Qualys Policy Compliance
Compliance Management- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Qualys Policy Compliance (PC) connector integrates with the Qualys Policy Compliance platform to synchronize compliance posture data into the Brinqa platform. It uses the classic Qualys Policy Compliance XML APIs (/api/2.0/fo/compliance/... and /api/4.0/fo/asset/host/) to retrieve compliance-enabled hosts, compliance controls, control violations (posture information), and the policies that scope them.
The connector synchronizes the following categories of data:
- Hosts — Compliance-enabled host assets, including hardware, network, and cloud provider metadata
- Controls — Compliance control definitions (mapped to Violation Definitions)
- Violations — Control posture results (failing/reopened/fixed) per host
- Policies — Compliance policy metadata used to scope violation collection
Data retrieved from Qualys Policy Compliance
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Host | Yes | Host |
| Control | Yes | Vulnerability Definition |
| Violation | Yes | Violation |
| Policy | Yes | Policy |
Model relationships
note
For detailed steps on how to view the data retrieved from Qualys Policy Compliance in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Qualys Policy Compliance from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API Server URL | Yes | https://qualysapi.qualys.com/ | Qualys platform API server url |
| Username | Yes | — | Qualys user login |
| Password | Yes | — | Qualys user password |
| Page size | No | 100 | Maximum number of hosts to request per API request |
| Parallel requests | No | 2 (or available processors) | Maximum number of parallel API requests |
| Maximum retries | No | 5 | The maximum number of retry attempts before giving up a request |
Authentication
The connector authenticates with the Qualys API using HTTP Basic Authentication (username and password). Credentials are supplied through the connector configuration and sent on every request.
Endpoint
| Method | URL |
|---|---|
GET | {baseUrl}/api/2.0/fo/compliance/... |
Usage
All API requests include the Basic Auth credentials:
Authorization: Basic <base64(username:password)>
Sync Behavior
The connector performs a mix of full and incremental (delta) syncs depending on the model. Models that support delta filter by the sync token (see each model's Sync Duration Parameter below); the rest perform a full sync every run.
How to obtain Qualys Policy Compliance credentials
Create a Qualys user
To ensure that the user account that the Qualys PC connector uses to access the Qualys API has the appropriate permissions, follow these steps.
-
Log in to your organization's Qualys server.
-
Navigate to Users, and then select the Users tab.
-
Click New and select User. The New User dialog displays.
-
Fill out the general information for the new user.
-
Click User Role on the left menu.
-
From the User Role dropdown, select Reader.
-
Select GUI and API to enable API access, and leave Business Unit as Unassigned.
-
Note: GUI access allows the user to log in to the Qualys GUI (graphical user interface). After you create the new Qualys user, log in to the Qualys GUI using the new credentials. The system prompts the user to reset their password. The Qualys connector will not function until you complete the password reset.
-
Click Asset Groups.
- From the Add asset groups dropdown, select All or only the asset groups the Qualys user needs access to.
-
Click Permissions and select all of the available permissions.
-
Click Options to modify the notification options as needed.
-
Click Save.
The new Qualys user with appropriate permissions to retrieve data displays on the Qualys Users page.
If you do not wish to create a new Qualys user, you can leverage an existing user with the appropriate permissions.
Note: If you do not have the permissions to create a Qualys user, contact your Qualys administrator. For additional information, see Qualys documentation on user roles and permissions.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Host
| Source Field Name | SDM Attribute |
|---|---|
All DNS names (combined) | DNS_NAMES |
All IP addresses (combined) | IP_ADDRESSES |
| ASSET_CATEGORY_HOST, ASSET_CATEGORY_VIRTUAL_MACHINE | CATEGORIES |
| Azure ipv6 | AZURE_IPV6 |
| Azure location | AZURE_LOCATION |
| Azure mac | AZURE_MAC_ADDRESS |
| Azure name | AZURE_NAME |
| Azure osType | AZURE_OS_TYPE |
| Azure privateIp | AZURE_PRIVATE_IPV4 |
| Azure public-ipv4 | AZURE_PUBLIC_IPV4 |
| Azure resourceGroupName | AZURE_RESOURCE_GROUP_NAME |
| Azure state | AZURE_STATE |
| Azure subnet | AZURE_SUBNET |
| Azure subscriptionId | AZURE_SUBSCRIPTION |
| Azure vmId | AZURE_VM_ID |
| Cloud metadata name / DNS hostname / NetBIOS / IP | NAME |
Cloud metadata state (normalized) or "active" | STATUS |
| EC2 accountId | EC2_AWS_ACCOUNT |
| EC2 availabilityZone | EC2_AVAILABILITY_ZONE |
| EC2 hostname | EC2_HOSTNAME |
| EC2 imageId | EC2_AMI_ID |
| EC2 instanceId / instance-id | EC2_INSTANCE_ID |
| EC2 instanceState | EC2_INSTANCE_STATE |
| EC2 instanceType / instance-type | EC2_INSTANCE_TYPE |
| EC2 local-ipv4 / privateIp | EC2_PRIVATE_IPV4 |
| EC2 mac | EC2_MAC_ADDRESS |
| EC2 public-ipv4 | EC2_PUBLIC_IPV4 |
| EC2 region | EC2_REGION |
| EC2 security-groups | EC2_SECURITY_GROUPS |
| EC2/Azure/GCP mac attribute | MAC_ADDRESSES |
| GCP hostname | GCP_HOSTNAME |
| GCP instance-id | GCP_INSTANCE_ID |
| GCP mac | GCP_MAC_ADDRESS |
| GCP machineType | GCP_MACHINE_TYPE |
| GCP network | GCP_NETWORK |
| GCP privateIp | GCP_PRIVATE_IPV4 |
| GCP projectId | GCP_PROJECT_ID |
| GCP public-ipv4 | GCP_PUBLIC_IPV4 |
| GCP state | GCP_STATE |
| GCP zone | GCP_ZONE |
host.getAGENTACTIVATIONKEY | AGENT_ACTIVATION_KEY |
host.getAGENTACTIVATIONTITLE | AGENT_ACTIVATION_TITLE |
host.getAGENTSTATUS | AGENT_STATUS |
host.getARSFACTORS.getARSFORMULA | ARS_FORMULA |
host.getASSETCRITICALITYSCORE | ACS |
host.getASSETID | ASSET_ID |
host.getASSETRISKSCORE | ARS |
host.getCLOUDAGENTRUNNINGON | CLOUD_AGENT_RUNNING_ON |
host.getCLOUDPROVIDER | CLOUD_PROVIDER |
host.getCLOUDPROVIDERTAGS | CLOUD_PROVIDER_TAGS |
host.getCLOUDRESOURCEID | CLOUD_RESOURCE_ID |
host.getCLOUDRESOURCEID, EC2/Azure/GCP metadata | INSTANCE_ID |
host.getCLOUDSERVICE | CLOUD_SERVICE |
host.getDNSDATA.getDOMAIN | DOMAIN |
host.getDNSDATA.getFQDN (private) | PRIVATE_DNS_NAMES |
host.getDNSDATA.getFQDN (public) | PUBLIC_DNS_NAMES |
host.getDNSDATA.getHOSTNAME | DNS_HOSTNAME |
host.getFIRSTFOUNDDATE / EC2/GCP firstDiscovered | FIRST_SEEN |
host.getHARDWAREUUID | HARDWARE_ID |
host.getID | UID |
host.getIP (private), EC2/Azure/GCP privateIp | PRIVATE_IP_ADDRESSES |
host.getIP (public), EC2/Azure/GCP public-ipv4 | PUBLIC_IP_ADDRESSES |
host.getLASTACTIVITY | LAST_ACTIVITY |
host.getLASTBOOT | LAST_STARTED |
host.getLASTVMAUTHSCANNEDDATE | LAST_AUTH_SCANNED |
host.getLASTVULNSCANDATETIME | LAST_SCANNED |
host.getNETBIOS | NETBIOS_HOSTNAME |
host.getNETBIOS, host.getDNSDATA.getHOSTNAME, host.getOSHOSTNAME | HOSTNAMES |
host.getNETWORKID | NETWORK_ID |
host.getOS | OPERATING_SYSTEM |
host.getOSHOSTNAME | OS_HOSTNAME |
host.getOWNER | OWNER |
host.getQGHOSTID | QG_HOST_ID |
host.getSERIALNUMBER | SERIAL_NUMBER |
host.getTAGS.getTAG | TAGS |
host.getTRACKINGMETHOD | TRACKING_METHOD |
host.getTRURISKSCORE | TRURISK_SCORE |
host.getTRURISKSCOREFACTORS.getTRURISKSCOREFORMULA | TRURISK_SCORE_FORMULA |
Instant.now() at sync start | LAST_CAPTURED |
| Latest of LAST_SCANNED or LAST_ACTIVITY | LAST_SEEN |
| name + OS | DESCRIPTION |
Control
| Source Field Name | SDM Attribute |
|---|---|
| Calculated from normalized severity | SEVERITY_SCORE |
CID_PREFIX + control.getID | UID |
control.getCATEGORY | CATEGORY |
control.getCHECKTYPE | CHECK_TYPE |
control.getCREATEDDATE | SOURCE_CREATED_DATE |
control.getCRITICALITY.getVALUE | SOURCE_SEVERITY |
control.getCRITICALITY.getVALUE (normalized) | SEVERITY |
control.getFRAMEWORKLIST.getFRAMEWORK[].getNAME | FRAMEWORKS |
control.getSTATEMENT (XML-unescaped) | STATEMENT |
control.getSUBCATEGORY | SUB_CATEGORY |
control.getTECHNOLOGYLIST.getTECHNOLOGY[].getNAME | TECHNOLOGIES |
control.getUPDATEDATE | SOURCE_LAST_MODIFIED |
Violation
| Source Field Name | SDM Attribute |
|---|---|
Control.CID_PREFIX + info.getCONTROLID | TYPE |
Derived from info.getSTATUS / getPREVIOUSSTATUS | STATUS |
Derived from info.getSTATUS / getPREVIOUSSTATUS | SOURCE_STATUS |
Derived from status (open / closed) | STATUS_CATEGORY |
| glossary control rationale by technology | RATIONALE |
glossary TECHNOLOGY.getNAME | TECHNOLOGY |
info.getCAUSEOFFAILURE (aggregated) | CAUSE_OF_FAILURE |
info.getEVIDENCE.getEXTENDEDEVIDENCE | EXTENDED_EVIDENCE |
info.getFIRSTFAILDATE | FIRST_FAILED |
info.getFIRSTPASSDATE | FIRST_PASSED |
info.getHOSTID | TARGETS |
info.getID | UID |
info.getLASTFAILDATE | LAST_FAILED |
info.getLASTPASSDATE | LAST_PASSED |
info.getPOSTUREMODIFIEDDATE | SOURCE_LAST_MODIFIED |
info.getPREVIOUSSTATUS | PREVIOUS_STATUS |
info.getREMEDIATION | SOLUTION |
info.getSTATUS | PROVIDER_STATUS |
policy ID (from policy list) | POLICY_ID |
policy title (from policy list) | POLICY_TITLE |
Policy
| Source Field Name | SDM Attribute |
|---|---|
policy.getASSETGROUPIDS | ASSET_GROUP_IDS |
policy.getCREATED | SOURCE_CREATED_DATE |
policy.getEVALUATENOW | EVALUATE_NOW |
policy.getID | UID |
policy.getID | POLICY_ID |
policy.getINCLUDEAGENTIPS | INCLUDE_AGENT_IPS |
policy.getISLOCKED | IS_LOCKED |
policy.getLASTEVALUATED | LAST_ASSESSED |
policy.getLASTMODIFIED | SOURCE_LAST_MODIFIED |
policy.getSTATUS | STATUS |
policy.getTAGEXCLUDESELECTOR | TAG_SET_EXCLUDE_SELECTOR |
policy.getTAGINCLUDESELECTOR | TAG_INCLUDE_SELECTOR |
policy.getTAGSETEXCLUDE.getTAGID | TAG_SET_EXCLUDE |
policy.getTAGSETINCLUDE.getTAGID | TAG_SET_INCLUDE |
policy.getTITLE | POLICY_TITLE |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Host
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the compliance_scan_since sync token, filtering on since.
API
- Type: REST (classic Qualys XML API; XML response parsed via JAXB) · Endpoint:
GET {baseUrl}/api/4.0/fo/asset/host/ - Default filters:
compliance_enabled=1(only compliance-enabled hosts), plusdetails=All/AGs,show_asset_id=1,show_cloud_tags=1,show_tags=1,show_trurisk=1,show_trurisk_factors=1,cloud_agent_activationkey=1,host_metadata=all
Control
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the updated_after_datetime sync token, filtering on since.
API
- Type: REST (classic Qualys XML API; XML response parsed via JAXB) · Endpoint:
GET {baseUrl}/api/2.0/fo/compliance/control/ - Default filters:
action=list,details=All,truncation_limit=<pageSize>
Violation
Operation options
This object does not support any operation options.
Delta sync
Supported. The connector performs an incremental (delta) sync via the status_changes_since sync token, filtering on since.
API
- Type: REST (classic Qualys XML API; XML response parsed via JAXB) · Endpoint:
GET {baseUrl}/api/2.0/fo/compliance/posture/info/ - Default filters:
action=list,details=All,show_remediation_info=1,show_extended_evidence=1,cause_of_failure=1,policy_id=<policyId>,truncation_limit=<pageSize>
Policy
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Policy on every run and applies no incremental date filter.
API
- Type: REST (classic Qualys XML API; XML response parsed via JAXB) · Endpoint:
GET {baseUrl}/api/2.0/fo/compliance/policy/ - Default filters:
action=list,details=Basic
Changelog
The Qualys Policy Compliance connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 5.3.41 | Improvements - Added a "Last captured" timestamp to Host records, recording when each record was last retrieved from Qualys during a sync. Bug Fixes - Fixed an issue where parallel host synchronization could exceed the configured parallelism level, opening more concurrent requests to the Qualys API than intended. Parallel execution now strictly respects the configured parallelism cap. | N/A |
| 5.3.40 | No changes in this release. | N/A |
| 5.3.39 | No changes in this release. | N/A |
| 5.3.38 | No changes in this release. | N/A |
| 5.3.37 | No changes in this release. | N/A |
| 5.3.36 | Improvements Coding Standards Modernization - Bumped http-connectors-parent from 2.1.7 to 2.1.12 and connectors-model from 1.5.10 to 1.6.19 to align with the current connector framework baseline. - Replaced all new AttributeInfoBuilder(...) usages with AttributeInfos.newAttribute(...) across all model classes. This ensures custom attributes are registered with the correct consolidation priority, so they participate properly in attribute consolidation and value precedence. - Removed local addAttribute helper methods in favor of AttributeUtils.addAttribute from connectors-model, which prevents null values from silently reaching the attribute builder and adds type validation. - Migrated storage initialization from the deprecated LocalFactory / LocalConfig to StorageManager from connectors-model. - Removed the connector-local InstantDeserializer / InstantUtils in favor of OptionalInstantDeserializer from connectors-model, which supports a broader set of input formats. - Applied Spotless code formatting to the full codebase. | N/A |
| 5.3.35 | No changes in this release. | N/A |
| 5.3.34 | No changes in this release. | N/A |
| 5.3.33 | Improvements - Cloud provider tags on hosts are now captured as descriptive Key: <name>; Value: <value> pairs instead of the tag name alone, making the source cloud metadata more readable. | • Host: Cloud provider tag values are re-formatted. Re-sync the connector to refresh the stored values. |
| 5.3.32 | No changes in this release. | N/A |
| 5.3.31 | No changes in this release. | N/A |
| 5.3.30 | Improvements - Hosts now expose dedicated NetBIOS hostname and DNS hostname attributes, in addition to the consolidated hostname list. | N/A |
| 5.3.29 | Bug Fixes - Corrected host IP address handling: public and private IP addresses are now written to their correct attributes (previously public IP values were mistakenly stored under the public DNS name attribute), and non-IP values are filtered out. | • Host: IP address attributes are corrected. Re-sync the connector to refresh the stored values. |
| 5.3.28 | No changes in this release. | N/A |
| 5.3.27 | No changes in this release. | N/A |
| 5.3.26 | No changes in this release. | N/A |
| 5.3.25 | No changes in this release. | N/A |
| 5.3.24 | No changes in this release. | N/A |
| 5.3.23 | No changes in this release. | N/A |
| 5.3.22 | No changes in this release. | N/A |
| 5.3.21 | Bug Fixes - The policy "Is locked" attribute is now stored as text rather than a boolean, so its source value is preserved without conversion errors. | • Policy: The "Is locked" attribute type changed from boolean to text. Re-sync the connector to refresh the stored values. |
| 5.3.20 | No changes in this release. | N/A |
| 5.3.19 | No changes in this release. | N/A |
| 5.3.18 | No changes in this release. | N/A |
| 5.3.17 | Improvements - Hosts now include the cloud agent activation key and activation title when reported by Qualys. | N/A |
| 5.3.16 | No changes in this release. | N/A |
| 5.3.15 | No changes in this release. | N/A |
| 5.3.14 | No changes in this release. | N/A |
| 5.3.13 | New Features - Added a new Policy model, allowing compliance policies to be synchronized alongside controls and violations. | N/A |
| 5.3.12 | No changes in this release. | N/A |
| 5.3.11 | No changes in this release. | N/A |
| 5.3.10 | New Features - Hosts now carry a lifecycle policy that marks an asset inactive after 30 days without being seen, improving stale-asset handling. Improvements - Refined the set of host identity keys (instance ID, serial number, MAC addresses, public IP addresses, hostnames, public DNS names) to improve correlation of hosts with assets from other sources. | • Host: Identity keys changed. Re-sync the connector so hosts re-correlate correctly. |
| 5.3.9 | No changes in this release. | N/A |
| 5.3.8 | No changes in this release. | N/A |
| 5.3.7 | No changes in this release. | N/A |
| 5.3.6 | No changes in this release. | N/A |
| 5.3.5 | No changes in this release. | N/A |
| 5.3.4 | Bug Fixes - The host "Asset ID" attribute is now stored as text rather than a number, preventing loss of precision and conversion errors. | • Host: The "Asset ID" attribute type changed from numeric to text. Re-sync the connector to refresh the stored values. |
| 5.3.3 | No changes in this release. | N/A |
| 5.3.2 | No changes in this release. | N/A |
| 5.3.1 | No changes in this release. | N/A |
| 5.3.0 | No changes in this release. | N/A |
| 5.2.4 | Improvements - Reworked host network attributes to capture multiple hostnames, DNS names, and IP addresses (public and private), plus a serial number, providing richer and more accurate host identity data. | • Host: Hostname, DNS name, and IP address attributes were restructured into multivalued attributes. Re-sync the connector to refresh the stored values. |
| 5.2.3 | No changes in this release. | N/A |
| 5.2.2 | No changes in this release. | N/A |
| 5.2.1 | No changes in this release. | N/A |
| 5.2.0 | Improvements Dependency Upgrades - Updated the connector framework ( connectors-model) to a newer baseline. | N/A |
| 5.1.13 | New Features - Violations now include extended evidence and cause-of-failure details when available from Qualys, giving more context for each compliance failure. | N/A |
| 5.1.12 | No changes in this release. | N/A |
| 5.1.11 | Improvements - Hosts now include a Network ID attribute when reported by Qualys. | N/A |
| 5.1.10 | No changes in this release. | N/A |
| 5.1.9 | Bug Fixes - Corrected the control and posture API request paths so requests are routed reliably. | N/A |
| 5.1.8 | Improvements - Added support for Asset Risk Score (ARS) query filters when synchronizing hosts. | N/A |
| 5.1.7 | Improvements - Controls now report a normalized severity (with severity score and source severity) derived from their criticality, and fetch full control detail from Qualys. Control attributes were re-keyed to a consistent, stable scheme. | • Control: Control attribute keys changed and a normalized severity was introduced. Re-sync the connector to refresh the stored values. |
| 5.1.6 | Improvements - Controls now map to the Violation Definition data model, aligning policy controls with the platform's finding-definition model. | • Control: The target data model changed to Violation Definition. Re-sync the connector so controls map to the correct model. |
| 5.1.5 | No changes in this release. | N/A |
| 5.1.4 | No changes in this release. | N/A |
| 5.1.3 | No changes in this release. | N/A |
| 5.1.2 | No changes in this release. | N/A |
| 5.1.1 | No changes in this release. | N/A |
| 5.1.0 | New Features - Added a configurable Max retries setting to control how many times failed requests to Qualys are retried. Improvements Dependency Upgrades - Upgraded the HTTP connector parent and connectors-model framework to a newer baseline. | N/A |
| 5.0.18 | No changes in this release. | N/A |
| 5.0.17 | No changes in this release. | N/A |
| 5.0.16 | Improvements - Attribute values that are null are now filtered out before being written, preventing empty values from appearing on synchronized objects. | N/A |
| 5.0.15 | No changes in this release. | N/A |
| 5.0.14 | Improvements - Refined host identity handling to use the unique identifier as an additional matching key, improving host correlation. | N/A |
| 5.0.13 | No changes in this release. | N/A |
| 5.0.12 | Improvements - Host asset categories are now reported as a multivalued attribute (so a cloud host can be both Host and Virtual Machine), and tags are exposed as a standard predefined attribute. | • Host: The category attribute was changed to a multivalued "categories" attribute. Re-sync the connector to refresh the stored values. |
| 5.0.11 | Improvements - Added Google Cloud Platform host attributes, a first-seen timestamp, and MAC address normalization for hosts. | N/A |
| 5.0.10 | Improvements - Host IP addresses are now classified as public or private, and host identity keys were updated to use public DNS name, hostname, and public IP address for more accurate correlation. | • Host: Host identity keys and IP address attributes changed. Re-sync the connector so hosts re-correlate correctly. |
| 5.0.9 | No changes in this release. | N/A |
| 5.0.8 | No changes in this release. | N/A |
| 5.0.7 | Improvements - Improved host identity matching by adding MAC address, instance ID, and hostname as identity keys, and normalized host categories and instance identifiers. | • Host: Host identity keys changed. Re-sync the connector so hosts re-correlate correctly. |
| 5.0.6 | Improvements - Refined how host names, IP addresses, and MAC addresses are extracted from cloud (EC2, Azure, GCP) metadata for more accurate host data. | N/A |
| 5.0.5 | Improvements - Hosts, controls, and violations now use refined unique-identifier mapping for more reliable correlation with existing records. | • Control, Violation: The redundant "Sys ID" attribute was removed (the value is already the object's unique identifier). Re-sync the connector to refresh the stored values. |
| 5.0.4 | No changes in this release. | N/A |
| 5.0.3 | No changes in this release. | N/A |
| 5.0.2 | No changes in this release. | N/A |
| 5.0.1 | No changes in this release. | N/A |
| 5.0.0 | Overview The Qualys Policy Compliance connector integrates with Qualys to synchronize compliance controls, control violations, and the hosts they are evaluated against. Category: Compliance Management Models | N/A |