Split Qualys detections based on vulnerability instance

task brazil Updated Sep 10, 2026 1 min read split-qualys-detections.md

Vulnerability Response allows you to split detections from Qualys scanners, creating a unique Vulnerable Item (VIT) for each detected vulnerability instance. This supports more precise assignment to remediation teams and improves vulnerability management and tracking.

Before you begin

Role required: admin

About this task

The Qualys scanner payload includes detection data with proof details. Each path in the proof is used to identify and split vulnerability instances. The output tag in the payload indicates the location of the vulnerability, enabling accurate separation and management of detections.

Procedure

Enable detection splitting
1. Navigate to the Third-party Integration table [sn_sec_int_integration].
2. Open the record for Qualys Cloud Platform.
3. Set the Include proof VI key to true.
4. Save the record.
Exclude specific QIDs from detection splitting
1. Open the system property [sn_vul_qualys.skip_split_detection_ids].
2. In the Value field, enter a comma-separated list of QIDs you want to exclude from splitting.
  
  Note: By default, the following QIDs are excluded from splitting due to the volume of their findings: QID-989920, QID-993308, QID-5001711, QID-5001632.
3. Save the property.
Ensure QIDs are listed for splitting
1. Navigate to the Proof Key Vulnerability List table [sn_vul_proof_key_vulnerability_list].
2. Verify that the QIDs you want to split are listed.

Result

After executing the Qualys Host Detection Integration, detections are split based on proof, creating individual Vulnerable Items (VITs) for each vulnerability instance. You can verify the results in the Vulnerability Item Detections table [sn_vul_detection_list], where each detection appears as a separate record.

60 lines · 2.7 KB Wrap lines

---
title: Split Qualys detections based on vulnerability instance
description: Vulnerability Response allows you to split detections from Qualys scanners, creating a unique Vulnerable Item \(VIT\) for each detected vulnerability instance. This supports more precise assignment to remediation teams and improves vulnerability management and tracking.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/vulnerability-response/split-qualys-detections.html
release: brazil
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Understanding the Qualys Vulnerability Integration, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Split Qualys detections based on vulnerability instance

Vulnerability Response allows you to split detections from Qualys scanners, creating a unique Vulnerable Item \(VIT\) for each detected vulnerability instance. This supports more precise assignment to remediation teams and improves vulnerability management and tracking.

## Before you begin

Role required: admin

## About this task

## Procedure

1. Enable detection splitting

1. Navigate to the Third-party Integration table \[sn\_sec\_int\_integration\].

2. Open the record for Qualys Cloud Platform.

3. Set the **Include proof VI key** to true.

4. Save the record.

2. Exclude specific QIDs from detection splitting

1. Open the system property \[sn\_vul\_qualys.skip\_split\_detection\_ids\].

2. In the **Value** field, enter a comma-separated list of QIDs you want to exclude from splitting.

**Note:** By default, the following QIDs are excluded from splitting due to the volume of their findings: QID-989920, QID-993308, QID-5001711, QID-5001632.

3. Save the property.

3. Ensure QIDs are listed for splitting

1. Navigate to the Proof Key Vulnerability List table \[sn\_vul\_proof\_key\_vulnerability\_list\].

2. Verify that the QIDs you want to split are listed.

## Result

After executing the Qualys Host Detection Integration, detections are split based on proof, creating individual Vulnerable Items \(VITs\) for each vulnerability instance. You can verify the results in the Vulnerability Item Detections table \[sn\_vul\_detection\_list\], where each detection appears as a separate record.