Qualys Policy Compliance Reporting Service

Compliance Management

Overview

The Qualys Policy Compliance Reporting Service (PCRS) connector integrates with the Qualys Policy Compliance platform through its Posture Reporting Service APIs (pcrs/...) to synchronize compliance posture data into the Brinqa platform. All models are derived from a single posture-information feed (pcrs/3.0/posture/postureInfo), which is scoped by policy and host.

The connector synchronizes the following categories of data:

• Hosts — Host assets that appear in posture results
• Violation Definitions — Distinct compliance controls (deduplicated by control ID)
• Violations — Individual control posture results per host
• Policies — Distinct compliance policies (deduplicated by policy ID)

---

Data retrieved from Qualys Policy Compliance Reporting Service

Connector Object	Required	Maps to Data Model
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Host	Yes	Host
Policy	Yes	Policy

Model relationships

note

For detailed steps on how to view the data retrieved from Qualys Policy Compliance Reporting Service in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Qualys Policy Compliance Reporting Service from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API Server URL	Yes	https://gateway.<POD>.apps.qualys.com/	Qualys platform API server url
Username	Yes	—	Qualys user login
Password	Yes	—	Qualys user password
Page size	No	100	Maximum number of hosts to request per API request
Parallel requests	No	2 (or available processors)	Maximum number of parallel API requests
Maximum retries	No	5	The maximum number of retry attempts before giving up a request
API Timeout	No	300	The maximum time to wait for an API response in seconds. Maximum allowed value 300

Authentication

The connector authenticates using Username/Password credentials. A JWT bearer token is obtained from the Qualys gateway /auth endpoint and used for all subsequent API requests.

Endpoint

Method	URL
POST	{baseUrl}/auth

Request Body

The credentials are sent as form-encoded parameters:

username=<username>&password=<password>&token=true

Usage

Once authenticated, all subsequent API requests include the token as a standard header:

Authorization: Bearer <jwt-token>

---

Sync Behavior

The connector performs an incremental (delta) sync. When a sync token from a prior run is available, records are filtered by that timestamp; on the first run, or when no token is present, a full sync is performed.

---

How to obtain Qualys Policy Compliance Reporting Service credentials

Create a Qualys user

To ensure the user account that the Qualys PCRS connector uses to access the Qualys server has the appropriate permissions, follow these steps.

1. Log in to your organization's Qualys server.

2. Navigate to Users, and then select the Users tab.

3. Click New and select User. The New User dialog displays.

   

4. Fill out the general information.

5. Click User Role on the left menu.

   • From the User Role dropdown, select Reader.

   • Select GUI and API to enable API access, and leave Business Unit as Unassigned.

Note: GUI access allows the user to log in to the Qualys GUI (graphical user interface). After you create the new Qualys user, log in to the Qualys GUI using the new credentials. The system prompts the user to reset their password. The Qualys connector will not function until you complete the password reset.

6. Click Asset Groups.

   • From the Add asset groups dropdown, select All or only the asset groups the Qualys user needs access to.

7. Click Permissions and select all of the available permissions.

8. Click Options to modify the notification options as needed.

9. Click Save.

The new Qualys user with appropriate permissions to retrieve data displays on the Qualys Users page.

If you do not wish to create a new Qualys user, you can leverage an existing user with the appropriate permissions.

Note: If you do not have permissions to create a new Qualys user, contact your Qualys administrator. For additional information, see Qualys documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Violation

Source Field Name	SDM Attribute
CID- + info.controlId	TYPE
Derived from info.status / info.previousStatus	STATUS
Derived from status (open / closed)	STATUS_CATEGORY
info.causeOfFailure.missing.logic	CAUSE_OF_FAILURE_MISSING_LOGIC
info.causeOfFailure.missing.value	CAUSE_OF_FAILURE_MISSING_VALUE
info.causeOfFailure.unexpected.value	CAUSE_OF_FAILURE_UNEXPECTED
info.evidence.currentValues	EVIDENCE_CURRENT_VALUES
info.evidence.expectedValues	EVIDENCE_EXPECTED_VALUES
info.evidence.extendedEvidence	EXTENDED_EVIDENCE
info.firstFailDate	FIRST_FAILED
info.firstPassDate	FIRST_PASSED
info.hostId	TARGETS
info.id	UID
info.lastFailDate	LAST_FAILED
info.lastPassDate	LAST_PASSED
info.policyId	POLICY_ID
info.policyTitle	POLICY_TITLE
info.postureModifiedDate	SOURCE_LAST_MODIFIED
info.previousStatus	PREVIOUS_STATUS
info.status	SOURCE_STATUS
info.technology.name	TECHNOLOGY

Violation Definition

Source Field Name	SDM Attribute
Calculated from info.criticality.value	SEVERITY_SCORE
CID- + info.controlId	UID
CID- + info.controlId	NAME
info.controlStatement	STATEMENT
info.created	SOURCE_CREATED_DATE
info.criticality.value	SOURCE_SEVERITY
info.criticality.value (normalized)	SEVERITY
info.postureModifiedDate	SOURCE_LAST_MODIFIED
info.rationale	DESCRIPTION
info.remediation	RECOMMENDATION

Host

Source Field Name	SDM Attribute
"active" (normalized)	STATUS
"unknown"	SOURCE_STATUS
ASSET_CATEGORY_HOST	CATEGORIES
info.assetId	ASSET_ID
info.complianceLastScanDate	LAST_SCANNED
info.complianceLastScanDate	COMPLIANCE_LAST_DATE
info.created	SOURCE_CREATED_DATE
info.created	FIRST_SEEN
info.dns (private)	PRIVATE_DNS_NAMES
info.dns (public)	PUBLIC_DNS_NAMES
info.domainName	DOMAIN
info.hostId	UID
info.hostId	HOST_ID
info.instance	INSTANCE
info.ip	IP_ADDRESSES
info.ip (private)	PRIVATE_IP_ADDRESSES
info.ip (public)	PUBLIC_IP_ADDRESSES
info.ip / info.dns / info.netBios (first available)	NAME
info.lastEvaluatedDate	LAST_SEEN
info.netBios	NETBIOS
info.networkId	NETWORK_ID
info.networkName	NETWORK_NAME
info.os	OPERATING_SYSTEM
info.postureModifiedDate	SOURCE_LAST_MODIFIED

Policy

Source Field Name	SDM Attribute
info.policyId	UID
info.policyId	POLICY_ID
info.policyTitle	POLICY_TITLE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Violation

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the statusChangedSince sync token.

API

• Type: REST endpoint (JSON) · Endpoint: POST {baseUrl}/pcrs/3.0/posture/postureInfo
• Default filters: evidenceRequired=1, compressionRequired=0

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the statusChangedSince sync token.

API

• Type: REST endpoint (JSON) · Endpoint: POST {baseUrl}/pcrs/3.0/posture/postureInfo
• Default filters: evidenceRequired=1, compressionRequired=0

Host

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the statusChangedSince sync token.

API

• Type: REST endpoint (JSON) · Endpoint: POST {baseUrl}/pcrs/3.0/posture/postureInfo
• Default filters: evidenceRequired=1, compressionRequired=0

Policy

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the statusChangedSince sync token.

API

• Type: REST endpoint (JSON) · Endpoint: POST {baseUrl}/pcrs/3.0/posture/postureInfo
• Default filters: evidenceRequired=1, compressionRequired=0

Changelog

Changelog

The Qualys Policy Compliance Reporting Service connector has undergone the following changes:

Version	Description	Migration Steps
5.3.41	No changes in this release.	N/A
5.3.40	No changes in this release.	N/A
5.3.39	No changes in this release.	N/A
5.3.38	Bug Fixes - Corrected the Violation Definition "Source severity" attribute to be stored as text (was declared as a number), matching the value returned by the Qualys API.	• Violation Definition: the "Source severity" attribute changed from a number to text. Re-sync the Qualys_PCRS connector to repopulate these records.
5.3.37	No changes in this release.	N/A
5.3.36	Improvements Coding Standards Modernization - Bumped http-connectors-parent from 2.1.7 to 2.1.12 and connectors-model from 1.5.10 to 1.6.19 to align with the current connector framework baseline. - Replaced all new AttributeInfoBuilder(...) usages with AttributeInfos.newAttribute(...) across all model classes. This ensures custom attributes are registered with the correct consolidation priority, so they participate properly in attribute consolidation and value precedence. - Removed local addAttribute helper methods in favor of AttributeUtils.addAttribute from connectors-model, which prevents null values from silently reaching the attribute builder and adds type validation. - Migrated storage initialization from the deprecated LocalFactory / LocalConfig to StorageManager from connectors-model. - Removed the connector-local InstantDeserializer / InstantUtils in favor of OptionalInstantDeserializer from connectors-model, which supports a broader set of input formats. - Applied Spotless code formatting to the full codebase.	N/A
5.3.35	No changes in this release.	N/A
5.3.34	Improvements - Hardened large posture-data syncs against dropped connections. Premature end-of-chunk and connection-closed errors from the Qualys API are now treated as retryable, and the number of retry attempts honors the connector's configured maximum, reducing failed syncs on unstable networks.	N/A
5.3.33	No changes in this release.	N/A
5.3.32	No changes in this release.	N/A
5.3.31	New Features - Expanded the Host model with additional attributes: Host ID, Compliance last date, First seen, Last seen, Source created date, and Source last modified date, giving a fuller picture of each host's compliance scan history.	N/A
5.3.30	No changes in this release.	N/A
5.3.29	No changes in this release.	N/A
5.3.28	New Features - Added an "API read timeout" connector setting (default and maximum 300 seconds) so the time allowed for Qualys posture responses can be tuned per environment.	N/A
5.3.27	New Features - Added support for the "Exclude inactive control" sync option, allowing violations tied to inactive controls to be omitted from the posture data pulled from Qualys.	N/A
5.3.26	No changes in this release.	N/A
5.3.25	No changes in this release.	N/A
5.3.24	No changes in this release.	N/A
5.3.23	No changes in this release.	N/A
5.3.22	No changes in this release.	N/A
5.3.21	No changes in this release.	N/A
5.3.20	Improvements Dependency Upgrades - Upgraded the shared HTTP connector framework to 2.1.7.	N/A
5.3.19	No changes in this release.	N/A
5.3.18	No changes in this release.	N/A
5.3.17	No changes in this release.	N/A
5.3.16	New Features - Added "Evidence expected values" and "Evidence current values" attributes to the Violation model, surfacing the expected versus observed configuration values that explain why a control failed.	N/A
5.3.15	No changes in this release.	N/A
5.3.14	No changes in this release.	N/A
5.3.13	Improvements Dependency Upgrades - Added the JAXB runtime dependency to support XML data handling.	N/A
5.3.12	New Features - Added Technology, Policy ID, and Policy title attributes to the Violation model. Improvements - Consolidated the Violation Definition model's attribute set: the redundant "Technologies" and "Technology" attributes, along with Policy ID and Policy title, were removed from Violation Definition (this information is now carried on the Violation model where it is most relevant).	• Violation and Violation Definition: attribute sets changed (attributes added to Violation, removed from Violation Definition). Re-sync the Qualys_PCRS connector to repopulate these records.
5.3.11	No changes in this release.	N/A
5.3.10	No changes in this release.	N/A
5.3.9	No changes in this release.	N/A
5.3.8	Improvements - Increased the API read timeout to three minutes so long-running posture data requests against large subscriptions complete reliably.	N/A
5.3.7	Improvements - Parallelized violation retrieval by splitting host batches into concurrent requests, significantly speeding up posture data syncs for large environments. - Violations are now synchronized for all statuses rather than only failed or previously-failed controls, providing a complete compliance posture.	• Violation: the set of synced violations now includes all control statuses (previously limited to failed controls). Re-sync the Qualys_PCRS connector to capture the full set of violations.
5.3.6	No changes in this release.	N/A
5.3.5	No changes in this release.	N/A
5.3.4	No changes in this release.	N/A
5.3.3	No changes in this release.	N/A
5.3.2	Improvements Dependency Upgrades - Updated the connectors model library and local-store dependency, and removed the unused RocksDB dependency.	N/A
5.3.1	Bug Fixes - Corrected Policy ID, Violation Definition Policy ID, and Violation "Targets" values to be stored as text, matching the identifiers returned by the Qualys API and preventing inconsistent formatting of these fields.	• Policy, Violation Definition, and Violation: the Policy ID and Targets values changed from numeric to text. Re-sync the Qualys_PCRS connector to repopulate these records.
5.3.0	No changes in this release.	N/A
5.2.4	Improvements Dependency Upgrades - Updated the connectors model library, Woodstox XML parser, and Immutables annotation processor to current baselines.	N/A
5.2.3	No changes in this release.	N/A
5.2.2	No changes in this release.	N/A
5.2.1	No changes in this release.	N/A
5.2.0	Overview The Qualys Policy Compliance Reporting Service connector integrates with the Qualys Policy Compliance Reporting Service (PCRS) to synchronize compliance hosts, policies, control violations, and violation definitions. Category: Compliance Management Models	N/A