This guide shows how to delete Qualys assets from a subscription via FC Platform. Deleting assets is working on "Delete by query".
Delete all Cisco assets which were not scanned more than 30 days back.
fcpc qualys del-assets-by-query \
'/{tag: "platform:cisco" AND qlastvulnscan: [* TO now-30d]}/'
Delete all assets with OS Windows Server which are not scanned by agent anymore more than 7 days.
fcpc qualys del-assets-by-query \
'/{tag: "os:windowsserver" AND tag: "qualys:agent" AND qlastcheckin: [* TO now-7d]}/'
Delete all assets which do not have Qualys agent installed and are older than 30 days.
fcpc qualys del-assets-by-query \
'/{tag: "os:windowsserver" AND -tag: "qualys:agent" AND qlastvulnscan: [* TO now-30d]}/'
Create elastic search before deleting assets - check assets todelete in kibana using same filter that is in command.
fcpc --db.elastic.prefix=fcpc_gce search 'qualyshost/{tag: "qualys:duplicated" AND tag: "qualys:duplicated:name" AND tag:"qualys:asset:inactive"}/'
Delete all assets duplicated by name within Qualys.
fcpc qualys del-assets-by-query '/{tag: "qualys:duplicated" AND tag: "module:duplicated:name" AND tag:"qualys:asset:inactive"}/'
fcpc --db.elastic.prefix=fcpc_gce qualys del-assets-by-query '/{tag: "qualys:duplicated" AND tag: "qualys:duplicated:name" AND tag:"qualys:asset:inactive"}/'
fcpc --db.elastic.prefix=fcpc_vdgulf qualys del-assets-by-query '/{tag: "qualys:duplicated" AND tag: "qualys:duplicated:name" AND tag:"qualys:asset:inactive"}/'