MARS and Qualys vulnerability scanning integration

[genewolfe]

What does adding Qualys vulnerability scan data to MARS allow MARS, help MARS to do?

Does it help MARS identify an alert as a false positive in the context of a host which Qualys says isn't vulnerable OR does it do something else like when the Qualys data is retrieved simply listing each vulnerability as an incident?

[eegilbert]

My understanding was the Qualys would inform MARS if a system was really vulnerable or not based on it's (the qualys box) information of the situation.

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/cfgVulAs.html

Erric

[flavendhomme]

I just made the configuration to day, it seems to work corectly, but I am wondering something. Does anyone has really estimated the real benefits of using qualysquard with Csmars ?

[genewolfe]

I haven't been able to set this up yet. If MARS is able to mark alerts which don't apply to a device as false positives or something like that it could be valuable because it would save the staff time hunting down false positives.