Last Updated on May 12, 2022 by Dave Farquhar
My friend does vulnerability management for a company that likes to rebuild machines instead of patching them. I don’t judge; that’s how I wanted to patch machines when I was a sysadmin but I didn’t have fast enough storage. But if you do this, you’re liable to end up with duplicate machines in your reports. One unpatched, and the other one (hopefully) patched. Here’s how to rebuild machines without making duplicates in Qualys or Tenable.
The problem with UUIDs
Both Qualys and Tenable stamp a machine with a tracking UUID the first time they scan it. This way, if a machine changes IP addresses, or has multiple network interfaces, they can track the machine without creating duplicates. This is great, until you rebuild a machine and don’t stamp it with the existing UUID. Then you create the problem the UUID was designed to solve. But the problem is easy enough to fix.
Rebuild Windows machines without making duplicates in Qualys or Tenable
Qualys stores its UUID in the Registry, in HKLM\Software\Qualys. Just save the whole key before you rebuild the machine, then restore the key before you re-scan it, or before you install the Qualys agent if you use agents.
Tenable stores its UUID in HKLM\Software\Tenable. Do the same thing. Save the whole key before you rebuild the machine, then restore the key before you re-scan it, or before you install the Tenable agent if you use agents.
If you ever forget and end up with duplicates, purge or delete them from within Qualys or Tenable. Both of them have facilities to do this.
Also, if you haven’t heard, it’s now possible to force a Qualys agent scan. This lets you force a scan on your freshly rebuilt machine and get credit for your work. Here’s how.
Rebuild Linux machines without making duplicates in Qualys or Tenable
On Linux, Qualys stores its UUID in a file. It’s configurable, but by default it lives in /etc/qualys/hostid. Just save the file before you rebuild the machine, then restore the file before you re-scan it, or before you install the Qualys agent if you use agents.
Tenable stores its UUID in either /etc/machine_id or /etc/tenable_tag. Do the same thing. Save the file before you rebuild the machine, then restore the file before you re-scan it, or before you install the Tenable agent if you use agents.
If you forget to do this and end up with duplicates, purge or delete them from within Qualys or Tenable. Both of them have facilities to do this.
There are other cases where you can make duplicate assets. Here’s how to take care of duplicate assets in Qualys once they happen.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.