From 5a8d24f678051d276c854f01625aaafa0df9cd5c Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Fri, 7 Nov 2025 07:12:51 +1030
Subject: [PATCH] qualys_vmdr: add config option for query list length

---
 packages/qualys_vmdr/changelog.yml                       | 5 +++++
 .../asset_host_detection/agent/stream/input.yml.hbs      | 2 +-
 .../data_stream/asset_host_detection/manifest.yml        | 9 +++++++++
 packages/qualys_vmdr/manifest.yml                        | 2 +-
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/packages/qualys_vmdr/changelog.yml b/packages/qualys_vmdr/changelog.yml
index a3469942ffd..df4a02818ae 100644
--- a/packages/qualys_vmdr/changelog.yml
+++ b/packages/qualys_vmdr/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "6.12.0"
+  changes:
+    - description: Allow user configuration of `/api/3.0/fo/knowledge_base/vuln/` request limits.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15890
 - version: "6.11.0"
   changes:
     - description: Improve handling of host query lists in asset_host_detection data stream.
diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs b/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs
index 9b9801ca45c..07c8aacbc0e 100644
--- a/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs
+++ b/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs
@@ -22,7 +22,7 @@ state:
   params: {{input_parameters}}
   show_igs: {{show_igs}}
   keep_xml: {{preserve_original_event}}
-  query_limit: 1000
+  query_limit: {{host_qid_list_query_limit}}
 redact:
   fields:
     - password
diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml
index 5265e311680..8dbd61b9fb2 100644
--- a/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml
+++ b/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml
@@ -30,6 +30,15 @@ streams:
         multi: false
         required: true
         show_user: false
+      - name: host_qid_list_query_limit
+        type: integer
+        title: Vulnerability knowledge base list query limit
+        description: >-
+          Limit for the number of knowledge base IDs included in enrichment requests. This should be lowered if requests to the `/api/3.0/fo/knowledge_base/vuln/` endpoint return 414 status codes.
+        default: 500
+        multi: false
+        required: true
+        show_user: false
       - name: http_client_timeout
         type: text
         title: HTTP Client Timeout
diff --git a/packages/qualys_vmdr/manifest.yml b/packages/qualys_vmdr/manifest.yml
index 3894adbaa1c..b987902e535 100644
--- a/packages/qualys_vmdr/manifest.yml
+++ b/packages/qualys_vmdr/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.4.0"
 name: qualys_vmdr
 title: Qualys VMDR
-version: "6.11.0"
+version: "6.12.0"
 description: Collect data from Qualys VMDR platform with Elastic Agent.
 type: integration
 categories: