Qualys VMDR

View as Markdown

Community Platform

runZero imports asset and vulnerability data from Qualys VMDR through the Qualys KnowledgeBase API.

Asset inventory

The asset inventory page has a column with the count of vulnerabilities Qualys detected for each asset. Select a single asset and the vulnerabilities table lists every result for it. The type of vulnerability scan and the import settings you select can both affect the vulnerability count.

Vulnerabilities table

The Vulnerabilities tab of the inventory lists every vulnerability result imported from Qualys. Selecting a result takes you to the page for the affected asset.

Severity and risk scores

Qualys assigns every vulnerability a severity rating (Minimal, Medium, Serious, Critical, Urgent). runZero normalizes these severities so the vulnerability inventory is consistent across the runZero Console.

runZero Severity Qualys Severity
Info 1 / Minimal
Low 2 / Medium
Medium 3 / Serious
High 4 / Critical
Critical 5 / Urgent

runZero also normalizes the risk scores Qualys assigns. A risk score of 0.0 appears as none in the runZero Console, and every other risk score matches the assigned severity level.

Getting started with Qualys

To set up the Qualys VMDR integration, you’ll need to:

  1. Create or obtain user credentials with access to the Qualys API.
  2. Configure CVSS scoring in Qualys.
  3. Add the Qualys API username, password, and account API URL in runZero.
  4. Choose whether to run the integration as a scan probe or connector task.
  5. Activate the Qualys integration to pull your data into runZero.

Requirements

Before you set up the Qualys VMDR integration:

  • Make sure you have access to the Qualys Cloud Platform portal.

Step 1: Add the Qualys credentials to runZero

  1. Go to the Credentials page in runZero. Provide a name for the credentials, like Qualys.
  2. Choose Qualys Username & Password from the list of credential types.
  3. Fill in these fields:
    • Qualys username - the username you use to connect to the Qualys API.
    • Qualys password - the password for your Qualys API username.
    • Qualys account API URL - the URL of the Qualys API for the relevant account, in the form https://ip:port or https://domain.tld:port. This URL is unique for each Qualys user.
  4. To let other organizations use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
  5. Save the credential.
The role of the Qualys API user determines which VM scanned hosts the integration can see. Managers may view all VM scanned hosts in the subscription. Auditors have no permission to view VM scanned hosts. Unit Managers may view VM scanned hosts in the user's assigned business unit. Scanners and Readers may view VM scanned hosts in the user's account, but must be assigned to the assets through asset groups in VM/VMDR.

Step 2: Choose how to configure the Qualys integration

You can run the Qualys integration as either a scan probe or a connector task. A scan probe gathers integration data during scan tasks. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 3: Set up and activate the Qualys integration to sync data

After you add your Qualys credential, sync your data with a scan probe or a connector.

The Qualys Cloud Platform limits the API calls subscription users can make. Both API controls are limited per subscription based on your service level, so the tasks this integration generates may run slowly or fail when they hit those limits. The Qualys API documentation covers these limits.

Step 3a: Configure the Qualys scan probe

Run the Qualys VMDR integration as a scan probe to have the runZero Explorer pull your vulnerability data into the runZero Console.

In a new or existing scan configuration:

  • Set the QUALYS option to Yes in the Probes and SNMP tab and change any default options as needed.
  • Set the correct Qualys credential to Yes in the Credentials tab.
  • Set the severity and risk levels for ingested vulnerability scan results (optional).

Step 3b: Configure the Qualys connector

A connector needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Qualys-only assets.

  1. Activate a connection to Qualys. You can reach every available third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they are not listed, check that the credentials have access to the organization you are in.
  3. Set the severity and risk levels you want to import (optional).
  4. Set the Fingerprint only toggle to Yes to ingest vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
  5. Specify the tags to include in the import as a comma-separated list. Only assets that match any of the provided tags are imported (optional).
  6. Specify the network IDs to include in the import as a comma-separated list. Only assets that match any of the provided network IDs are imported (optional).
  7. Enter a name for the task, like Qualys sync (optional).
  8. Choose the Explorer to run this connector task from (optional).
  9. Choose the site to add your assets to. runZero stores all newly discovered assets in this site.
  10. Enter a description for the task (optional).
  11. To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes them.
  12. To include assets that have not been assessed for vulnerabilities, switch the Include unscanned assets toggle to Yes.
  13. Enter a number of hours in the Last update filter to exclude assets that have not been scanned within that time (optional). A blank value uses the default of 30 days.
  14. Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
  15. Activate the connection when you are done. The sync runs on the defined schedule, and the Scheduled tasks page shows when the next sync will occur.

Step 4: View Qualys assets and vulnerabilities

After a successful sync, go to your inventory to view your Qualys assets. They show a Qualys icon in the Source column.

The integration also gathers the vulnerabilities Qualys detected. Go to Inventory > Vulnerabilities to view the vulnerability data from Qualys VMDR. To search and filter those results, use the vulnerability instance inventory keywords.

To filter to Qualys assets, run this query:

Click an asset to see its attributes. runZero shows the attributes gathered from the Qualys VMDR scan data.

Troubleshooting

If you are having trouble with this integration, the questions and answers below may help.

Why is the Qualys integration unable to connect?

  1. Check whether the Qualys integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the Qualys integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
  4. If Qualys is on-premises, verify that the integration task runs from an Explorer with access to the Qualys host.
Updated