in this section.